3 ms·
Ahh, JAAS... Java applets were removed, but JAAS, which only existed to support applets, could not be removed because there was lots of code that depended on t
by cryptonector 1y ago
Ahh, JAAS... Java applets were removed, but JAAS, which only existed to support applets, could not be removed because there was lots of code that depended on the Login and Subject classes and the runAs() method. Why would such code exist though, if JAAS existed only to support applets? Well, because the Login class could be used to acquire credentials. For example the Krb5Login class could be used as a Java kinit in Kerberos environments.
Anyways, JAAS' Permission class and model are weak, but yeah, they could be used to limit libraries' capabilities. A capability model would be much better than a permission model.
- pjmlp 1y agoJAAS is on the death row and will be gone. https://openjdk.org/jeps/411 https://openjdk.org/jeps/411 https://openjdk.org/jeps/486 https://openjdk.org/jeps/486
- cryptonector 1y agoHmmm, but Login and Subject and related classes stick around, right?
- pjmlp 1y agoI wouldn't count on that, since Java 9 there has been a more agressive approach towards deprecated code, hence why @deprecated(forRemoval=true) is now possible. https://docs.oracle.com/en/java/javase/24/docs/api/java.base/javax/security/auth/Subject.html https://docs.oracle.com/en/java/javase/24/docs/api/java.base... => "The following methods in this class for user-based authorization that are dependent on Security Manager APIs are deprecated for removal: "
- cryptonector 1y agoApache code uses Login extensively. It uses it as a convenience kinit. Deprecating that will take time. The page you linked shows some methods of Subject are deprecated, but the things Apache code relies on are not going away.