Mailing-List: contact dev-help@geronimo.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@geronimo.apache.org
Received-SPF: pass (nike.apache.org: domain of xhhsld@gmail.com designates
 74.125.92.24 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:date:message-id:subject:from:to:content-type;
        b=NkCCwIyDHfd7cceueEHnSTnwkjmjajaVnmXaYL9l1zDAnqxUOnwZ7bKTg1ZQmsx9pg
         bN0M4DGBGqlDATuw4M0JkZ5pe6K+Czv+cMEC6iOPiaRn3skQpbeSwvsdyqvKyQyJL9jc
         k0q9papd2R/l/IVPy3/Xia5ufPA30JrQxXNvo=
MIME-Version: 1.0
Date: Thu, 12 Nov 2009 18:27:29 +0800
Message-ID: <45f744e40911120227p3d2170f5tba3bee42aebbdd3c@mail.gmail.com>
Subject: User Admin Service in Geronimo 3.0 OSGI-Integration
From: Ivan <xhhsld@gmail.com>
To: dev@geronimo.apache.org
Content-Type: multipart/alternative; boundary=00151759031e87223f047829fdfe

--00151759031e87223f047829fdfe
Content-Type: text/plain; charset=ISO-8859-1

Hi,
    In the OSGI world, it uses User Admin service for authentication and
authorization. I am thinking what we could do between User Admin Service and
Geronimo 3.0.
    One side, is Geronimo possible to provide any User Admin service
implementation ? From my view, it is not. It seems that it is better for
those authentication provider to provide those implementations, such as LDAP
server, etc, not Geronimo. IIRC, Geronimo only ships a property file based
solution, and it is just a "doll" used for admin console.
    Anther side is that, is Geronimo possible to take advantage of User
Admin service ? Comparing with JAAS/JACC used in Geronimo now, User Admin is
a role-based security model. In my feeling, it is more general,
    a. It does not specify what and how to do in Java EE environment. While
in the Java world, specail permission objects are defined in JACC, like
WebResourcePermission for web application, EJBMethodPermssion for EJB
application, etc.
    b. The authorization way is also somewhat different.  In user admin
service, for each action, a group contains allowed users/groups is defined,
in the urntime, it will check whether the current context implies the group
object.
    So currently, for authentication, we might define a loginmodule based on
User Admin service; For authorization, no clear idea is seen by me :-(
   Not sure whether there are other sides that we could use it in Geronimo
3.0, thanks for any comment !

-- 
Ivan

--00151759031e87223f047829fdfe
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hi,<br>=A0=A0=A0 In the OSGI world, it uses User Admin service for authenti=
cation and authorization. I am thinking what we could do between User Admin=
 Service and Geronimo 3.0.<br>=A0=A0=A0 One side, is Geronimo possible to p=
rovide any User Admin service implementation ? From my view, it is not. It =
seems that it is better for those authentication provider to provide those =
implementations, such as LDAP server, etc, not Geronimo. IIRC, Geronimo onl=
y ships a property file based solution, and it is just a &quot;doll&quot; u=
sed for admin console.<br>
=A0=A0=A0 Anther side is that, is Geronimo possible to take advantage of Us=
er Admin service ? Comparing with JAAS/JACC used in Geronimo now, User Admi=
n is a role-based security model. In my feeling, it is more general, <br>=
=A0=A0=A0 a. It does not specify what and how to do in Java EE environment.=
 While in the Java world, specail permission objects are defined in JACC, l=
ike WebResourcePermission for web application, EJBMethodPermssion for EJB a=
pplication, etc. <br>
=A0=A0=A0 b. The authorization way is also somewhat different.=A0 In user a=
dmin service, for each action, a group contains allowed users/groups is def=
ined, in the urntime, it will check whether the current context implies the=
 group object.<br>
=A0=A0=A0 So currently, for authentication, we might define a loginmodule b=
ased on User Admin service; For authorization, no clear idea is seen by me =
:-(<br>=A0=A0 Not sure whether there are other sides that we could use it i=
n Geronimo 3.0, thanks for any comment !<br clear=3D"all">
<br>-- <br>Ivan<br>

--00151759031e87223f047829fdfe--