You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@avalon.apache.org by Adam Rossi <ad...@platinumsolutions.com> on 2002/06/28 04:53:17 UTC
current state of security
Hello. I am new to Avalon. I have read the "getting started" guide,
downloaded Avalon and the various subprojects, studied the sourcecode,
and tried to understand how the various components work together.
I am very interested in security. The getting started guide mentions
Guardian, but I have not been able to locate which project contains this
class. The mail archives mention something called Fortress, but the link
from the Avalon home page to Fortress is a dead link. The archives
describe various security initiatives, but I can't figure out how far
along these initiatives ever got. So I am writing this email. Please
excuse me for the blitz of questions below; I have tried to search
before posting.
What is the current state of security in Avalon? How does it work (in
general)?
Is Avalon compatible with JAAS?
What is Guardian?
What is Fortress?
A comment: What I have seen regarding security in Avalon seems to
concentrate more on component security, and which code should be allowed
to execute in the server. I am interested in code security, but I am
more interested in user-based security. How is user-based security
implemented in Avalon? Does Avalon provide Access Control Lists or
equivalent?
How do I administer security?
I would appreciate any information you can point me towards. Thanks!
Regards,
Adam Rossi
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: current state of security
Posted by Stephen McConnell <mc...@osm.net>.
Adam Rossi wrote:
>>There is a lot of discussion going on at the mment concerning
>>meta-models for components. Today - our sucurity policy approach is
>>"application" centric - and I think it could be interesting to explore a
>>more component centric model for security policy declaration at the meta
>>level.
>>
>>
>
>That would be very good. I would like to be able to assign security
>permissions to components through a central security manager, instead of
>having to code security calls directly into the component. Then, a
>container could be configured to enforce security on all components in a
>consistent fashion.
>
The sort of thing I'm thinking about is declaration of default static
security policy at the level of the component (in meta) and have a
container leverage this information, together with policy supplier by an
assembler enabling container based administration. The container based
administration can then be broken down into a internal set of security
mechansism (authentication, authorization, etc.) that could be leveraged
during deployment (assembly etc.). The more interesting bit would be
the way security services could be configurated so that administration
was transparent - [warning - Steve's thinking out loud] ... but there is
lots of room for ideas because we can introduce policy into both sides
of the equation (service provision and serive usage). A container could
provide proxies to service interfaces - in effect intercepting incomming
incovations and use this interception point to delegate access control
back to the managing container.
Steve.
--
Stephen J. McConnell
OSM SARL
digital products for a global economy
mailto:mcconnell@osm.net
http://www.osm.net
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: current state of security
Posted by Richard Wallace <rw...@a--i--m.com>.
If your interested in security components for avalon/phoenix check out
the project Larry McCay and I are have started at sourceforge (it's
there until we have something more substantial to put in cornerstone).
The project is aaa4avalon and we're trying to create a good component
oriented architecture for Authentication, Authentication and Auditing.
We're still in the very early stages (just getting done with the design
and initial implementation of some of the authen. components). Take a
look and feel free to contribute if you want.
Rich
On Fri, 2002-06-28 at 06:22, Berin Loritsch wrote:
> > From: Adam Rossi [mailto:adam.rossi@platinumsolutions.com]
> >
> > Thanks for your response Steve. I have a few comments below.
> >
> > <snip>
> > >
> > > >What is Guardian?
> > > >
> > >
> > > No idea.
> >
> > Gaurdian was a class discussed in the "Developing with Apache
> > Avalon" document. Here is a code snippet:
> >
> > public void compose(ComponentManager manager)
> > throws ComponentException
> > {
> > if (this.manager == null)
> > {
> > this.manager = manager;
> > myGuard = (Guardian) this.manager.lookup(Guardian.ROLE);
> > }
> > }
> >
> > /**
> > * This is the method that uses the Guardian.
