Mailing-List: contact tomcat-user-help@jakarta.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <tomcat-user@jakarta.apache.org>
Message-ID: <3FCCAE4D.1050706@comcast.net>
Date: Tue, 02 Dec 2003 10:22:53 -0500
From: Christopher Schultz <christopher.d.schultz@comcast.net>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.5) Gecko/20031007
MIME-Version: 1.0
To: Tomcat Users List <tomcat-user@jakarta.apache.org>
Subject: Re: SessionListener
References: <805197E9D6BEE44C816B68DC4E2D373F15E22F@sfavb2.sfa.com>
In-Reply-To: <805197E9D6BEE44C816B68DC4E2D373F15E22F@sfavb2.sfa.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

Justin,

> Won't quite do it, JDBCRealm looks for users in a database, I want to
> connect a user TO a database using their credentials, but the code to
> do this feat will be quite minimal by comparison.

This will make it hard to use a connection pool (which you mentioned
that you do/want to do).

Is there a particular reason for the database access paranoia? Most apps
connect to the db using the same login regardless of the user actually 
logged in to the application. They use other types of permission 
checking to see if you can perform some action, instead of relying on 
thr database for that kind of checking.

I absolutely agree that having multiple layers of security is great, but 
this one may make your application suck really bad, especially if you 
are using a db like Oracle, where the database connections are anything 
but "lightweight".

-chris


---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org