Obtaining JAAS subject in a servlet.

Question

G'day,
There are problems in Java with getting the JAAS subject, as the standard Subject.getSubject() call can return null if called within a privileged action:
Subject s = Subject.getSubject(AccessController.getContext());
Subject.doAs(s, new PrivilegedAction() {
  public Object run() {
    Subject s1 = Subject.getSubject(AccessController.getContext());
    AccessController.doPrivileged(new PrivilegedAction() {
      public Object run() {
        Subject s2 = Subject.getSubject(AccessController.getContext());
        return null;
    return null;
Here, s2 may be null, which is why other app servers have custom approaches (such as JBoss and its SecurityAssociation.getSubject() call).
Is there a similar API for Netweaver AS Java for obtaining the JAAS subject? Or can the JAAS subject be obtained always using the standard Java API?
Edit I put the above code into a servlet protected by BasicLoginModule, and all three subject objects (s, s1, and s2) were null. I thought that at least 's' would be non-null, but apparently not.
--Geoff

Answer 1

G'day,
Thanks for the link to the JAAS login module section of the SAP Library documentation.
I have already written a custom JAAS login module (which populates a subject with principals and their credentials), but I am looking for the Netweaver equivalent of JBoss's SecurityAssociation.getSubject() that can be called from any code. I did not find anything suitable while searching through the SAP Library documentation.
However, I did stumble upon an API that might be useful:
Object object = com.sap.security.core.InternalUMFactory.getEngineResourceHelper();
if (object != null && object instanceof com.sap.security.core.IEngineResourceHelper) {
  com.sap.security.core.IEngineResourceHelper helper =
      (com.sap.security.core.IEngineResourceHelper) object;
  Subject subject = helper.getCurrentSubject();
The class name InternalUMFactory suggests that this API may be undocumented or unstable.
If I have a servlet protected by the BasicLoginModule, and I authenticate to the servlet using a username/password, then the subject returned is a principal with the correct username, and with password credentials.
If the servlet is not protected by a login module, then the subject returned is "Guest".
If I put the servlet as an iView within a portal, then the subject returned is "Guest", even though the portal is protected by a login module and authentication is required. I thought here that the Subject for the portal would be propogated to the servlets running in that portal, but maybe my understanding is wrong.
--Geoff