Re: replacing security service with JAAS

[Martin Poeschl]

Makes sense!!!

is is possibe to implement the JAAS api with the existing security system as backend (just for backwards compatibility)

martin

Rodrigo Reyes wrote:

Makes sense.
Still, I wasn't thinking about a demo for a commercial product. I was
thinking about a service which could become part of the Turbine code base,
as the Velocity Service or the Logging Service are. Something that could
give Turbine users the oportunity of having a Security Service which is not
tied to Torque (as the one Turbine has now). Makes sense?

Rodrigo

----- Original Message -----
From: "Clifton, Ryan" <[EMAIL PROTECTED]>
To: "Turbine Users List" <[EMAIL PROTECTED]>
Sent: Tuesday, February 11, 2003 7:57 PM
Subject: RE: replacing security service with JAAS

It sounds like you are releasing a demo for general consumption that

supports JAAS? In this case, you are correct that tying it to NT would
limit the number of people who could run it. The way I see it is that you
have a couple of options:

1) Write a proprietary JAAS implementation that isn't tied to any native

service. Design your implementation so that the interfaces are robust and
the API calls make sense for more complex environments, but the actual
implementation would be very simple since it's a demo and has to work for
everyone. This way when they buy your software, you could then build a
custom security implementation for them that ties into whatever they already
have. (I see several good things here.. they'll like it because it'll work
with their stuff and you'll like it because you get to make more money in a
service contract).

2) Ship the demo with a number of different JAAS implementations that the

customer can choose from (kinda like how Torque can work with different
databases, your demo would work with different security systems). Then just
write a configuration tool that lets the customer choose the implementation
they want to try.

Make sense?

-----Original Message-----
From: Rodrigo Reyes [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, February 11, 2003 4:48 PM
To: Turbine Users List
Subject: Re: replacing security service with JAAS


OK. Hope I get it right this time. Thanx.
Still, the problem I found about having a demo working with NT is that
we will be limiting the "out of the box" demo audience to people who have

a

working NT server (workstation?). I understand that it should be no

problem

to have it working with other authentication technologies (no business

rules

code change, right?), but even then there would be extra steps for someone
without the NT environment. Wouldn't it be easier for those users if we

used

some other (more universal) technology? It would be a step less, wouldn't
it?

Rodrigo

----- Original Message -----
From: "Clifton, Ryan" <[EMAIL PROTECTED]>
To: "Turbine Users List" <[EMAIL PROTECTED]>
Sent: Tuesday, February 11, 2003 7:22 PM
Subject: RE: replacing security service with JAAS

I think you may be a bit confused on what JAAS is/does. JAAS IS the

independent security technology you are speaking of. When broken down, it
amounts to a bunch of interfaces that allow it to be implemented into a

wide

variety of environments. So, for example, you can make a JAAS demo

working

with NT. JAAS itself has nothing to do with NT (thank god), the purpose
behind the API is to present a standard way of handling security to client
applications (your business logic). If implemented with a bit of
forethought, that JAAS demo working under NT could be ported to some other
security mechanism and the business logic of the demo should not have to
change.

Just to make sure I said that clearly, I'll explain it a different way.

Imagine you write a JUnit test called SecurityTest.java. SecurityTest

makes

a bunch of calls to your JAAS implementation that validates users and does
other neat things that JAAS provides. SecurityTest shouldn't know/care

how

this particular JAAS implementation works, so that if you re-implemented

it

to work with Oracle and a user DB, SecurityTest's tests would still run
perfectly.

Hope that helps a bit..

-----Original Message-----
From: Rodrigo Reyes [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, February 11, 2003 4:06 PM
To: Turbine Users List
Subject: Re: replacing security service with JAAS


I am a bit new to JAAS, but I thought JAAS would let us build a security
service independent of the authentication technology used behind. Am I
right? Another question: Is your tutorial winNT dependent? If it is, I
propose finding a universal authentication technology, so any one could

use

the service, no matter where they run it. Hope there is one :)

Rodrigo


----- Original Message -----
From: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, February 09, 2003 5:30 PM
Subject: RE: replacing security service with JAAS

I wouldn't mind collaborating. I have a JAAS tutorial where I can

query

if

a username/password/domain exists in NT. It seems to work quite well.

I

would like to use it as the first step in authenticating a user.

Eric

-----Original Message-----
From: Rodrigo Reyes [mailto:[EMAIL PROTECTED]]
Sent: Saturday, February 08, 2003 9:34 AM
To: Turbine Users List
Subject: Re: replacing security service with JAAS


I am interested in working on that.
I read the JAAS tutorial (I was looking for a service like this a

while

ago, but I couldn't find it until you menction it here) and it looks
flexible enough to me. I haven't used the security service Turbine

provides

because it is tightly integrated with Torque, and I am not using

Torque.

But

it seems it wouldn't be that hard to have Torque working with JAAS,

and

it

would also give other technologies the oportunity to colaborate in

Turbine

Security.
You may already know about this, but I will mection it here just

in

case

you don't. There is a service how-to for Turbine at

http://jakarta.apache.org/turbine/turbine-2.3/howto/services-howto.html.

It

doesn't look that hard to build one for JAAS. Maybe we could start

with

that.

Rodrigo

----- Original Message -----
From: "Marc Lustig" <[EMAIL PROTECTED]>
To: "Turbine Users List" <[EMAIL PROTECTED]>
Sent: Saturday, February 08, 2003 5:37 AM
Subject: replacing security service with JAAS

Hi,

is there any doc or code available for replacing the default

security

service and implementing Sun's JAAS ?
I like the idea to have a robust and standardized API, instead of

the

very

inflexible one that is currently integrated in Turbine.
If anybody has tried this I'd be interested to know about the amount

of

work

that needs to be done.

Marc

---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]