Return-Path: Delivered-To: apmail-geronimo-dev-archive@www.apache.org Received: (qmail 43351 invoked from network); 31 Oct 2004 16:18:43 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (209.237.227.199) by minotaur-2.apache.org with SMTP; 31 Oct 2004 16:18:43 -0000 Received: (qmail 7241 invoked by uid 500); 31 Oct 2004 16:18:35 -0000 Delivered-To: apmail-geronimo-dev-archive@geronimo.apache.org Received: (qmail 7200 invoked by uid 500); 31 Oct 2004 16:18:34 -0000 Mailing-List: contact dev-help@geronimo.apache.org; run by ezmlm Precedence: bulk list-help: list-unsubscribe: list-post: Reply-To: dev@geronimo.apache.org Delivered-To: mailing list dev@geronimo.apache.org Received: (qmail 7186 invoked by uid 99); 31 Oct 2004 16:18:34 -0000 X-ASF-Spam-Status: No, hits=0.0 required=10.0 tests= X-Spam-Check-By: apache.org Received: from [192.18.33.10] (HELO exchange.sun.com) (192.18.33.10) by apache.org (qpsmtpd/0.28) with SMTP; Sun, 31 Oct 2004 08:18:33 -0800 Received: (qmail 21161 invoked from network); 31 Oct 2004 16:18:32 -0000 Received: from localhost (HELO nagoya) (127.0.0.1) by nagoya.betaversion.org with SMTP; 31 Oct 2004 16:18:32 -0000 Message-ID: <1967368065.1099239512086.JavaMail.apache@nagoya> Date: Sun, 31 Oct 2004 08:18:32 -0800 (PST) From: "Aaron Mulder (JIRA)" To: dev@geronimo.apache.org Subject: [jira] Created: (GERONIMO-409) SQLSecurityRealm/SQLLoginModule needs overhaul Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N SQLSecurityRealm/SQLLoginModule needs overhaul ---------------------------------------------- Key: GERONIMO-409 URL: http://issues.apache.org/jira/browse/GERONIMO-409 Project: Apache Geronimo Type: Bug Components: security Versions: 1.0-M2 Reporter: Aaron Mulder The SQLSecurityRealm and SQLLoginModule do not scale. In particular, they load all users and all groups in the security realm once when the realm is started, and again for every login request. Imagine a database of thousands of users/groups. There should instead be required SQL queries to load a single password given a username, and to load a list of groups for a single user given a username. Then there can be optional SQL queries to load a list of all users or to load a list of all groups, though we still shouldn't care who the group members are. Also, it appears that the digesting features provided by SQLSecurityRealmPasswordDigested are never invoked, so that class has no effect. It seems like the best way to implement digesting would be to make the basic SQLLoginModule take a digest algorithm argument. If present, the SQLLoginModule could instantiate and use a digester on the incoming password (and if not, not). Then we don't need any extra class for it, and you could enable digesting simply by adding a login module configuration option. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa - If you want more information on JIRA, or have a bug to report see: http://www.atlassian.com/software/jira