We are planning a project, where we are using the same RPC interface
for GWT app and for RMI client. In the beginning I though it would be
the most convenient to use GWT RPC service directly from Java client.
Eventually I found that there is no such possibility.
Then I realized being wrong in my assumptions. GWT RPC protocol is
strongly bound to HTTP protocol. For example client request
authorization is based on HttpSession. We want to have analogous
mechanism in RMI code, probably implemented with help of JAAS.
We came to exactly the analogous solution you are proposing here -
separate RMI and GWT RPC remote services being facade (with
authorization control) to some general target implementation.
The main obstacle now is how to implement authorization control for
specific GWT RPC methods. We cannot use something like acegi filter
before the request hits GWT RPC service. We are thinking about
extending RemoteServiceServlet adding JAAS authorization on method
level there.
--
"Meaning is differential not referential"
kazik 'morisil' pogoda
http://www.xemantic.com/ http://blog.xemantic.com/