java client authenticating with remote security manager?

[mneilly <mn...@yahoo.com>]

Hi, I want to use Shiro for authenticating a java game client against a java
game server running the Shiro security manager. I've looked over the
tutorials/docs (and probably need to do so several more times) and seem to
be missing how to communicate the credentials from the client to the remote
server for authentication. 

>From the authentication reference
(http://shiro.apache.org/authentication.html) I see the basic steps:

1) Collect the Subject's submitted principals and credentials
2) Submit the principals and credentials for authentication.
3) If the submission is successful, allow access, otherwise retry
authentication or block access.
 
I can see how to do (1) and (3). I can see how to do (2) if everything is
handled in a single app but I'm missing how this happens over the network...
I can see the same issue arising for authorization and session management so
I must not be cluing into something obvious.

If somebody could point me in the right direction it would be much
appreciated. 

thanks
-M







--
View this message in context: http://shiro-user.582556.n2.nabble.com/java-client-authenticating-with-remote-security-manager-tp7579464.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: java client authenticating with remote security manager?

[mneilly <mn...@yahoo.com>]

BTW - if you're interested this seems to be a reasonable indication of the
current state of affairs in JME in regard to security. Maybe there is
opportunity for some sort of joint learning. :)

http://hub.jmonkeyengine.org/forum/topic/encryption-for-authentication/



--
View this message in context: http://shiro-user.582556.n2.nabble.com/java-client-authenticating-with-remote-security-manager-tp7579464p7579472.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: java client authenticating with remote security manager?

[mneilly <mn...@yahoo.com>]

Thank you for the response Jared. I got distracted by other tasks and wasn't
able to get back to this until now. :( 

I'm using JME3 which has it's own networking API (SpiderMonkey) for sending
messages between client and server. I need to ping the JME developers next
to make sure I haven't missed something but my impression is that there is
no significant support for security.

Originally, after looking at the architecture diagram for Shiro
(http://shiro.apache.org/assets/images/ShiroArchitecture.png) I had the
impression that it could handle the network transport between an application
and the security manager as well as between the security manager and a
backend database. 

Ie - I thought I could instance a Subject and a UsernamePasswordToken and
then Subject.login(token) would magically communicate over the network to
the the server running the security manager. I was trying to figure out how
the necessary information got communicated to enable that. Unfortunately,
I'm still at the point where I don't know what I don't know. :)

For now, I've decided to send the login and password in clear text to a
server implementing a Shiro SM and try to get things working on the server
side first. Hopefully that'll get me far enough along the learning curve on
both ends to have a better idea of what's really necessary in this type of
system. 

-M





--
View this message in context: http://shiro-user.582556.n2.nabble.com/java-client-authenticating-with-remote-security-manager-tp7579464p7579471.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: java client authenticating with remote security manager?

[Jared Bunting <ja...@peachjean.com>]

It all depends on how you plan to communicate with the game server.  If
you're using a restful interface, you would just declare the credentials in
your http client call.  If you're using a custom protocol, then how to send
the credentials is up to you.  If you'd like to share more about how you're
communicating with the game server, we can give further suggestions.

-Jared
On Dec 14, 2013 7:04 AM, "mneilly" <mn...@yahoo.com> wrote:

>
> Hi, I want to use Shiro for authenticating a java game client against a
> java
> game server running the Shiro security manager. I've looked over the
> tutorials/docs (and probably need to do so several more times) and seem to
> be missing how to communicate the credentials from the client to the remote
> server for authentication.
>
> From the authentication reference
> (http://shiro.apache.org/authentication.html) I see the basic steps:
>
> 1) Collect the Subject's submitted principals and credentials
> 2) Submit the principals and credentials for authentication.
> 3) If the submission is successful, allow access, otherwise retry
> authentication or block access.
>
> I can see how to do (1) and (3). I can see how to do (2) if everything is
> handled in a single app but I'm missing how this happens over the
> network...
> I can see the same issue arising for authorization and session management
> so
> I must not be cluing into something obvious.
>
> If somebody could point me in the right direction it would be much
> appreciated.
>
> thanks
> -M
>
>
>
>
>
>
>
> --
> View this message in context:
> http://shiro-user.582556.n2.nabble.com/java-client-authenticating-with-remote-security-manager-tp7579464.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>