Seperate instances of server class for authentication

Question

I'd like to implement some form of authentication in my server class. I thought about adding a few login routines and while the client hasn't authenticated itself all calls to functions other than the login stuff will throw Exceptions.
However, as I understand from the (in my opinion chaotic documentation and tutorial) every UnicastRemoteObject class is instanced only once and after that every client will use a threaded version of that same class instance... This would mean that if one client logs in, all clients log in as the object doesn't distinguise between clients.
So I either need a way to instance the server class for every client or (perhaps even more graceful) use a Login class that spawns a server class as soon as the login has been accepted.
Unfortunately I can't find anything on the web or the forums about this (lotsa problems like mine but either unanswered or different enough to be less than helpful).

Answer 1

I'd like to implement some form of authentication in
my server class. I thought about adding a few login
routines and while the client hasn't authenticated
itself all calls to functions other than the login
stuff will throw Exceptions.
However, as I understand from the (in my opinion
chaotic documentation and tutorial) every
UnicastRemoteObject class is instanced only once and
after that every client will use a threaded version
of that same class instance.No, you can have as many instances as you like but you have to start with a single object which is bound into the Registry. What you are after is a Session pattern like this:
public interface Login extends Remote
  Session login(String credentials) throws RemoteException;
public interface Session extends Remote
/// ... whatever you want
then a singleton instance of LoginImpl is bound to the registry, the client retrieves it, tries to get a Session by logging in. The implementation of login() just looks like this:
public Session login(String credentials) throws RemoteException
// check credentials, RemoteServer.getClientHost() &c:
if not acceptable throw new AccessException();
// otherwise
return new SessionImpl(credientials);
}Easy as pie.