Patch to provide a custom tomcat Realm to protect CS servlets with both client authentication protection and simple authorization protection. Testing instructions in the patch's checkin message.
Based on ACK from alee, along with suggested minor changes. Pushed to master. ----- Original Message ----- From: "John Magne" <jmagne@redhat.com> To: pki-devel@redhat.com Sent: Friday, March 9, 2012 7:19:29 PM Subject: [Pki-devel] 0001-Provide-Custom-PKI-JNDI-Realm.patch Patch to provide a custom tomcat Realm to protect CS servlets with both client authentication protection and simple authorization protection. Testing instructions in the patch's checkin message. _______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
On 03/09/2012 10:19 PM, John Magne wrote:
Patch to provide a custom tomcat Realm to protect CS servlets with both client authentication protection and simple authorization protection.
Testing instructions in the patch's checkin message.
_______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
Sorry I missed this. This is really cool. Would you say that this is a complete solution for the Authentication piece (Modulo maybe extending the ACIs) or is there more work to be done. Am I correct in understanding that this uses ACIs for Authorization?
So while this is perfect for working with both PKI, and FreeIPA, for most of the JNDI/LDAP world, authorization consists of membership in groups. I believe the is how the original JNDI plugin works. When we extract this into its own RPM, we should keep that in mind, and allow the configuration to specify which way it is going to be used.
Most of the acls support group membership as part of their contraints. For this we make use of the inherited JNDI support to check to see if the user has the given role/group membership. Also, the code calls the base class method for authorization. Thus if the web.xml was configured with static roles and auth constraints, those checks would be done as well. ----- Original Message ----- From: "Adam Young" <ayoung@redhat.com> To: pki-devel@redhat.com Sent: Wednesday, March 14, 2012 6:47:46 PM Subject: Re: [Pki-devel] 0001-Provide-Custom-PKI-JNDI-Realm.patch So while this is perfect for working with both PKI, and FreeIPA, for most of the JNDI/LDAP world, authorization consists of membership in groups. I believe the is how the original JNDI plugin works. When we extract this into its own RPM, we should keep that in mind, and allow the configuration to specify which way it is going to be used. _______________________________________________ Pki-devel mailing list Pki-devel@redhat.com https://www.redhat.com/mailman/listinfo/pki-devel
participants (2)
-
Adam Young -
John Magne