CASA/CASA-auth-token/server/AuthTokenValidate/Svc/README

/***********************************************************************
 * 
 *  Copyright (C) 2006 Novell, Inc. All Rights Reserved.
 *
 *  This library is free software; you can redistribute it and/or
 *  modify it under the terms of the GNU Lesser General Public
 *  License as published by the Free Software Foundation; version 2.1
 *  of the License.
 *
 *  This library is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 *  Library Lesser General Public License for more details.
 *
 *  You should have received a copy of the GNU Lesser General Public
 *  License along with this library; if not, Novell, Inc.
 * 
 *  To contact Novell about this file by physical or electronic mail, 
 *  you may find current contact information at www.novell.com.
 * 
 *  Author: Juan Carlos Luciani <jluciani@novell.com>
 *
 ***********************************************************************/
/***********************************************************************
 *
 *  README for CasaAuthtokenValidateD
 *
 ***********************************************************************/

INTRODUCTION

CasaAuthtokenValidateD provides a service that is utilized by libcasa_s_authtoken
for the validation of CASA Authentication Tokens.

Processes executing libcasa_s_authtoken communicate with CasaAuthTokenValidateD via
domain sockets. CasaAuthTokenValidateD validates authentication tokens by invoking
the appropriate CASA Authentication Token Java classes.

COMMAND LINE PARAMETERS

CasaAuthtokenValidateD has the following command line parameters:

   -b BeginThreads

      Optional parameter that specifies the initial number of threads utilized by the
      service to process requests.

   -g GrowThreads

      Optional parameter that specifies the number of threads by which the service can
      grow its thread pool utilized for processing requests.

   -m MaxThreads

      Optional parameter that specifies the maximum number of threads that the service
      can have in its thread pool for processing requests.

   -D DebugLevel

      Optional parameter that specifies the level used for logging debugging information.
      0 being the lowest debug level.

   -d
      Optional parameter that specifies that the service must be run as a daemon.

   -s
      Do not use multiple threads to call into the JVM when invoking the authentication
      token verification classes. This option was added to have a temporary work around
      to bug present in Sun's JVM Invoke Interface (BUG221420).

SECURITY CONSIDERATIONS

Appropriate rights need to be set on the folder used by CasaAuthtokenValidateD to
create its listeing socket to keep other services from hijacking it and taking on
the validation of CASA authentication sockets. CasaAuthtokenValidateD creates its
listen socket in the /var/lib/CASA/authtoken/validate/ folder.

The SuSE rpm package for this component only allows processes executing as casaatvd
to setup a listener on the /var/lib/CASA/authtoken/validate/ folder but it allows any
process to connect to it. This setup may allow a rogue process to easily launch a
denial of service attack on CasaAuthtokenValidateD. If this is not acceptable then
change the rigths on the folder to only allow selected users to connect to it.