Ahh, originally I was thinking this list was specific for sshd, I didn't pay close enough attention to the list address it seems.
My question is specific to org.apache.sshd.server.PublickeyAuthenticator. It has a single method: boolean authenticate(String username, PublicKey key, ServerSession session) My implementation just checks if the a user (specified by the username parameter) has the same public key. We check for the key equality with another PublicKey the server already knows about. If the two keys match, we happily return true. We do nothing with the ServerSession. Is comparing two PublickKeys ( and username ) enough? Are there any other security concerns that I should have? Is anyone already using Shiro / JSecurity for authorization ? Thanks, -Brian On Tue, May 25, 2010 at 8:57 AM, David Latorre <[email protected]> wrote: > Hello Brian, > > I don't fully understand your question but the TLS handshake with > client-authentication is described in wikipedia at: > > http://en.wikipedia.org/wiki/Transport_Layer_Security#Client-authenticated_TLS_handshake > > You can see that the client uses its private key in order to sign some > of the 'handshake messages' (Certificate, ClientKeyExchange ) so in > order to authenticate a client, you should also check with the > client's public key that this signature is correct. > > > > 2010/5/24 Brian Demers <[email protected]>: > > I have a PublickeyAuthenticator, it is a pretty simple, I just check if > a > > public key is valid. > > > > I am just trying to verify this is all I need to worry about. > > Without knowing the details of ssl handshake, it struck me as odd to > just > > compair two public keys. Obviously the server does not have the clients > > private key. > > > > Just looking for a little reassurance. ( that I can add to my javadoc ) > > > > Also, anyone interested in an Apache Shrio (getting out of the incubator > > soon ) PasswordAuthenticator/PublickeyAuthenticator impl? (maybe a sub > > project?) > > > > Thanks, > > -Brian > > >
