| Previous | Table of Contents | Next |
The primary assumption of this interoperability protocol is that transport layer security can ensure that it is not necessary
to issue a preliminary request to establish a confidential association with the intended target.
In order to sustain this assumption, trust in target and a confidential transport shall be established prior to issuing any
call that may contain arguments (including object keys) or service context elements that the client considers confidential.
A CSS acting on behalf of a client may trust a target to locate an object (process a locate request) without having to trust
the target with confidential arguments (other than object keys) or service context elements. For example, a CSS may have established
a confidential connection to an address it learned from an IOR, and may then determine if the client trusts the target with
its request arguments and any associated service context elements. If the client does not trust the target with its request,
the CSS may send a locate request.11 If the locate reply contains a new address, the CSS may establish a new confidential
connection, evaluate the level of trust the client has in the new target,
11.This requires that the CSS be provided with a method to cause the ORB to issue a locate request. There is no standard API
to cause an ORB to issue a locate request.
and determine whether it can issue the client’s request to the target. If in response to the request, the CSS receives a location
forward, it will establish another confidential connection with the new address and repeat its trust determination.
Compound security mechanisms appearing in IORs leading to a location daemon should not require clients to authenticate using
the username/password mechanism if doing so would cause an overly trusting caller to share its password with an untrusted
location daemon.
The way in which a location daemon derives an IOR for a target object is not prescribed by this specification.
24.5.3.1 Comments on Establishing Trust in Client
A client that does not have the artifacts necessary to provide evidence of its authenticity over at least one of the transports
supported by it and its target should search the IOR for a security mechanism definition that does not require client authentication
to occur in a transport mechanism.