> > */
> > public void myMethod()
> > throws SecurityException
> > {
> > this.myGuard.checkPermission(new BasicPermission("test"));
>
>
> >From the author of that guide:
>
> Guardian, like all the components in that guide are merely discussion
> points. It shows how you *might* implement security in a component
> oriented way. There has been no formal (or informal) research in this
> direction as of yet.
>
> If there are any interested parties in sponsering that research, I would
> be the first to offer my services. My contracting fee is fairly
> reasonable
> ($40 USD an hour).
>
> I was only half joking about that. I really want to do it, but the day
> job kind of gets in the way.
>
>
> > > >What is Fortress?
> > > >
> > >
> > > Nothing to do with security.
> > > Its basically a manager of components - (a container in Avalon
> > > terminology).
> >
> > I suspected that, but I could not check it out due to the web
> > site reorganization. Is there a direct URL to a place where I
> > can learn more about Fortress?
>
>
> We need to fix that.
>
> BTW, did you know that we have a user's list? It is more focused
> towards
> questions of this nature. If you are interested, the list is:
>
> avalon-users@jakarta.apache.org
>
> You can subscribe by the following email address:
>
> avalon-users-subscribe@jakarta.apache.org
>
>
> > > There is a lot of discussion going on at the mment concerning
> > > meta-models for components. Today - our sucurity policy
> > approach is
> > > "application" centic - and I think it could be interesting
> > to explore a
> > > more component centric model for security policy
> > declaration at the meta
> > > level.
> >
> > That would be very good. I would like to be able to assign
> > security permissions to components through a central security
> > manager, instead of having to code security calls directly
> > into the component. Then, a container could be configured to
> > enforce security on all components in a consistent fashion.
>
> :)
>
> That is the goal. This would work with a combination of Meta Data,
> JAAS (with the improved classloader security support), and a number
> of cues from J2EE security models.
>
> That is more the model I would prefer to design.
>
>
> --
> To unsubscribe, e-mail: <ma...@jakarta.apache.org>
> For additional commands, e-mail: <ma...@jakarta.apache.org>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: current state of security
Posted by Berin Loritsch <bl...@apache.org>.
> From: Adam Rossi [mailto:adam.rossi@platinumsolutions.com]
>
> Thanks for your response Steve. I have a few comments below.
>
> <snip>
> >
> > >What is Guardian?
> > >
> >
> > No idea.
>
> Gaurdian was a class discussed in the "Developing with Apache
> Avalon" document. Here is a code snippet:
>
> public void compose(ComponentManager manager)
> throws ComponentException
> {
> if (this.manager == null)
> {
> this.manager = manager;
> myGuard = (Guardian) this.manager.lookup(Guardian.ROLE);
> }
> }
>
> /**
> * This is the method that uses the Guardian.
> */
> public void myMethod()
> throws SecurityException
> {
> this.myGuard.checkPermission(new BasicPermission("test"));
>From the author of that guide:
Guardian, like all the components in that guide are merely discussion
points. It shows how you *might* implement security in a component
oriented way. There has been no formal (or informal) research in this
direction as of yet.
If there are any interested parties in sponsering that research, I would
be the first to offer my services. My contracting fee is fairly
reasonable
($40 USD an hour).
I was only half joking about that. I really want to do it, but the day
job kind of gets in the way.
> > >What is Fortress?
> > >
> >
> > Nothing to do with security.
> > Its basically a manager of components - (a container in Avalon
> > terminology).
>
> I suspected that, but I could not check it out due to the web
> site reorganization. Is there a direct URL to a place where I
> can learn more about Fortress?
We need to fix that.
BTW, did you know that we have a user's list? It is more focused
towards
questions of this nature. If you are interested, the list is:
avalon-users@jakarta.apache.org
You can subscribe by the following email address:
avalon-users-subscribe@jakarta.apache.org
> > There is a lot of discussion going on at the mment concerning
> > meta-models for components. Today - our sucurity policy
> approach is
> > "application" centic - and I think it could be interesting
> to explore a
> > more component centric model for security policy
> declaration at the meta
> > level.
