Return-Path: X-Original-To: apmail-ace-commits-archive@www.apache.org Delivered-To: apmail-ace-commits-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id B69BB9B75 for ; Wed, 25 Apr 2012 09:59:11 +0000 (UTC) Received: (qmail 66446 invoked by uid 500); 25 Apr 2012 09:59:11 -0000 Delivered-To: apmail-ace-commits-archive@ace.apache.org Received: (qmail 66422 invoked by uid 500); 25 Apr 2012 09:59:11 -0000 Mailing-List: contact commits-help@ace.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@ace.apache.org Delivered-To: mailing list commits@ace.apache.org Received: (qmail 66414 invoked by uid 99); 25 Apr 2012 09:59:11 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 25 Apr 2012 09:59:11 +0000 X-ASF-Spam-Status: No, hits=-2000.0 required=5.0 tests=ALL_TRUSTED X-Spam-Check-By: apache.org Received: from [140.211.11.4] (HELO eris.apache.org) (140.211.11.4) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 25 Apr 2012 09:59:10 +0000 Received: from eris.apache.org (localhost [127.0.0.1]) by eris.apache.org (Postfix) with ESMTP id 3A4182388A29 for ; Wed, 25 Apr 2012 09:58:50 +0000 (UTC) Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: svn commit: r814365 - in /websites/staging/ace/trunk/content: ./ dev-doc/design/ace-authentication.html Date: Wed, 25 Apr 2012 09:58:50 -0000 To: commits@ace.apache.org From: buildbot@apache.org X-Mailer: svnmailer-1.0.8-patched Message-Id: <20120425095850.3A4182388A29@eris.apache.org> X-Virus-Checked: Checked by ClamAV on apache.org Author: buildbot Date: Wed Apr 25 09:58:49 2012 New Revision: 814365 Log: Staging update by buildbot for ace Modified: websites/staging/ace/trunk/content/ (props changed) websites/staging/ace/trunk/content/dev-doc/design/ace-authentication.html Propchange: websites/staging/ace/trunk/content/ ------------------------------------------------------------------------------ --- cms:source-revision (original) +++ cms:source-revision Wed Apr 25 09:58:49 2012 @@ -1 +1 @@ -1330176 +1330179 Modified: websites/staging/ace/trunk/content/dev-doc/design/ace-authentication.html ============================================================================== --- websites/staging/ace/trunk/content/dev-doc/design/ace-authentication.html (original) +++ websites/staging/ace/trunk/content/dev-doc/design/ace-authentication.html Wed Apr 25 09:58:49 2012 @@ -155,7 +155,7 @@

Enabling authentication in ACE

last updated: April 24th, 2012

Introduction

-

When provisioning software (partly) to targets, one has to rely upon the trustworthiness of both the network and the target. Even if everything is under your control and governance, one cannot entirely be sure that unwanted access takes place. A first step in order to prevent unwanted access is authentication, which gives you the ability to verify the identity of someone. Once the identity is known, one can apply authentication in order to determine what actions are allowed and which are not. +

When provisioning software (partly) to targets, one has to rely upon the trustworthiness of both the network and the target. Even if everything is under your control and governance, one cannot entirely be sure that unwanted access takes place. A first step in order to prevent unwanted access is authentication, which gives you the ability to verify the identity of someone. Once the identity is known, one can apply authorization in order to determine what actions are allowed and which are not. In this article, the recently added authentication layer of ACE is explained in more depth, and some details on how extensions can be written for additional mechanisms are given. The remainder of this article assumes the reader has basic knowledge of the principles behind ACE, and has sufficient programming skills. For this article, the latest code of ACE (0.8.1-SNAPSHOT, rev.1329269) was used.

Communication paths

Before going in more depth on the authentication layer of ACE, we first need to pinpoint all places were authentication is to be applied. The following figure shows the main components in ACE and their communication paths, providing a global overview of where authentication is applicable to ACE.