db-derby-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From chaa...@apache.org
Subject svn commit: r1305386 - in /db/derby/docs/trunk/src/devguide: cdevcsecure90988.dita cdevcsecuree.dita
Date Mon, 26 Mar 2012 15:06:19 GMT
Author: chaase3
Date: Mon Mar 26 15:06:19 2012
New Revision: 1305386

URL: http://svn.apache.org/viewvc?rev=1305386&view=rev
Log:
DERBY-5636  Improve the overview of Derby's security mechanisms

Added more information and links to "Derby and security" overview, updated links and terminology
in "Signed jar files" topic.

Patch: DERBY-5636.diff

Modified:
    db/derby/docs/trunk/src/devguide/cdevcsecure90988.dita
    db/derby/docs/trunk/src/devguide/cdevcsecuree.dita

Modified: db/derby/docs/trunk/src/devguide/cdevcsecure90988.dita
URL: http://svn.apache.org/viewvc/db/derby/docs/trunk/src/devguide/cdevcsecure90988.dita?rev=1305386&r1=1305385&r2=1305386&view=diff
==============================================================================
--- db/derby/docs/trunk/src/devguide/cdevcsecure90988.dita (original)
+++ db/derby/docs/trunk/src/devguide/cdevcsecure90988.dita Mon Mar 26 15:06:19 2012
@@ -20,7 +20,7 @@ limitations under the License.
 -->
 <concept id="cdevcsecure90988" xml:lang="en-us">
 <title>Signed jar files</title>
-<shortdesc>In a Java 2 environment, <ph conref="../conrefs.dita#prod/productshortname"></ph>
can
+<shortdesc>In a Java SE environment, <ph conref="../conrefs.dita#prod/productshortname"></ph>
can
 detect digital signatures on jar files. When attempting to load a class from
 a signed jar file stored in the database, <ph conref="../conrefs.dita#prod/productshortname"></ph>
will
 verify the validity of the signature.</shortdesc>
@@ -34,7 +34,7 @@ only validates the integrity of the sign
 has not expired. <ph conref="../conrefs.dita#prod/productshortname"></ph> cannot
 ascertain whether the validity/identity of declared signer is correct. To
 validate identity, use a Security Manager (i.e., an implementation of <i>java.lang.SecurityManager</i>).</note>
-<p>When loading classes from an application jar file in a Java 2 environment, <ph
+<p>When loading classes from an application jar file in a Java SE environment, <ph
 conref="../conrefs.dita#prod/productshortname"></ph> behaves as follows: </p>
 <ul>
 <li><i>If the class is signed, <ph conref="../conrefs.dita#prod/productshortname"></ph>
will:</i> 
@@ -47,8 +47,9 @@ not, throw an exception. </li>
 <li>Check that the set of signing certificates are all valid for the current
 date and time. If any certificate has expired or is not yet valid, throw an
 exception.</li>
-<li>Pass the array of certificates to the <i>setSigners()</i> method of
<codeph><i>java.lang.ClassLoader</i></codeph>.
-This allows security managers to obtain the list of signers for a class (using <codeph><i>java.lang.Class.getSigners</i></codeph>)
+<li>Pass the array of certificates to the <i>setSigners()</i> method of
+<i>java.lang.ClassLoader</i>. This allows security managers to obtain the list
+of signers for a class (using <i>java.lang.Class.getSigners</i>)
 and then validate the identity of the signers using the services of a Public
 Key Infrastructure (PKI). </li>
 </ul></li>
@@ -56,10 +57,10 @@ Key Infrastructure (PKI). </li>
 <note><ph conref="../conrefs.dita#prod/productshortname"></ph> does not
provide
 a security manager.</note>
 <p>For more information about signed jar files, see <xref format="html"
-href="http://download.oracle.com/javase/6/docs/technotes/guides/jar/jar.html"
-scope="external">http://download.oracle.com/javase/6/docs/technotes/guides/jar/jar.html</xref>.</p>
+href="http://docs.oracle.com/javase/7/docs/technotes/guides/jar/jar.html"
+scope="external">http://docs.oracle.com/javase/7/docs/technotes/guides/jar/jar.html</xref>.</p>
 <p>For more information about Java security, go to <xref format="html"
-href="http://download.oracle.com/javase/6/docs/technotes/guides/security/"
-scope="external">http://download.oracle.com/javase/6/docs/technotes/guides/security/</xref>..</p>
+href="http://docs.oracle.com/javase/7/docs/technotes/guides/security/"
+scope="external">http://docs.oracle.com/javase/7/docs/technotes/guides/security/</xref>..</p>
 </conbody>
 </concept>

