Excerpt: Inside Java 2 Platform Security - 2nd Ed, published by Addison Wesley, 20038.4.1 Subjects and PrincipalsUsers often depend on computing services to assist them in performing work Furthermore, services themselves might subsequently interact with other services..
JaaS Uses The Term Subject To Refer to A System Entity, SUCH AS ASTEM Entity, Such As A User OR A Computing Service. JaaS use term Subject to represent system entities, such as one user or a computing service.
To identify the subjects with which it interacts, a computing service typically relies on names. However, a subject might not have the same name for each service and, in fact, may even have a different name for each individual service. Services typically relies on names To identify the subjects that interact with it. However, a Subject generally does not use the same name to face each service, in fact, even Subject will use different names to each service.
The term principal represents a name associated with a subject [71]. Because a subject may have multiple names, potentially one for each service with which it interacts, a subject in JAAS comprises a set of principals. The term principal represents a subject associated first name. Because a Subject can have multiple names, different names are used in order to interact with different services, and a Subject consists of a set of Principal.
Once a subject is authenticated, an instance of javax.security.auth.Subject is created to represent that subject and is populated with objects that implement the java.security.Principal interface. Once a subject is authenticated, the system generates a javax. Instance of Security.Auth.Subject to represent the subject, and add some objects that implement the Java.Security.Principal interface to the Subject instance.
Authentication represents the process by which one system entity verifies the identity of another and must be performed in a secure fashion;. Otherwise, an intruder may impersonate others to gain access to a system is a system authentication entity verifies the identity of another entity of the process And must be carried out in a safe way; otherwise the intruder will disguise into other entities into the system.
Authentication typically involves the subject demonstrating possession of some form of evidence to prove its identity. Such evidence may be information only the subject would be likely to know or have, such as a password or smart card, or that only the subject could produce, such As Signed Data Using A Private Key. When you are usually a Subject presents its evidence to prove its identity. These evidence can be aware of this subject, such as a password or a smart card. . . When it attempts to authenticate to a service, a subject typically provides the proof of its identity along with its name. If the authentication attempt succeeds, the service associates a service-specific Principal, using the given name, with the Subject. Applications and services CAN DETERMINE The Identity of the Subject Simply by Referencing The Relevant Principal Associated with That Subject. When it is tried to pass a service authentication, Subject usually provides its identification with its name. If the authentication is passed, the service will be the same as the name of the Principal and Subject associations, names, and Subject request authentication. Applications and services can identify the identity of Subject by referring to Subject associated with Principal.
Reliance on named principals usually derives from the fact that a service implements a conventional access control model of security [69]. This model allows a service to define a set of protected resources and the conditions under which named principals may access those resources. Named Principals is worth trustworthy, from services, generally implement the same access control security model by convention. This model allows services to define a collection of protected resources, as well as naming Principal to access these resources conditions.
Both KeyNote [14] and SPKI [34] have focused on the limitations of using conventional names in large distributed systems for access control and note that public keys, instead, provide a more practical and scalable name representation. JAAS and SPKI do not impose any restrictions on principal names. Localized environments that have limited namespaces or that do not rely on public-key cryptography may define principals that have conventional names. Large-scale distributed systems may use principals that allow the principal name to be a public key.8.4. 2 CredentialsIn addition to Principal information, some services may want to associate other security-related attributes and data with a Subject. JAAS calls such generic security-related attributes credentials. in addition to information Principal, and some services also need some other security Subjec related Properties and data. JAAS uses terminology Credential to represent these usual security related properties.
A credential may contain information that could be used to authenticate the subject to additional services. Some common types of credentials are passwords, Kerberos tickets [87] and public-key certificates. A credential might contain the subject to the information of other service authentication. Credentail is usually password, Kerberos Tickets, and public key certificates.
.
Credentials may also contain data that simply enables the subject to perform certain activities. Cryptographic keys, for example, represent credentials that enable the subject to sign or encrypt data. In JAAS, credentials may be any type of object. Therefore, existing credential implementations, such as java.security.cert.Certificate, can be easily incorporated into JAAS. Third-party credential implementations may also be plugged in to the JAAS framework.credentials may also contain some data, so that subject can perform some particular point activities. For example, contain Cryptographic Keys, Subject can sign or encrypt data. In the JAAS framework, Credential can make any type of object. Although Kerberos Tickets and Cryptographic Keys Exemplify Common Types of Credentials, Credentials Can Represent A Wider Range of Security-Related Data.
Applications running on behalf of subjects must coordinate with the services on which they depend so as to agree on the kinds of credentials that are needed and recognized during their interactions. Thus, some credentials might be standard or well recognized, whereas others might be application and Service specific.
In addition, credential implementations do not necessarily have to contain the security-related data;. They might simply reference that data This occurs when the data must physically reside on a separate server or hardware device, such as private keys on a smart card.
A subject must successfully authenticate to a service to obtain credentials. On successful authentication, the service creates the appropriate credential object and associates it with the Subject. Once a Subject has been populated with credentials, applications considered to be running on behalf of the subject may , with the proper permissions, then access and use those credentials. a subject must successfully pass certification services, in order to get credentials.JAAS does not impose any restrictions about credential delegation to third parties. Rather, JAAS either allows each credential implementation to specify ITS OWN Delegation Protocol, As Kerberos Does, or Leaves Delegation Decisions Up to the Applications.
JAAS divides each Subject's credentials into two sets. One set contains the subject's public credentials, such as public-key certificates. The other set stores the subject's private credentials, such as private keys, Kerberos tickets, encryption keys, passwords, and so on.
To access a Subject's public credentials, no permissions are required. However, access to a Subject's private credential set requires the caller to have been granted a PrivateCredentialPermission for the corresponding credential class.
