If GSI Secure Transport or GSI Secure Conversation is used, the org.globus.axis.gsi.GSIConstants.GSI_AUTHORIZATION property must be set on the stub. The value of this property must be an instance of an object that extends from org.globus.gsi.gssapi.auth.GSSAuthorization. All distributed authorization schemes have implementation in org.globus.gsi.gssapi.auth package.

For all other authentication schemes, the org.globus.wsrf.impl.security.Constants.AUTHORIZATION property must be set on the stub. The value of this property must be an instance of an object that implements the org.globus.wsrf.impl.security.authorization.Authorization interface.

Example:

      // Create endpoint reference EndpointReferenceType
      endpoint = new EndpointReferenceType(); 
      // Set address of service
      String counterAddr = 
         "http://localhost:8080/wsrf/services/CounterService";
      // Get handle to stub object
      CounterPortType port = 
           locator.getCounterPortTypePort(endpoint);
      // set client authorization to self 
      ((Stub)port)._setProperty(Constants.AUTHORIZATION, 
                   SelfAuthorization.getInstance());
            

If the authentication scheme to be used is GSI Secure Transport or GSI Secure Conversation, the custom authorization scheme should extend from extends from org.globus.gsi.gssapi.auth.GSSAuthorization.

      public class TestAuthorization extends GSSAuthorization {
      
        // Provide some way to instantiate this class. Can use constructor
        // with arguments to pass in parameters.
         public TestAuthorization() {

         }

         public GSSName getExpectedName(GSSCredential cred, String host) 
            throws GSSException {

            // Return the expected GSSName of the remote entity.
         }


          public void authorize(GSSContext context, String host)
	     throws AuthorizationException {      

             // Perform the authorization steps.
             // context.getSrcName() provides the local GSSName
             // context.getTargName() provides the remote GSSName

             // if authorization fails, throw AuthorizationException
         }
      }
      

The following describes the steps done for client side authorization during context establishment:

	Note
	Client authorization is done prior to invocation.

To configure the custom authorization scheme:

      ((Stub)port)._setProperty(GSIConstants.GSI_AUTHORIZATION, 
                   new TestAuthorization());
      

Various authorization scheme implementations in package org.globus.gsi.gssapi.auth would serve as examples. View CVS Link

For all authentication schemes other than those in previous step the org.globus.wsrf.impl.security.Constants.AUTHORIZATION property must be set on the stub. The value of this property must be an instance of an object that implements the org.globus.wsrf.impl.security.authorization.Authorization interface.

      public class TestAuthorization implements Authorization {
      
        // Provide some way to instantiate this class. Can use constructor
        // with arguments to pass in parameters.
         public TestAuthorization() {

         }

         public GSSName getName(MessageContext ctx) 
            throws GSSException {

            // Return the expected GSSName of the remote entity.
         }


          void authorize(Subject peerSubject, MessageContext context)
                                 throws AuthorizationException {

             // Perform the authorization steps.
             // peerSubject provides the remote Subject
             // Use SecurityManager API to get local Subject

             // if authorization fails, throw AuthorizationException
         }
      }
      

The following describes the steps done for client side authorization:

	Note
	Client authorization is done after the invocation.

To configure the custom authorization scheme:

      ((Stub)port)._setProperty(Constants.AUTHORIZATION, 
                   new TestAuthorization());
      

Various authorization scheme implementations in package org.globus.wsrf.impl.security.authorization would serve as examples. View CVS Link.