[Openjmx-devel] RMI Adaptor client authentication

[Bordet, Simone]

Hi all,

so I'm done with the JRMP over SSL adaptor, it works, I will commit it soon.

The last bit to be cleared is client authentication.

The HTTP adaptor support basic authentication (Carlos, some other that I don't know of - digest, etc ?), meaning that a user must login before getting something on the browser.

One can think that the same should be required for the RMI adaptor as well, but there is no standard here like there is for HTTP. So it must be done via API, for example via an RMIConnector.login() method.
But here it opens up a wide hole, since I may want to pass in user name and password, a X509 certificate, and so on.
Furthermore it should be done with JAAS.

Any idea or comments ?

We can also go with 1.0 without it, and do it for OpenJMX 1.1

Simon

[Carlos Quiroz]

Post by Bordet, Simone
Hi all,

Hi

Post by Bordet, Simone
so I'm done with the JRMP over SSL adaptor, it works, I will commit it soon.
The last bit to be cleared is client authentication.
The HTTP adaptor support basic authentication (Carlos, some other that I
don't know of - digest, etc ?), meaning that a user must login before
getting something on the browser.

Only basic is implemented. I found digest unecessary since SSL is available,
it can be easily implmented if required

Post by Bordet, Simone
One can think that the same should be required for the RMI adaptor as well,
but there is no standard here like there is for HTTP. So it must be done
via API, for example via an RMIConnector.login() method. But here it opens
up a wide hole, since I may want to pass in user name and password, a X509
certificate, and so on. Furthermore it should be done with JAAS.

What about a login(username, password) RMI method, that will go with SSL and
will be therfore protected. However, I think the best bet is to use client
authentication with certificates since that should be transparent and handled
at the SSL Factory level

Do you want to use JAAS to implement MBeanServer wide authentication, that
every adaptor will use?

Post by Bordet, Simone
Any idea or comments ?
We can also go with 1.0 without it, and do it for OpenJMX 1.1
Simon
_______________________________________________
Openjmx-devel mailing list
https://lists.sourceforge.net/lists/listinfo/openjmx-devel

[Bordet, Simone]

Hi,

Post by Bordet, Simone

Post by Bordet, Simone
One can think that the same should be required for the RMI

adaptor as well,

Post by Bordet, Simone
but there is no standard here like there is for HTTP. So it

must be done

Post by Bordet, Simone
via API, for example via an RMIConnector.login() method.

But here it opens

Post by Bordet, Simone
up a wide hole, since I may want to pass in user name and

password, a X509

Post by Bordet, Simone
certificate, and so on. Furthermore it should be done with JAAS.

What about a login(username, password) RMI method, that will
go with SSL and
will be therfore protected.

Yes, I was thinking at login(username, password), but it cannot go over SSL on this one only, unless providing another remote object that act as authenticator (which may be a good choice).
Once you export the RMI adaptor, either you export it over SSL or not. You cannot have some method yes and some no.

Post by Bordet, Simone
However, I think the best bet is
to use client
authentication with certificates since that should be
transparent and handled
at the SSL Factory level

Yes, exactly.
But it is really damn slow.
So I guess 95% of users would like to have a weak authentication only to keep out curioses (of course hackers will access eventually, but if there are hackers around I will go full SSL).
So I send user and password in clear, not even base64, just plain text.

Post by Bordet, Simone
Do you want to use JAAS to implement MBeanServer wide
authentication, that
every adaptor will use?

That would be the desiderata, but it is not so simple, since I should have callbacks on client and authentication on server...
JAAS is a very base framework, you have to build something around it in every case. The goal is to build something extendible, powerful, reusable, simple and fast around JAAS for our Adaptors ;)

Anyhow we can go 1.0 and think more about that for 1.1.

Simon