Discussions

News: JSR 196: pluggable authentication for JEE containers early draft

Bookmark and Share Get thread feed

  1. JSR 196: pluggable authentication for JEE containers early draft (6 messages)

    After nearly 3 years since the expert group formed, an early draft review of JSR 196, Java Authentication Service Provider Interface for Containers has been released for review. The spec is intended for security & user management product vendors (not application developers). The spec will create standard ways for third party authentication providers to integrate with any JEE appserver, as opposed to the current situation where security/user management vendors need to implement custom, per-appserver interfaces (like weblogic.security.spi.AuthenticationProvider) to plug-in to those appservers.

    The points at which this integration can occur are described in the spec:
    A typical message interaction between a client and server begins with a request from the client to the server. The server recieves the request and dispatches it to a service to perform the requested operation. When the service completes, it creates a response that is returned back to the client.

    The SPI defined by the specification is structured such that message processing runtimes can inject security processing at four points in the typical message interaction scenario. A message processing runtime uses the SPI at these points to delegate the corresponding message security processing to an authentication provider or module integrated into the runtime by way of the SPI.
    The four points of interception consist of two on the client side (upon first request and just before receipt of response), and on the server side (at receipt of request, and after execution of the request.

    Updated - originally this news item had the wrong JSR number, thanks to those who pointed that out.
    Reply to this

    Threaded Messages (6)

  2. JSR 196: pluggable authentication for JEE containers early draft[ Go to top ]

    Is it easier to delete the news item than to change the topic? Time for a system update perhaps...
    Reply to this Reply to original

  3. JSR 196: pluggable authentication for JEE containers early draft[ Go to top ]

    I didn't delete the news item. I deleted the comments mentioning that the title was wrong, since i corrected the title and thus the comments themselves were no longer adding value.

    Floyd
    Reply to this Reply to original

  4. nnot for develoers[ Go to top ]

    ... management product vendors (not application developers) ...

    Only a manager or a vendor would need this?

    .V
    Reply to this Reply to original

  5. Acegi[ Go to top ]

    Any idea how this JSR relates to something like Acegi?
    Reply to this Reply to original

  6. Acegi[ Go to top ]

    Acegi doesn't rely on J2EE authentication but use their own mechanism. Haven't read the JSR 196 yet but I think that i´t would be possible for Acegi to act as a authentication provider (I am not an ACEGI expert though)

    Frank
    Reply to this Reply to original

  7. Acegi - Pluggable Security Frameworks[ Go to top ]

    I posted these comments on JSR196 on my blog. I found this comment from the spec interesting.

    <blockquotes>Implementations also have custom logic to determine what modules to invoke, and in what order</blockquotes>

    Basically the spec does not provide any guidelines around the interaction of the authentication modules. Am I getting this right?

    Regards,

    David Le Strat.
    Reply to this Reply to original