# Re: Request for 1.2 Feature

Li Gong (gong@games.eng.sun.com)
Thu, 15 Jan 1998 23:35:06 -0800

- Messages sorted by: [ date ][ thread ][ subject ][ author ]
- Next message: Dan Brown: "web page not available?"
- Previous message: STEVEN GOLDBERG: "?? Java Secure Channel"
- Maybe in reply to: jgindin@walldata.com: "Request for 1.2 Feature"

    Date: Thu, 15 Jan 1998 23:35:06 -0800

    Message-Id: <199801160735.XAA06797@games.eng.sun.com>

    From: Li Gong <gong@games.eng.sun.com>

    To: jgindin@walldata.com

    Subject: Re: Request for 1.2 Feature

    In-Reply-To: jgindin@walldata.com's mail of Wed, 14 January, 1998

Jay,

I understand the requested feature but do not understand fully the
problem you are trying to solve. Could you let us know the scenario
of the application so we can see what is the best way to address your
concern? More specifically, why it matters to you if the caller is a
particular type? What are you trying to determine here about the
caller? What about alternative solutions?

For example, suppose you want to have A call B but have B check if A
is an instance of X. You can do this by constructing a new class C
and have a method C.invokeB(A) -- you invoke the appropriate method on
B via C but passing A through as the real invoker.

B can now check if A is of the right instance. If so, B then does
whatever it needs to do. If B needs to return data Y to A, just add a
method A.getResult() and have B invokes it -- A.getResult(Y).

You may think C could lie, but there are ways to get that fixed. This
just shows there might be other ways to do something, so we may want
to figure out more back ground before committing to a feature.

Thanks.

Li

    --

    jgindin@walldata.com writes:
    > I need to be able to dynamically determine the caller of a particular
    > method.  I only want to allow objects that implement a particular
    > interface to call the method--if anyone else calls the method, I want to
    > be able to throw an exception.  The code would look something like this:
    >
    > public void foo() throws UnauthorizedCallerException
    > {
    >   Object caller = someSecurityApiToGetTheCaller();
    >   if ( caller instanceof ISecureObject ) {
    >     // Do work
    >   }
    >   else {
    >     throw new UnauthorizedCallerException();
    >   }
    > }
    >
    > I understand that the code that wants to call the
    > someSecurityApiToGetTheCaller() method may need to have privileges (as
    > defined in the 1.2 security documents), and that is perfectly acceptable
    > (probably even desirable!).
    >
    > There is an allusion to this sort of ability on 32 of the "Java Security
    > Architecture (JDK 1.2)" document, revision 0.7, dated October 1, 1997.
    >
    > I appreciate any help you are able to offer.
    >
    > Jay R. Gindin
    >
    > -----------------------------
    > Jay R. Gindin			| This
    > Senior Product Developer	|    space
    > Wall Data Incorporated	|      for
    > jgindin@walldata.com		|        rent!
    >
    >
    >

- Next message: Dan Brown: "web page not available?"
- Previous message: STEVEN GOLDBERG: "?? Java Secure Channel"
- Maybe in reply to: jgindin@walldata.com: "Request for 1.2 Feature"