Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #29905

Re: application server, just without the "web" part...

Show key headers only | View raw

On Thu, 04 Sep 2014 07:36:22 +0000, Andreas Leitgeb wrote:

> Martin Gregorie <martin@address-in-sig.invalid> wrote:
>> On Wed, 03 Sep 2014 18:29:57 +0000, Martin Gregorie wrote:
>>> On Wed, 03 Sep 2014 17:51:45 +0000, Andreas Leitgeb wrote:
>>>> Meanwhile that's the remaining part of my problem. The authorization
>>>> should not be part of the protocol, but some local "challenge", that
>>>> only a particular user on the same machine can do. E.g. write to an
>>>> appropriately set up named pipe or unix domain socket. 
>>>> Unfortunately, Java doesn't seem to support unix domain sockets
>>>> without JNI, and named pipes have their own bag of downsides.  See
>>>> new thread "java unix domain sockets ..."
>>> I think you can do what you need with bog standard Java Sockets.
>>> Assuming that this program will be listening for incoming connections
>>> on a ServerSocket, if your first action after ServerSocket.accept()
>>> returns a Socket, is to call Socket.getInetAddress(). You can easily
>>> check whether the InetAddress it returns is a local loopback
>>> connection or not: if it is on the local loopback, the IP address will
>>> be 127.0.0.1 or the IPV6 equivalent.
>> I missed seeing the restriction to specific users on the local box. My
>> bad. Would requiring the authorised users to belong to a specific group
>> help solve the problem?
> 
> I'd be very curious about a mechanism that could be used to restrict the
> connecting user's group (even if that same mechanism couldn't also be
> used to restrict the user)
> 
> Admittedly, not so much for the task at hand, but for general
> learning...

AFAIK you can't do it in pure Java, but the possibilities are:

- run the groups utility via ProcessBuilder and examine the list of
  groups it returns. This is a Free Software Foundation utility program
  that  writes a space-delimited list of groups to stdout. Using it may
  be the easiest way to check group membership: obviously, once the group
  list has been retrieved it can be scanned by either client or server to
  see whether the caller is a member of the required group. 

- call getgrouplist() via JNI. getgrouplist() is a nonstandard function,
  but is available in Linux and (it says) most BSD versions. The manpage
  has an example utility that calls it.

- have the process call getgroups() via JNI, though this would only
  return the group ID of supplementary groups the process is a member of.

I hope this is useful info.


-- 
martin@   | Martin Gregorie
gregorie. | Essex, UK
org       |

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

application server, just without the "web" part... Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-05-14 19:16 +0000
  Re: application server, just without the "web" part... markspace <markspace@nospam.nospam> - 2014-05-14 13:23 -0700
  Re: application server, just without the "web" part... leif.roar@invalid.com (Leif Roar Moldskred) - 2014-05-14 16:57 -0500
    Re: application server, just without the "web" part... Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-05-15 14:16 +0000
  Re: application server, just without the "web" part... Arne Vajhøj <arne@vajhoej.dk> - 2014-05-14 19:46 -0400
    Re: application server, just without the "web" part... Joerg Meier <joergmmeier@arcor.de> - 2014-05-15 12:25 +0200
      Re: application server, just without the "web" part... Arne Vajhøj <arne@vajhoej.dk> - 2014-05-16 21:06 -0400
    Re: application server, just without the "web" part... Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-05-15 14:32 +0000
      Re: application server, just without the "web" part... Arne Vajhøj <arne@vajhoej.dk> - 2014-05-16 21:10 -0400
        Re: application server, just without the "web" part... Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-05-17 09:46 +0000
          Re: application server, just without the "web" part... Jeff Higgins <jeff@invalid.invalid> - 2014-05-17 07:42 -0400
            Re: application server, just without the "web" part... Jeff Higgins <jeff@invalid.invalid> - 2014-05-17 08:52 -0400
              Re: application server, just without the "web" part... Jeff Higgins <jeff@invalid.invalid> - 2014-05-17 09:07 -0400
                Re: application server, just without the "web" part... Jeff Higgins <jeff@invalid.invalid> - 2014-05-17 09:12 -0400
                Re: application server, just without the "web" part... Luuk <luuk@invalid.lan> - 2014-05-17 15:35 +0200
                Re: application server, just without the "web" part... Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-06-16 18:21 +0000
        Re: application server, just without the "web" part... "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-05-17 10:49 +0100
  Re: application server, just without the "web" part... Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-05-15 14:10 +0000
  Re: application server, just without the "web" part... "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-05-17 11:00 +0100
    Re: application server, just without the "web" part... Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-09-03 17:51 +0000
      Re: application server, just without the "web" part... Martin Gregorie <martin@address-in-sig.invalid> - 2014-09-03 18:29 +0000
        Re: application server, just without the "web" part... Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-09-03 18:43 +0000
        Re: application server, just without the "web" part... Martin Gregorie <martin@address-in-sig.invalid> - 2014-09-03 19:43 +0000
          Re: application server, just without the "web" part... Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-09-04 07:36 +0000
            Re: application server, just without the "web" part... Martin Gregorie <martin@address-in-sig.invalid> - 2014-09-04 12:13 +0000
              Re: application server, just without the "web" part... Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-09-05 00:43 +0000
                Re: application server, just without the "web" part... Martin Gregorie <martin@address-in-sig.invalid> - 2014-09-05 09:14 +0000
                Re: application server, just without the "web" part... Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-09-05 10:43 +0000
                Re: application server, just without the "web" part... Martin Gregorie <martin@address-in-sig.invalid> - 2014-09-05 21:45 +0000
  Re: application server, just without the "web" part... Roedy Green <see_website@mindprod.com.invalid> - 2014-06-20 08:09 -0700
  Re: application server, just without the "web" part... Roedy Green <see_website@mindprod.com.invalid> - 2014-06-20 08:13 -0700
    Re: application server, just without the "web" part... Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-09-03 17:33 +0000

csiph-web