geronimo-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Dain Sundstrom <dsundst...@gluecode.com>
Subject Re: JNDI provider / remote jndi
Date Wed, 15 Sep 2004 16:01:06 GMT
On Sep 15, 2004, at 7:11 AM, Ken Horn wrote:

> Quick question on remote JNDI access.
>
> Does the java: provider below one provide remote access -- ie j2ee 
> client app?
>
> For security reasons, we want to be able to bind some/all resources 
> for a given app into a jndi tree (by any reasonable means: subtree / 
> provider / naming convention) that cannot be accessed outside of the 
> cluster. This will stop users who can authenticate to the container, 
> being able to write a client app, to pull (for example) a database 
> connection out of jndi and bypass business rules to hit the db 
> directly.

Ken,

I don't see how a remote client would be able to "pull" a database 
connection from jndi, since database connection is not serializable.

As for the meat of your question, I personally don't know the answer.

-dain


Mime
View raw message