Subject: Java GSS vs. JCA, JCE, JAAS, JSSE

From: Dave Arnold <[email-masked]>
Date: Mon, 21 Jun 1999 10:25:15 -0700

Hello everyone,

I just returned from the JavaOne conference in San Francisco.

There were a few sessions on Java Security given by the the Sun Security
team.  We attended the Security Birds-Of-a-Feather session with great
interest which was focused primarily on JCE with much attention given to
export restrictions for provider implementors.

At the BOF, we asked what Sun was doing with respect to Java GSS and they
didn't have an answer.  I have a feeling that some in attendance didn't know
what GSS is, which surprised me.

We were wondering if anybody on this list might be able to comment on the
future of Java GSS and how it will relate to JCE/JAAS.

Any thoughts?

Thanks,

Dave Arnold
mailto:[email-masked]
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: Mayank Upadhyay <[email-masked]>
Date: Mon, 21 Jun 1999 19:33:47 -0700 (PDT)

Dave,

Unfortunately I was at another BOF (JSSE) when you probably asked about
Java GSS at the JCE BOF. 

For those who were not present at Java One, JSSE is the Java Secure Socket
Extension (SSL), JCE is the Java Crypto API (encryption/decryption
algorithms), JAAS is a PAM like framework for authentication and
authorization, and JCA is the overall Provider based architecture. 

Sun does have an implementation of Java GSS but its not public at the
moment and is based on draft-ietf-cat-gssv2-javabind-00.txt. 

Ideally I would like to see JGSS be distributed with the other security
API's in Java but can't commit on that at present. JGSS can leverage the
provider architecture of JCA to allow apps to seamlessly install and
access different implementations of the GSS-API. One of my goals in the
next version of the Java language bindings draft (which will be out by
Friday) is to introduce some of the provider architecture to do this.

Besides that, a mechanism provider (say kerberos) that plugs underneath
JGSS can choose to use JCE for its crypto routines. Also, the same
provider might have classes that plugin underneath JAAS and obtain the
user's credentials when he logs in, and later pass the credentials to its
JGSS counterpart. 

As for today, there is an implementation of a Java GSS based on
draft-ietf-cat-gssv2-javabind-00.txt and supporting kerberos that you can
see at: 

  http://security.dstc.edu.au/projects/java/release4.html.

Its free for non-commercial use and comes with source code. 

-Mayank