You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@geronimo.apache.org by "Aaron Mulder (JIRA)" <de...@geronimo.apache.org> on 2004/11/02 05:50:32 UTC
[jira] Created: (GERONIMO-420) Refactor *UserPrincipal and *GroupPrincipal
Refactor *UserPrincipal and *GroupPrincipal
-------------------------------------------
Key: GERONIMO-420
URL: http://nagoya.apache.org/jira/browse/GERONIMO-420
Project: Apache Geronimo
Type: Improvement
Components: security
Versions: 1.0-M2
Reporter: Aaron Mulder
It would be nice if the default security realms all used the same user and group principal implementation classes. For one thing, the code is 99% identical across all 4 existing implementation classes. But also, these are essentially generic, and it would be nice to provide generic implementations of users and groups that custom login modules could take advantage of, instead of setting the precedent that every module must have a new and different set of principal classes.
If we truly make the user and group principals generic, we would lose the current behavior that equals() can distinguish between a SQLUserPrincipal "foo" and a PropertiesFileUserPrincipal "foo", but I'm not sure that's all that important anyway -- the required class name goes into the configuration files, so if the class name isn't correct then the principal needs to be discarded regardless of what equals() reports. Plus, a principal "foo" from FileRealm "bar" is not actually the same as a principal "foo" from FileRealm "baz" even though the user principal implementation classes and user principal names are both the same -- so the current equals implementation isn't fully correct anyway.
However, if we still want different classes for different realm types for any reason, we could at least put all the code in a base class and then have empty subclasses.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://nagoya.apache.org/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
[jira] Commented: (GERONIMO-420) Refactor *UserPrincipal and *GroupPrincipal
Posted by "Alan Cabrera (JIRA)" <de...@geronimo.apache.org>.
[ http://nagoya.apache.org/jira/browse/GERONIMO-420?page=comments#action_54926 ]
Alan Cabrera commented on GERONIMO-420:
---------------------------------------
Extraction of principals can be done by class. It might be helpful to still have the different principal classes.
In any case, using the the off the shelf login modules will give you many different kinds of principals; just try logging in via Kerberos, an NT domain, or a Solaris domain.
I guess that it's not clear to me that there is a problem here to solve.
> Refactor *UserPrincipal and *GroupPrincipal
> -------------------------------------------
>
> Key: GERONIMO-420
> URL: http://nagoya.apache.org/jira/browse/GERONIMO-420
> Project: Apache Geronimo
> Type: Improvement
> Components: security
> Versions: 1.0-M2
> Reporter: Aaron Mulder
>
> It would be nice if the default security realms all used the same user and group principal implementation classes. For one thing, the code is 99% identical across all 4 existing implementation classes. But also, these are essentially generic, and it would be nice to provide generic implementations of users and groups that custom login modules could take advantage of, instead of setting the precedent that every module must have a new and different set of principal classes.
> If we truly make the user and group principals generic, we would lose the current behavior that equals() can distinguish between a SQLUserPrincipal "foo" and a PropertiesFileUserPrincipal "foo", but I'm not sure that's all that important anyway -- the required class name goes into the configuration files, so if the class name isn't correct then the principal needs to be discarded regardless of what equals() reports. Plus, a principal "foo" from FileRealm "bar" is not actually the same as a principal "foo" from FileRealm "baz" even though the user principal implementation classes and user principal names are both the same -- so the current equals implementation isn't fully correct anyway.
> However, if we still want different classes for different realm types for any reason, we could at least put all the code in a base class and then have empty subclasses.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://nagoya.apache.org/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
[jira] Commented: (GERONIMO-420) Refactor *UserPrincipal and *GroupPrincipal
Posted by "Aaron Mulder (JIRA)" <de...@geronimo.apache.org>.
[ http://nagoya.apache.org/jira/browse/GERONIMO-420?page=comments#action_54935 ]
Aaron Mulder commented on GERONIMO-420:
---------------------------------------
I wouldn't say there's a problem... just room for improvement.
But when advising people on how to write their own LoginModule, it would be nice to say, "you need principal classes. If all you need are users and groups, you can (re)use GenericUserPrincipal and GenericGroupPrincipal."
Instead of "You need principal classes. Write your own, or copy and paste either PropertiesFileUserPrincipal and PropertiesFileGroupPrincipal or SQLUserPrincipal and SQLGroupPrincipal (they're the same anyway)."
You know?
> Refactor *UserPrincipal and *GroupPrincipal
> -------------------------------------------
>
> Key: GERONIMO-420
> URL: http://nagoya.apache.org/jira/browse/GERONIMO-420
> Project: Apache Geronimo
> Type: Improvement
> Components: security
> Versions: 1.0-M2
> Reporter: Aaron Mulder
>
> It would be nice if the default security realms all used the same user and group principal implementation classes. For one thing, the code is 99% identical across all 4 existing implementation classes. But also, these are essentially generic, and it would be nice to provide generic implementations of users and groups that custom login modules could take advantage of, instead of setting the precedent that every module must have a new and different set of principal classes.
> If we truly make the user and group principals generic, we would lose the current behavior that equals() can distinguish between a SQLUserPrincipal "foo" and a PropertiesFileUserPrincipal "foo", but I'm not sure that's all that important anyway -- the required class name goes into the configuration files, so if the class name isn't correct then the principal needs to be discarded regardless of what equals() reports. Plus, a principal "foo" from FileRealm "bar" is not actually the same as a principal "foo" from FileRealm "baz" even though the user principal implementation classes and user principal names are both the same -- so the current equals implementation isn't fully correct anyway.
> However, if we still want different classes for different realm types for any reason, we could at least put all the code in a base class and then have empty subclasses.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://nagoya.apache.org/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
[jira] Closed: (GERONIMO-420) Refactor *UserPrincipal and *GroupPrincipal
Posted by "Aaron Mulder (JIRA)" <de...@geronimo.apache.org>.
[ http://nagoya.apache.org/jira/browse/GERONIMO-420?page=history ]
Aaron Mulder closed GERONIMO-420:
---------------------------------
Resolution: Won't Fix
It turns out it's useful to be able to distinguish. Might want to move common code into a superclass, but don't want to replace subclasses.
> Refactor *UserPrincipal and *GroupPrincipal
> -------------------------------------------
>
> Key: GERONIMO-420
> URL: http://nagoya.apache.org/jira/browse/GERONIMO-420
> Project: Apache Geronimo
> Type: Improvement
> Components: security
> Versions: 1.0-M2
> Reporter: Aaron Mulder
>
> It would be nice if the default security realms all used the same user and group principal implementation classes. For one thing, the code is 99% identical across all 4 existing implementation classes. But also, these are essentially generic, and it would be nice to provide generic implementations of users and groups that custom login modules could take advantage of, instead of setting the precedent that every module must have a new and different set of principal classes.
> If we truly make the user and group principals generic, we would lose the current behavior that equals() can distinguish between a SQLUserPrincipal "foo" and a PropertiesFileUserPrincipal "foo", but I'm not sure that's all that important anyway -- the required class name goes into the configuration files, so if the class name isn't correct then the principal needs to be discarded regardless of what equals() reports. Plus, a principal "foo" from FileRealm "bar" is not actually the same as a principal "foo" from FileRealm "baz" even though the user principal implementation classes and user principal names are both the same -- so the current equals implementation isn't fully correct anyway.
> However, if we still want different classes for different realm types for any reason, we could at least put all the code in a base class and then have empty subclasses.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://nagoya.apache.org/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira