Realm in tomcat

[Jack <ja...@hotmail.com>]

In tomcat, "Realm" has such a definition: A Realm is a "database" of 
usernames and passwords that identify valid users of a web application (or 
set of web applications), plus an enumeration of the list of roles 
associated with each valid user. This is exactly a UserManager should do.



I guess the reason why we use "Realm" here is that at the beginning of the 
web, Realm is used to contain authorization & authentication together just 
like the MemoryRealm in Tomcat. With time, other things were removed from 
Realm gradually.



Actuall, realm should be a group of resources & the action can be performed 
on it.



Users will be prompted by such information: In order to allow you to access 
the realm: xxxxx, please provide us your identity. User can choose to 
provide certificate or username & password pair whatever is right. At the 
beginning of web, only username & password is used.



Apache is still using the "Realm" in its right meaning:
Realms: Areas of Controlled Access
In terms of voluntary control mechanisms on the Web, each protected area, 
whether it be a single document or an entire server, is called a realm. When 
a server challenges a client for credentials, it provides the name of the 
realm so the client can figure out which credentials to send.



Realm should return to its true meaning: a group of resources, like 
SecurityConstraint in tomcat.

We need to seperate UserManager from Realm.






---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Authorization in tomcat & JAAS

[Jack <ja...@hotmail.com>]

Where to specify the authorization
In JAAS, the authorization is specified in granting entries in the policy 
file, and it is implemented by java.security.ProtectionDomain. A granting 
entry grants rights to sourcecodes or principals/usernames. The action of 
authorization is done by java.lang.SecurityManager.

In tomcat, the authorization is specified in web-resource-collection & 
user-data-constraint elements in web-app (web.xml), and it is implemented by 
SecurityConstraint. (This is the Realm should be. At present, the Realm 
mixup usermanagement, authorization, authentication). In web.xml, the 
security-constraint element authorizes rights to roles. The action of 
authorization is done by Realm (hasResourcePermission, 
hasUserDataPermission.

I suggest to let Realm continue to act as a securityManager since we have 
SecurityContraint act as Realm already.




---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Realm in tomcat

[Bill Barker <wb...@wilshire.com>]

"Jack" <ja...@hotmail.com> wrote in message 
news:dqlta3$8q8$1@sea.gmane.org...
> In tomcat, "Realm" has such a definition: A Realm is a "database" of 
> usernames and passwords that identify valid users of a web application (or 
> set of web applications), plus an enumeration of the list of roles 
> associated with each valid user. This is exactly a UserManager should do.
>
>
>
> I guess the reason why we use "Realm" here is that at the beginning of the 
> web, Realm is used to contain authorization & authentication together just 
> like the MemoryRealm in Tomcat. With time, other things were removed from 
> Realm gradually.
>
>
>
> Actuall, realm should be a group of resources & the action can be 
> performed on it.
>
>
>
> Users will be prompted by such information: In order to allow you to 
> access the realm: xxxxx, please provide us your identity. User can choose 
> to provide certificate or username & password pair whatever is right. At 
> the beginning of web, only username & password is used.
>
>
>
> Apache is still using the "Realm" in its right meaning:
> Realms: Areas of Controlled Access
> In terms of voluntary control mechanisms on the Web, each protected area, 
> whether it be a single document or an entire server, is called a realm. 
> When a server challenges a client for credentials, it provides the name of 
> the realm so the client can figure out which credentials to send.
>
>
>
> Realm should return to its true meaning: a group of resources, like 
> SecurityConstraint in tomcat.
>
> We need to seperate UserManager from Realm.

Patches are always welcome ;-).




---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org