Authorization failed with JAAS in JBOSS

Question

Hi all,
I write my own login module class (WusLdapLoginModule) for my web app. I can authenticate my user with username and password. But I failed in authorizing my user with roles.
I believe that I missed something, please help me.
My web application run on WinXP, Jboss 4.2.3 GA, OpenLdap 2.0.2.9
Here is my login module class:
package wus.identity.security;
import java.io.IOException;
import java.util.Map;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.NameCallback;
import javax.security.auth.callback.PasswordCallback;
import javax.security.auth.callback.UnsupportedCallbackException;
import javax.security.auth.login.LoginException;
import javax.security.auth.spi.LoginModule;
import javax.security.auth.Subject;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import wus.identity.Role;
import wus.identity.User;
import wus.identity.dao.UserDAO;
public class WusLdapLoginModule implements LoginModule
    //properties
    private Subject subject;
    private CallbackHandler callbackHandler;
    private Map<String,?> sharedStates;
    private Map<String,?> options;
    private boolean loginOk;
    private User m_user;
    //====== DAO ====================
    private UserDAO m_userDao = new UserDAO();
    private static final Log log = LogFactory.getLog(WusLdapLoginModule.class);
    @Override
    public boolean commit() throws LoginException
        int i;
        if(loginOk)
            if(!subject.getPrincipals().contains(this.m_user))
                this.subject.getPrincipals().add(this.m_user);               
                for(i=0;i<m_user.getRoles().size();i++)
                    this.subject.getPrincipals().add(m_user.getRoles().get(i));
            AuthenticatedUser.setAuthenticatedUser(m_user);
        return loginOk;
}Here is my Role class
package wus.identity;
import java.io.Serializable;
import java.security.Principal;
public class Role implements Principal, Serializable
    private static final long serialVersionUID = 10797L;
    //Properties
    private String name;
    private String note;
    public Role()
        name = "";
    @Override
    public String getName()
        // TODO Auto-generated method stub
        return name;
    }Here is a part of web.xml:
<security-constraint>
        <web-resource-collection>
            <web-resource-name>Secure Area</web-resource-name>
            <url-pattern>/sa/*</url-pattern>
            <http-method>GET</http-method>
            <http-method>POST</http-method>
        </web-resource-collection>
        <auth-constraint>
            <!-- <role-name>user</role-name>  -->
            <role-name>user</role-name>
        </auth-constraint>
    </security-constraint>
    <!-- end security constraints -->
    <!-- Example Login page - lists user names -->
    <login-config>
        <auth-method>FORM</auth-method>
        <form-login-config>
            <form-login-page>/ua/login-example.jsf</form-login-page>
            <form-error-page>/ua/login-example.jsf?error=true</form-error-page>
        </form-login-config>
    </login-config>
<security-role>
        <role-name>admin</role-name>
    </security-role>
    <security-role>
        <role-name>user</role-name>
    </security-role>Thank in advance,
Vu

Answer 1

How is this question related to JSF?
Try a forum devoted to JAAS or JBoss, depending on the root cause of the problem.