Security & Servlet engine and ejb container on different servers

Question

          When you have the servlet container and the ejb container on different physical servers,
          how is the rmi connection meant to to be done while still maintaining the seucrity
          propagation from servlet to ejb tier?
          Assume that my user is already authenticated (forms) on the servlet tier. Do we then
          create a dedicated connection (InitialContext + url/username/password properties)
          to the ejb tier and store this connection in the HttpSession? (basically authenticating
          a 2nd time)
          OR,
          can the servlet container make a generic connection to the ejb container, and pass
          the users security context to the ejb tier transparantly?
          -Sam
          

Answer 1

Nick Minutello <[email protected]> wrote:
          > Assuming that web container security is being employed, I guess the fundamental question
          > is: Is it necessary to create a "connection" (ie. an InitialConext) per user, or
          > can a "global" initial context be shared (in the end, the TCP connection is shared
          > anyway)?
          It doesn't create a 'connection' per user - when you use JNDI authentication (specifying
          principal and credentials when constructing InitialContext) it associates security info
          with the current thread for the duration of the request. If you cache InitialContext and
          use it later on some other thread it will not do anything.
          > Does it really matter?
          No ;-)
          > Thanks,
          > Nick
          > "Dimitri I. Rakitine" <[email protected]> wrote:
          >>Nick Minutello <[email protected]> wrote:
          >>
          >>
          >>> OK, so when I create the InitialContext, I just specify the URL (to call
          >>the remote
          >>> EJB container). The user ID and credentials are mapped automatically.
          >>
          >>> I obviously also need to cache the initialContext variable in my HTTPSession
          >>object?
          >>
          >>> What would happen if I had one InitialContext for the whole servlet engine
          >>- and
          >>> each thread used that. Would the thread (security) context still get passed
          >>- or
          >>> would the credentials for the original connection get used?
          >>
          >>If you use web-app security, container will associate security info with
          >>the current
          >>thread before invoking your servlet. If you do not use it and cache InitialContext,
          >>
          >>then the current user will always be 'guest' (except for the very first
          >>time when
          >>application calls 'new InitialContext()' with username/password.
          >>
          >>
          >>> Thankyou.
          >>> -Sam
          >>
          >>
          >>> "Vinod Mehra" <[email protected]> wrote:
          >>>>
          >>>>"Sam the bad cat" <[email protected]> wrote in message
          >>>>news:[email protected]...
          >>>>>
          >>>>>
          >>>>> When you have the servlet container and the ejb container on different
          >>>>physical servers,
          >>>>> how is the rmi connection meant to to be done while still maintaining
          >>>>the
          >>>>seucrity
          >>>>> propagation from servlet to ejb tier?
          >>>>>
          >>>>> Assume that my user is already authenticated (forms) on the servlet
          >>tier.
          >>>>Do we then
          >>>>> create a dedicated connection (InitialContext + url/username/password
          >>>>properties)
          >>>>> to the ejb tier and store this connection in the HttpSession? (basically
          >>>>authenticating
          >>>>> a 2nd time)
          >>>>>
          >>>>> OR,
          >>>>> can the servlet container make a generic connection to the ejb container,
          >>>>and pass
          >>>>> the users security context to the ejb tier transparantly?
          >>>>
          >>>>If the user has logged in already, ie the authenticated user is already
          >>>>in
          >>>>the execute
          >>>>thread, the identity should be propgated to the ejb tier transparantly,
          >>>>when
          >>>>you create the
          >>>>new initial context.
          >>>>
          >>>>--Vinod.
          >>>>
          >>>>
          >>>>>
          >>>>> -Sam
          >>>>>
          >>>>>
          >>>>
          >>>>
          >>
          >>--
          >>Dimitri
          >>
          Dimitri