rmi over ssl/tls, any way to securely identify the caller?

Question

hi everyone,

is there any way to securely get the method invoker while running the called method (server-side)?

i know there's a client string reachable through the server properties, but isn't it too "weak"? any way to get e.g. the client certificate owner?

please give me a couple of hints, WILL RTFD right afterwards ;)

thanks in advance

Answer 1

I haven't thought this through too thoroughly, but off-hand, I'd suggest a plugging in a custom TrustManager that, after authenticating the caller, associates the client certificate with the caller's thread. This could be done simply with a ThreadLocal, or using the JAAS architecture.