How to implement JAAS?�?

Question

Hi all,
I'm building a web application using JSP and Sevlet, and I want to design a login page where users enter their name and pass. I heared that if I want to design that page I need to implement JAAS (Java Authentication and Authorization Service) please help me to do that and give me code, links, or articles that talk about design login pages.
thanx,

Answer 1

Some examples to help you get started...
Extracts from web.xml
    <!-- My App uses Struts - declare the struts action servlet -->
    <servlet> 
        <servlet-name>action</servlet-name>
        <servlet-class>org.apache.struts.action.ActionServlet</servlet-class>
        <init-param>
            <param-name>config</param-name>
            <param-value>/WEB-INF/config/struts/struts-config.xml</param-value>
        </init-param>
        <init-param>
            <param-name>debug</param-name>
            <param-value>2</param-value>
        </init-param>
        <init-param>
            <param-name>detail</param-name>
            <param-value>2</param-value>
        </init-param>
        <load-on-startup>2</load-on-startup>
        <security-role-ref>
            <role-name>member</role-name>
            <role-link>member</role-link>        
        </security-role-ref>
    </servlet>
    <!-- Standard Action Servlet Mapping -->
    <servlet-mapping>
        <servlet-name>action</servlet-name>
        <url-pattern>*.do</url-pattern>
    </servlet-mapping>
    <security-constraint>
        <!-- Member pages can only be accessed by 'members' -->    
        <web-resource-collection>
            <web-resource-name>Member Pages</web-resource-name>
            <url-pattern>/members/*</url-pattern>
            <http-method>GET</http-method>
            <http-method>POST</http-method>                              
        </web-resource-collection>
        <auth-constraint>
            <role-name>member</role-name>
        </auth-constraint>       
        <!-- Forces SSL -->
        <user-data-constraint>           
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>           
        </user-data-constraint>   
    </security-constraint>
    <!-- Specify Form Based Authentication -->
    <login-config>
        <auth-method>FORM</auth-method>       
        <form-login-config>
            <form-login-page>/displayLogin.do</form-login-page>
            <form-error-page>/displayLoginError.do</form-error-page>
        </form-login-config>
    </login-config>
    <security-role>
        <role-name>member</role-name>
    </security-role>
Login JSP (Uses Struts specific tags which can be ignored)
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%@ taglib prefix="html" uri="http://struts.apache.org/tags-html-el" %>
<%@ taglib prefix="bean" uri="http://struts.apache.org/tags-bean-el" %>
<form name="LoginForm" action="j_security_check" method="post">
     <table class="TwoColumnForm">     
        <tr>
            <th><bean:message key="user.username"/></th>
            <td><input type="text" name="j_username" class="Required" size="32" maxlength="32"/></td>
        </tr>
        <tr>
            <th><bean:message key="user.password"/></th>
            <td><input type="password" name="j_password" class="Required" size="32" maxlength="32"/></td>
        </tr>        
         <tr>
             <td Class="Buttons" colspan="2">
                 <html:image styleClass="Button" property="buttons.submit" pageKey="common.img.ok_button.src" alt="common.img.ok_button.alt"/>
                 <html:link page="/displayMain.do"><html:img styleClass="Button" pageKey="common.img.cancel_button.src" altKey="common.img.cancel_button.alt"/></html:link>
             </td>
         </tr>        
     </table>
<form>
Configure Tomcat to use custom JAAS login module - add the following to context.xml in META-INF
<Context reloadable="true">
     <!-- Realms -->
     <Realm className="org.apache.catalina.realm.JAASRealm" appName="MyApp" userClassNames="com.myapp.security.jaas.CustomUserPrincipal"
          roleClassNames="com.myapp.security.jaas.CustomRolePrincipal" debug="1"/>
     <!-- Monitored Resources -->
     <WatchedResource>META-INF/context.xml</WatchedResource>     
     <WatchedResource>WEB-INF/web.xml</WatchedResource>
</Context>
Create a file called jaas.config
MyApp
    com.myapp.security.jaas.CustomLoginModule required;
Specify the jaas.config file as a system property when you start you app server
-Djava.security.auth.login.config=="C:/Projects/MyApp/jaas.config"[b]Implement the CustomLoginModule, CustomUserPrincipal and CustomRolePrincipal as shown in the sun tutorials
These classes need to be deployed where your application server can find them when it starts up, i.e. outside of your WEB-INF/classes and WEB-INF/lib
You can implement the CustomLoginModule how you like, but if your application maintains it's own user database it may get a bit messy - I didn't like the idea of the app server interogating my application database and becoming responsible for the login logic (e.g. lock the account after 3 incorrect attempts etc). For this reason my CustomLoginModule (running in Tomcat) invokes a remote login method in my web app over RMI. The login method return a User object if successful which is added to the CustomUserPrincipal so it can be retrieved in the web-app.
Not the nicest of designs I admit. If anyone can suggest a better approach I'd be glad to hear it. I'm also not a JAAS expert. My app is just for testing out things I'm interested in, it's quite possible I may have misunderstood something along the way.