Extending the OSF DCE Authorization System to Support Practical Delegation

In a simple client/server distributed environment, two principals are involved in most transactions - the initiator and the target of the operation. The target of the operation can reasonably make authorization decisions based on the identity of the initiator. This model is insufficient, however, when the server performs operations on other components on behalf of the initiator as is common in distributed object oriented environments. This paper will describe the need for a delegation facility in distributed object oriented systems and then present some elements of the delegation system we've proposed for inclusion in OSF's Distributed Computing Environment (DCE). INTRODUCTION The need for a delegation facility In a distributed object oriented environment, intermediate objects hide the details of complex system interactions. These intermediate objects receive high level requests from initiating clients and perform some series of low level operations on a number of other services. Unfo..