>
> That would be very good. I would like to be able to assign
> security permissions to components through a central security
> manager, instead of having to code security calls directly
> into the component. Then, a container could be configured to
> enforce security on all components in a consistent fashion.
:)
That is the goal. This would work with a combination of Meta Data,
JAAS (with the improved classloader security support), and a number
of cues from J2EE security models.
That is more the model I would prefer to design.
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: current state of security
Posted by Adam Rossi <ad...@platinumsolutions.com>.
Thanks for your response Steve. I have a few comments below.
<snip>
>
> >What is Guardian?
> >
>
> No idea.
Gaurdian was a class discussed in the "Developing with Apache Avalon"
document. Here is a code snippet:
public void compose(ComponentManager manager)
throws ComponentException
{
if (this.manager == null)
{
this.manager = manager;
myGuard = (Guardian) this.manager.lookup(Guardian.ROLE);
}
}
/**
* This is the method that uses the Guardian.
*/
public void myMethod()
throws SecurityException
{
this.myGuard.checkPermission(new BasicPermission("test"));
>
> >What is Fortress?
> >
>
> Nothing to do with security.
> Its basically a manager of components - (a container in Avalon terminology).
I suspected that, but I could not check it out due to the web site
reorganization. Is there a direct URL to a place where I can learn more
about Fortress?
> There is a lot of discussion going on at the mment concerning
> meta-models for components. Today - our sucurity policy approach is
> "application" centic - and I think it could be interesting to explore a
> more component centric model for security policy declaration at the meta
> level.
That would be very good. I would like to be able to assign security
permissions to components through a central security manager, instead of
having to code security calls directly into the component. Then, a
container could be configured to enforce security on all components in a
consistent fashion.
Regards,
Adam
>
> Cheers, Steve.
>
> --
>
> Stephen J. McConnell
>
> OSM SARL
> digital products for a global economy
> mailto:mcconnell@osm.net
> http://www.osm.net
>
>
>
>
> --
> To unsubscribe, e-mail: <ma...@jakarta.apache.org>
> For additional commands, e-mail: <ma...@jakarta.apache.org>
>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: current state of security
Posted by Stephen McConnell <mc...@osm.net>.
Adam Rossi wrote:
>Hello. I am new to Avalon. I have read the "getting started" guide,
>downloaded Avalon and the various subprojects, studied the sourcecode,
>and tried to understand how the various components work together.
>
>I am very interested in security. The getting started guide mentions
>Guardian, but I have not been able to locate which project contains this
>class. The mail archives mention something called Fortress, but the link
>from the Avalon home page to Fortress is a dead link. The archives
>describe various security initiatives, but I can't figure out how far
>along these initiatives ever got. So I am writing this email. Please
>excuse me for the blitz of questions below; I have tried to search
>before posting.
>
>What is the current state of security in Avalon? How does it work (in
>general)?
>
The Phoenix project has some security related content - namely the
ability to declare security policies for a particular application (set
of components).
>Is Avalon compatible with JAAS?
>
Avalon Framework does not itself deal with security policies,
authentication, etc. It is certainly possible to build security
components using Avalon Franmework that leverage JASS.
>What is Guardian?
>
No idea.
>What is Fortress?
>
Nothing to do with security.
Its basically a manager of components - (a container in Avalon terminology).
>A comment: What I have seen regarding security in Avalon seems to
>concentrate more on component security, and which code should be allowed
>to execute in the server. I am interested in code security, but I am
>more interested in user-based security. How is user-based security
>implemented in Avalon? Does Avalon provide Access Control Lists or
>equivalent?
>
As far as I know thare are no security components for Avalon.
This would be a really interesting area.
>How do I administer security?
>
There is a lot of discussion going on at the mment concerning
meta-models for components. Today - our sucurity policy approach is
"application" centic - and I think it could be interesting to explore a
more component centric model for security policy declaration at the meta
level.
Cheers, Steve.
--
Stephen J. McConnell
OSM SARL
digital products for a global economy
mailto:mcconnell@osm.net
http://www.osm.net
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>