File APIs for Java Developers
Manipulate DOC, XLS, PPT, PDF and many others from your application.
http://aspose.com/file-tools
The moose likes Security and the fly likes beginner question on JAAS: comprehension of some mechanics behind authorization Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login


Win a copy of Java 8 in Action this week in the Java 8 forum!
JavaRanch » Java Forums » Engineering » Security
Bookmark "beginner question on JAAS: comprehension of some mechanics behind authorization" Watch "beginner question on JAAS: comprehension of some mechanics behind authorization" New topic
Author

beginner question on JAAS: comprehension of some mechanics behind authorization

Ryan Weller
Greenhorn

Joined: Aug 16, 2012
Posts: 3
Hi, this is my first post, which is also a crosspost here at stackoverflow (I haven't got any answer until now ).

I'm trying to understand the method how JAAS works internally to authorize an user represented as a set of principals to access a given ressource.

I know that the checkPermission()-method of the AccessController is used for every method on the thread stack to verify that an access to a ressource in a given code section is permitted. I'm interested in the way when and how JAAS derives the required permissions for the code that's protected in the run()-method of the PrivilegedAction-Interface implementing class.

For better understanding let's assume for example that I have defined the grants in my policy file and want to use some code in the run()-method with restricted access to a) some system properties and b) a local directory.

Regards,
Ryan
Ryan Weller
Greenhorn

Joined: Aug 16, 2012
Posts: 3
No answer yet, seems like JAAS has gone out of use. I want to understand JAAS, but can't realize how it works. If it's the description of my problem that's to vague, maybe I should elaborate a bit more? It can't be to difficult, probably I have mistaken something completely and a simple hint will resolve this.

Hope someone can help...
Jaikiran Pai
Marshal

Joined: Jul 20, 2005
Posts: 9343
    
111

Ryan Weller wrote:

I'm trying to understand the method how JAAS works internally to authorize an user represented as a set of principals to access a given ressource.

I know that the checkPermission()-method of the AccessController is used for every method on the thread stack to verify that an access to a ressource in a given code section is permitted. I'm interested in the way when and how JAAS derives the required permissions for the code that's protected in the run()-method of the PrivilegedAction-Interface implementing class.

That's not JAAS actually. That's plain Java security. There's an extensive explanation of it here. Take a look at the links in the "Authentication and Access Control" row of the table there.

[My Blog] [JavaRanch Journal]
Ryan Weller
Greenhorn

Joined: Aug 16, 2012
Posts: 3
Jaikiran Pai wrote:
That's not JAAS actually. That's plain Java security.

Really? I thought the PrivilegedAction-Interface was actually introduced as a part of JAAS (which of course is built on top of plain Java security). I'm saying this, because my question is concerned with the access of various protected resources inside the run()-method. But probably you're right and my problem is more related to the underlying fundamentals

Jaikiran Pai wrote:
There's an extensive explanation of it here. Take a look at the links in the "Authentication and Access Control" row of the table there

Many thanks, I'll have a look at that.
 
I agree. Here's the link: http://aspose.com/file-tools
 
subject: beginner question on JAAS: comprehension of some mechanics behind authorization
 
Similar Threads
Implementing the User access in an application
how to configure and use "20100514-jaas-book-code " web JAAS Tutorial in ANT through Eclipse
Understanding JAAS/Web app SSO
how to configure and use "20100514-jaas-book-code " web JAAS Tutorial in ANT through Eclipse
Web Applications and JAAS