OSF DCE Application Development Guide--Introduction and Style Guide

Security

associated with access privileges). Since the credential-based (ACL) method is

designed to provide a general solution to this problem, it is much to be preferred.

ACL based access checking is described in the following sections.

If the authorization service requested is acceptable, the server application makes

the appropriate access tests as described in step 6.

5. Check that the server principal name speciﬁed by the client is acceptable. This

check is useful for a server that is running with more than one principal identity.

The server may only want to allow the operation under a speciﬁc principal

identity. If the server is running with only one principal identity, this check is

redundant.

6. Extract the client privileges and perform the appropriate access testing. The form

of the client privileges depends on the authorization service. The application

needs to extract the privileges in the correct format and pass them to the

appropriate access tests.

3.4.1 Client Credentials

A client’s credentials may be implicitly passed on to an ACL manager via a call to

dce_acl_is_client_authorized( ). Or the credentials may be extracted from the client

binding by a call to rpc_binding_inq_auth_client( ) and then passed on to an ACL

manager via a call to sec_acl_mgr_is_authorized(). In the latter case, there is some

additional complication in the case that the client speciﬁed no authentication. If the

server supports credential-based authorization, it should handle this case by testing for

unauthenticated access via the ACL manager. However, no credentials are returned

from rpc_binding_inq_auth_client() in this case. The convention is to set the pac

argument to NULL in this case ((rpc_authz_handle_t)0). ACL managers that follow

the recommended policies will test for unauthenticated access in the case of such a null

handle.

Null credentials are not the same thing as anonymous credentials. Anonymous

credentials are simply credentials for the well-known anonymous user UUID. They are

tested in the normal way by the ACL manager against permissions for the anonymous

user in the relevant ACL.

The following code fragment shows the necessary steps:

124246 Tandem Computers Incorporated 3− 19