JAAS question...

[Joel Beach]

Hi everyone,

I am developing a Swing application at the moment and am a little confused
about JAAS. Mainly the authentication part of the equation. I want to use
a simple provider (as a prototype) which authenticates against something like
an XML file, with usernames and MD5-hashed passwords.

It seems that I need a Configuration telling JAAS how to authenticate and
so on, allowing me to plug in different ways to authenticate later without a
recompile.

My question is: How do you protect the text file containing the Configuration
from the user in Windows? Couldn't they simply edit it to point to some RDMBS
where they've setup some bogus user accounts?

Also, I realise that a user could also generate their own MD5 hash and edit
the XML file I'm authenticating against. For the prototype, I don't really
care about this, but I was wondering how people generally deal with users
editing files like this manually?

Thanks,

Joel

 

[Michiel Konstapel]

Hi everyone,

I am developing a Swing application at the moment and am a little confused
about JAAS. Mainly the authentication part of the equation. I want to use
a simple provider (as a prototype) which authenticates against something like
an XML file, with usernames and MD5-hashed passwords.

It seems that I need a Configuration telling JAAS how to authenticate and
so on, allowing me to plug in different ways to authenticate later without a
recompile.

My question is: How do you protect the text file containing the Configuration
from the user in Windows? Couldn't they simply edit it to point to some RDMBS
where they've setup some bogus user accounts?

Also, I realise that a user could also generate their own MD5 hash and edit
the XML file I'm authenticating against. For the prototype, I don't really
care about this, but I was wondering how people generally deal with users
editing files like this manually?

I think the general idea is that you have your user/pass values stored
securely on some server you control (or at least, the user doesn't).
Then you can have a JAAS client module on one end, communicating to a
server module on the other end, which does the actual database lookup.
Of course, the user can be assumed to have modified the client side
program, so your crucial business logic should also be run on the
server. If you let the client (application, applet, web app) talk
directly to the database, or execute privileged code, you must assume
this can be compromised.
Michiel