Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.

Bug 153850

Summary:	[sec] Support user authentication based on the JAAS login framework
Product:	[Eclipse Project] Equinox	Reporter:	Matt Flaherty <mwflaher>
Component:	Security	Assignee:	Security Inbox <equinox.security-inbox>
Status:	RESOLVED FIXED	QA Contact:
Severity:	enhancement
Priority:	P2	CC:	albert_silliman, jeffmcaffer, mkwhitacre, moz, ob1.eclipse, pascal, patrick, philippe_mulet, slewis, tjwatson
Version:	unspecified	Keywords:	plan
Target Milestone:	3.4
Hardware:	All
OS:	All
Whiteboard:
Bug Depends on:	198814, 199922
Bug Blocks:

Description Matt Flaherty

2006-08-14 22:03:27 EDT

Lotus shares the requirement with several customers at EclipseCon this year that requested the ability to secure the platform with a login infrastructure. Lotus would prefer that the infrastructure be based on Java Authentication and Authorization Service (JAAS), with the intention of enabling Subject based permission checking in a later release.

Comment 1 Oleg Besedin

2006-08-15 10:01:09 EDT

As an implementation note, it would be nice to have a button somewhere (status bar?) with a key or lock drawn on it. After clicking this button, user would be presented with a login dialog. Also, JAAS should allow more sophisticated login modules (smartcards etc.) to be used instead.

Once the base functionality is implemented, it will open some rather interesting areas for investigation:
- using OS login information / single login
- managing user capabilities based on the login credentials

Comment 2 Philipe Mulet

2007-03-26 10:02:40 EDT

Is anything planned for 3.3 ?

Comment 3 Jeff McAffer

2007-03-26 10:08:06 EDT

no, unfortunately the contribution did not come through in time.  We are hopeful for 3.4

Comment 4 Matt Flaherty

2007-08-08 18:07:15 EDT

Marking as plan.

Comment 5 Matt Flaherty

2008-03-10 15:50:47 EDT

Moving to Security component

Comment 6 Philipe Mulet

2008-05-16 04:09:55 EDT

Is this addressed in 3.4 already ?

Comment 7 Oleg Besedin

2008-05-16 10:41:42 EDT

Not really. The 3.4 contains adaptation of the JAAS framework for OSGi bundles world, and some initial bits of infrastructure but there is no code yet (neither a complete architecture) to obtain user's credentials.

Comment 8 Matt Flaherty

2008-05-16 11:40:30 EDT

Clarifying Oleg's comments.... The support for JAAS - in terms of extension-point based contribution, factories and an event model - is in place. This is good progress, and gives people something to play with and test out.

Going forward, we do need to make some ubiquitous support for asking 'who am I?' in any context. This will require wiring into the application lifecycle and dealing with the complexity of client threading models. This is 3.4+ work.

I'd call this one closed, and use this one:

https://bugs.eclipse.org/bugs/show_bug.cgi?id=218998

For future integration into the runtime.

Comment 9 Thomas Watson

2008-05-16 11:54:53 EDT

closing as fixed then.  Future work is tracked by bug 218998