9:19 p.m.
Patch to provide a custom tomcat Realm to protect CS servlets with
both client authentication protection and simple authorization protection.
Testing instructions in the patch's checkin message.
7:31 p.m.
Based on ACK from alee, along with suggested minor changes.
Pushed to master.
----- Original Message -----
From: "John Magne" <jmagne(a)redhat.com>
To: pki-devel(a)redhat.com
Sent: Friday, March 9, 2012 7:19:29 PM
Subject: [Pki-devel] 0001-Provide-Custom-PKI-JNDI-Realm.patch
Patch to provide a custom tomcat Realm to protect CS servlets with
both client authentication protection and simple authorization protection.
Testing instructions in the patch's checkin message.
_______________________________________________
Pki-devel mailing list
Pki-devel(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-devel
8:45 p.m.
On 03/09/2012 10:19 PM, John Magne wrote:
Patch to provide a custom tomcat Realm to protect CS servlets with
both client authentication protection and simple authorization protection.
Testing instructions in the patch's checkin message.
_______________________________________________
Pki-devel mailing list
Pki-devel(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-devel
Sorry I missed this. This is really cool. Would you say that this is a
complete solution for the Authentication piece (Modulo maybe extending
the ACIs) or is there more work to be done.
Am I correct in understanding that this uses ACIs for Authorization?
8:47 p.m.
So while this is perfect for working with both PKI, and FreeIPA, for
most of the JNDI/LDAP world, authorization consists of membership in
groups. I believe the is how the original JNDI plugin works. When we
extract this into its own RPM, we should keep that in mind, and allow
the configuration to specify which way it is going to be used.
2:06 p.m.
Most of the acls support group membership as part of their contraints.
For this we make use of the inherited JNDI support to check to see if the user has the
given role/group membership. Also, the code calls the base class method for
authorization. Thus if the web.xml was configured with static roles and auth
constraints, those checks would be done as well.
----- Original Message -----
From: "Adam Young" <ayoung(a)redhat.com>
To: pki-devel(a)redhat.com
Sent: Wednesday, March 14, 2012 6:47:46 PM
Subject: Re: [Pki-devel] 0001-Provide-Custom-PKI-JNDI-Realm.patch
So while this is perfect for working with both PKI, and FreeIPA, for
most of the JNDI/LDAP world, authorization consists of membership in
groups. I believe the is how the original JNDI plugin works. When we
extract this into its own RPM, we should keep that in mind, and allow
the configuration to specify which way it is going to be used.
_______________________________________________
Pki-devel mailing list
Pki-devel(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-devel
4672
days inactive
4677
days old
4 comments
2 participants
participants (2)
-
Adam Young -
John Magne