Mailing-List: contact dev-help@geronimo.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@geronimo.apache.org
Received-SPF: pass (asf.osuosl.org: domain of ammulder@gmail.com designates
 66.249.92.194 as permitted sender)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
        s=beta; d=gmail.com;
        h=received:message-id:date:from:sender:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
        b=YKJEXuzCzvz+tyDOfvcOum0OptvirnuvjpcAtNX6Ces8wdUJ0oaxJJcGSW+LEKtEPnJXt4h3c+lWqHDlqswja9+8rR4fOq7TJy24Ma+8cApRAR0kFGGKeyzNgDlnFBWvMVOz6A3SSG9wctmdSMx/pCKP+hrr7nyZFbU+a+pKXuo=
Message-ID: <74e15baa0602060938i32dca602p82d65f3f66fd04f6@mail.gmail.com>
Date: Mon, 6 Feb 2006 12:38:13 -0500
From: Aaron Mulder <ammulder@alumni.princeton.edu>
Sender: ammulder@gmail.com
To: dev@geronimo.apache.org
Subject: Re: Default Security Principal & Role Mapping
In-Reply-To: <26E27098-2B62-41B4-8248-E2B169ED03EF@yahoo.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
References: <74e15baa0602060741h37e70bexa56d0b6bc56cbebf@mail.gmail.com>
	 <26E27098-2B62-41B4-8248-E2B169ED03EF@yahoo.com>

Great.

So my next question is CORBA.  If a CORBA client calls in to an EJB,
and we have it configured to accept principals the caller provides
(see below) then does role mapping (as configured in openejb-jar.xml)
apply to the principals we grant the CORBA caller?  If so, do they
need qualifying roles for the EJB they're actually invoking, or just
for calls out to other EJBs from there?

Thanks,
   Aaron

<tss:compoundSecMechTypeList>
  <tss:compoundSecMech>
    <tss:sasMech>
      <tss:identityTokenTypes>
        <tss:ITTPrincipalNameGSSUP
principal-class=3D"org.apache.geronimo.security.realm.providers.GeronimoUse=
rPrincipal"/>
        <tss:ITTDistinguishedName/>
      </tss:identityTokenTypes>
    </tss:sasMech>
  </tss:compoundSecMech>
</tss:compoundSecMechTypeList>


On 2/6/06, David Jencks <david_jencks@yahoo.com> wrote:
> Assuming the principal classes are the same, the unauthenticated user
> if given the admin role.
>
> IIUC Simon wants to make the default subjects generated by actual
> login, which might make this point a bit clearer.
>
>
> thanks
> david jencks
>
> On Feb 6, 2006, at 7:41 AM, Aaron Mulder wrote:
>
> > If I have a security configuration block like this, is an
> > unauthenticated user given the Admin role?  Or does role mapping
> > ignore the default principal?
> >
> > Thanks,
> >     Aaron
> >
> > <security>
> >   <default-principal>
> >     <principal class=3D"..." name=3D"bob" />
> >   </default-principal>
> >   <role-mappings>
> >     <role name=3D"Admin">
> >       <principal class=3D"..." name=3D"bob" />
> >     </role>
> >   </role-mappings>
> > </security>
>
>