<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body><div><div style="font-family: Calibri,sans-serif; font-size: 11pt;">Just a BTW: It would be really cool to have a SPI interface for that, so people who need SRP, CCM or shared secret handshakes (or stuff like NPN?) don't need to use a third party SSL engine.<br><br>-- <br>http://bernd.eckenfels.net</div></div><div dir="ltr"><hr><span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Von: </span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:weijun.wang@oracle.com">Wang Weijun</a></span><br><span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Gesendet: </span><span style="font-family: Calibri,sans-serif; font-size: 11pt;">13.08.2014 12:20</span><br><span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">An: </span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:core-libs-dev@openjdk.java.net">OpenJDK Dev list</a>; <a href="mailto:security-dev@openjdk.java.net">OpenJDK Dev list</a></span><br><span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Betreff: </span><span style="font-family: Calibri,sans-serif; font-size: 11pt;">Trusted service?</span><br><br></div>Hi All<br><br>I'm working on "8038089: TLS optional support for Kerberos cipher suites needs to be re-examine" which will separate the implementation of Kerberos-related TLS ciphersuites from the other TLS codes. I am thinking of defining a ServiceLoader interface called ExternalCipherSuiteProvider inside the TLS module and implement a Krb5CipherSuiteProvider in the JGSS module. Now if the JGSS module is installed, it will be found and thus supports the TLS_KRB5_* ciphersuites.<br><br>However, it looks like any application can include an implementation and register it by adding its own $CLASSPATH/META-INF/services line. Is there anyway I can find out which is the "trusted" one? I've looked at some ServiceLoader example inside JDK and it looks like they first load an implementation specified by a system property and then do the ServiceLoader.load() loop. Is that system property meant to provide the "trusted" or "builtin" implementation? I wonder if it still works now because even if we define a system property (or security property), the implementation class will be invisible in a different module.<br><br>Thanks<br>Max<br><br></body></html>