Getting role attributes from loginHandler (LDAP)

[Cantor, Scott]

On 6/20/13 1:20 PM, "Byte Flinger" <byteflinger at gmail.com> wrote:

>If the Ldaploginmodule is already adding a role to the principal then it
>will be a custom principal regardless of whether I retrieve that data
>from it or not, no?

Yes, but there's a difference between relying on something and not relying
on it, if that information disappears across some boundary in the future.

>It's not about being an issue or not to do an extra ldap connection but
>more of an optimization thing since one less connection is always better.

No, it's not always better, that's my point. There are other
considerations.

>Regarding your last sentence, are you saying that the functionality of
>commiting a role exists solely for the purpose of making it harder to
>serialize the authentication result (which I am guessing, if so, is a
>security feature)?

No, it exists to add roles in JAAS. That has the effect of makng the
user's principal name an incomplete representation of the result. Custom
principals added to a Java Subject are not Serializable in Java, and
cannot be asked to persist themselves in any standard way, which means
preserving them in a cluster requires custom code that you would have to
plug into the IdP in a future version that's not using Terracotta. All to
avoid a meaningless, well-supported query to LDAP. It's not a good
trade-off.

-- Scott