Modified: db/derby/docs/trunk/src/devguide/cdevcsecuree.dita
URL: http://svn.apache.org/viewvc/db/derby/docs/trunk/src/devguide/cdevcsecuree.dita?rev=1305386&r1=1305385&r2=1305386&view=diff
==============================================================================
--- db/derby/docs/trunk/src/devguide/cdevcsecuree.dita (original)
+++ db/derby/docs/trunk/src/devguide/cdevcsecuree.dita Mon Mar 26 15:06:19 2012
@@ -33,21 +33,77 @@ encryption</indexterm><indexterm>encrypt
 <p><ph conref="../conrefs.dita#prod/productshortname"></ph> supplies or
supports
 the following optional security mechanisms:</p>
 <ul>
-<li><i>User authentication</i>   <p><ph conref="../conrefs.dita#prod/productshortname"></ph>
verifies
-user names and passwords before permitting them access to the <ph conref="../conrefs.dita#prod/productshortname"></ph>
system.</p></li>
-<li><i>User authorization</i>   <p>A means of granting specific users
permission
-to read a database or to write to a database.</p></li>
-<li><i>Disk encryption</i>   <p>A means of encrypting <ph conref="../conrefs.dita#prod/productshortname"></ph>
data
-stored on disk.</p></li>
-<li><i>Validation of certificates for signed jar files</i>   <p><ph
conref="../conrefs.dita#prod/productshortname"></ph>
-validates certificates for classes loaded from signed jar files.</p>  </li>
-<li><i>Network encryption and authentication</i><p><ph
-conref="../conrefs.dita#prod/productshortname"></ph>
-network traffic may be encrypted with SSL/TLS. SSL/TLS certificate
-authentication is also supported. See <i>"Network encryption and authentication with
SSL/TLS"</i> in the
-<cite><ph conref="../conrefs.dita#pub/citadmin"></ph></cite> for
-details.</p></li> 
+<li><i>Authentication</i>
+<p>Authentication determines whether you are a legal user. It establishes your
+identity. <ph conref="../conrefs.dita#prod/productshortname"></ph> verifies
+user names and passwords before permitting access to the
+<ph conref="../conrefs.dita#prod/productshortname"></ph> system.</p>
+<p>For more information about authentication, see
+<xref href="cdevcsecure42374.dita#cdevcsecure42374"></xref>.</p></li>
+<li><i>Authorization</i>
+<p>Authorization determines what operations can be performed by you, that is, by
+your <ph conref="../conrefs.dita#prod/productshortname"></ph> identity. 
+Authorization grants users or roles permission to read a database or to write
+to a database.</p>
+<p>For more information about authorization, see
+<xref href="cdevcsecure36595.dita#cdevcsecure36595"></xref>.</p></li>
+<li><i>Disk encryption</i>
+<p><ph conref="../conrefs.dita#prod/productshortname"></ph> provides ways
to
+encrypt data stored on disk.</p>
+<p>For more information about encryption, see
+<xref href="cdevcsecure24366.dita#cdevcsecure24366"></xref>.</p></li>
+<li><i>Validation of certificates for signed jar files</i>
+<p><ph conref="../conrefs.dita#prod/productshortname"></ph> validates
+certificates for classes loaded from signed jar files.</p>
+<p>For more information about using signed jar files, see
+<xref href="cdevcsecure90988.dita#cdevcsecure90988"></xref>.</p></li>
+<li><i>Network encryption and authentication</i>
+<p><ph conref="../conrefs.dita#prod/productshortname"></ph> network traffic
may
+be encrypted with SSL/TLS. SSL/TLS certificate authentication is also supported.
+See "Network encryption and authentication with SSL/TLS" in the
+<ph conref="../conrefs.dita#pub/citadmin"></ph> for details.</p></li>

 </ul>
+<p>The section "Derby Network Server advanced topics" in the
+<ph conref="../conrefs.dita#pub/citadmin"></ph> has more information on
+security issues. The <ph conref="../conrefs.dita#pub/citref"></ph> describes
+many security-related properties and system procedures, as well as such
+statements as GRANT, REVOKE, CREATE ROLE, DROP ROLE, CREATE PROCEDURE, and
+CREATE FUNCTION.</p>
+<section><title>Identity in
+<ph conref="../conrefs.dita#prod/productshortname"></ph></title>
+<p><ph conref="../conrefs.dita#prod/productshortname"></ph> provides two
+kinds of identity:</p>
+<ul>
+<li><i>System-wide identity</i>: Currently, any legal system-wide identity
+enjoys authorization to perform the following operations:
+<ul>
+<li>Create databases</li>
+<li>Restore databases</li>
+<li>Shut down the <ph conref="../conrefs.dita#prod/productshortname"></ph>
+engine</li>
+</ul>
+</li>
+<li><i>Database-specific identity</i>: If you are a legal identity in a
specific
+database, you may enjoy the following rights:
+<ul>
+<li>You can connect to that database, provided that coarse-grained connection
+authorization has not been set to <i>noAccess</i>.</li>
+<li>You can shut down that database, encrypt it, and upgrade it, provided that
+you are the database owner.</li>
+<li>You can create your own SQL objects and write data to your own tables,
+provided that your coarse-grained connection authorization has not been set to
+<i>readOnlyAccess</i>.</li>
+<li>You can access other SQL objects, provided that the owners have granted you
+fine-grained SQL access to those objects, and provided you have not been limited
+by coarse-grained <i>readOnlyAccess</i>.</li>
+</ul>
+</li>
+</ul>
+<p>The distinction between fine-grained SQL authorization and coarse-grained
+connection organization is described in
+<xref href="cdevcsecure36595.dita#cdevcsecure36595"></xref>.</p>
+</section>
+<section><title>Security mechanisms in action</title>
 <p>The following figure shows some of the <ph conref="../conrefs.dita#prod/productshortname"></ph>
security
 mechanisms at work in a client/server environment. User authentication is
 performed by accessing an LDAP directory service. The data in the database
@@ -65,5 +121,6 @@ environment.</p>
 <image href="security2_os.gif" placement="break"><alt>This figure shows disk
encryption between the Derby engine and the database.</alt>
 </image>
 </fig>
+</section>
 </conbody>
 </concept>



Mime
View raw message