<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<div class="moz-text-html" lang="x-western"> Mike Mazur wrote:
<blockquote cite="mid:20090225133307.2533b23d@sumo" type="cite">
<pre wrap="">Hi,
On Tue, 24 Feb 2009 19:54:16 -0800
Diva Canto <a class="moz-txt-link-rfc2396E"
href="mailto:diva@metaverseink.com"><diva@metaverseink.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">* Within a few days: write a simple [optional]
UserAuthenticationModule along the lines of option a) that does the
following: upon a NewUserConnection, regions will check with the
incoming user's User server that the declared user exists and is
logged into the system.
</pre>
</blockquote>
<pre wrap=""><!---->
In a grid a region can be told (via a configuration option) which user
server to check. What about HG regions? How does an HG region know
which user server to ping? Is this information supplied by the
connecting client? If so, what's to prevent a malicious client from
supplying a user server that will always reply favorably?
</pre>
</blockquote>
The HG region sends that information along when the user moves away
from the home UGAIM. The user carries along the collection of URLs of
all of the servers it uses. It's ok if the given User Server @
foobar.com always says yes -- that's not the problem. The problem we
need to detect is the user claiming to be from Intel.com or OSGrid.org,
when, in fact, isn't.<br>
<br>
<blockquote cite="mid:20090225133307.2533b23d@sumo" type="cite">
<blockquote type="cite">
<pre wrap="">Furthermore, upon AddNewClient (which happens
shortly after), regions will challenge the incoming client with 3 UDP
Ping messages having random seq numbers, to which the incoming client
must respond correctly
</pre>
</blockquote>
<pre wrap=""><!---->
How does the client know the correct response?
</pre>
</blockquote>
In fiddling with the client after talking to Teravus, I discovered a
pair of response-reply packets that can be initiated from the server.
They are StartPingCheck / CompletePingCheck. They take a byte as
argument. The server sends StartPingCheck(33), the client responds with
CompletePingCheck(33). Handy.<br>
<br>
<br>
</div>
</body>
</html>