[
Lists Home |
Date Index |
Thread Index
]
>
>
>The concept is this: authentication of not only a user for access
>control to a resource, but a combination of the user *and* a resource -
>
This is called delegation. System A is an active participant -- it is a
security entity of its own. User1 authenticates to A and "delegates"
its rights so that A can present its rights, and the delegated User1
rights to B. OSF DCE has rich delegation; COM has limited (IIRC just the
limited case of full delegation, which is really impersonation); Corba,
based on the DCE Security model, is closer to DCE's capabilities. XACML
and SAML have many OSF DCE alumni on them, so those standards should
have enough hooks to support delegation, even if it wasn't explicitly
part of their baseline specs.
(I just updated Mozilla; apologies if this comes out at HTML)
/r$
|
