Authorization with JAAS in JSF with facelets

Question

hi,
can u please hint me where i did mistake.. i clearly mention what i did and what i getting ..i did this in jsf1.2,tomcat6.x
i did JAAS authentication in jsf with facelets.but i am unable to do the authorization with JAAS in jsf
after getting authentication i put the subject in session. if i print the values in suject i got the following out put
Subject:
Principal: TypedPrincipal: hari [USER] // user name
Principal: TypedPrincipal: admin [GROUP] // user role.
now i want to authorization based on the role.
for this i wrote policy file --principal.policy like this
grant Principal com.alw.reports.jaas.TypedPrincipal "admin" {
    permission com.alw.reports.jaas.ViewIdPermission "*";
grant Principal com.alw.reports.jaas.TypedPrincipal "hari" {
    permission com.alw.reports.jaas.ViewIdPermission "*";
grant Principal com.alw.reports.jaas.TypedPrincipal "user" {
    permission com.alw.reports.jaas.ViewIdPermission "/contents.jsp";
};and i set the path for this policy file like
              System.setProperty("java.security.policy", "policy file location" );when i run my application i am getting login page after that i gave username and passwed. it is getting authentication .. but not able to displaying next page that is /pages/welcome.xhtml but directly it is showin /pages/error.xhtml
i am getting following error
java.security.AccessControlException: access denied (com.alw.reports.jaas.ViewIdPermission /pages/welcome.xhtml)
     at java.security.AccessControlContext.checkPermission(Unknown Source)
     at java.security.AccessController.checkPermission(Unknown Source)
     at java.lang.SecurityManager.checkPermission(Unknown Source)
     at com.alw.reports.jaas.JAASHelper$1.run(JAASHelper.java:87)
     at java.security.AccessController.doPrivileged(Native Method)
     at javax.security.auth.Subject.doAsPrivileged(Unknown Source)
     at com.alw.reports.jaas.JAASHelper.permitionToAccessViewId(JAASHelper.java:83)
     at com.alw.reports.jaas.JAASActionListener.processAction(JAASActionListener.java:65)
     at javax.faces.component.UICommand.broadcast(UICommand.java:106)
     at org.ajax4jsf.component.AjaxViewRoot.processEvents(AjaxViewRoot.java:184)
     at org.ajax4jsf.component.AjaxViewRoot.broadcastEvents(AjaxViewRoot.java:162)
     at org.ajax4jsf.component.AjaxViewRoot.processApplication(AjaxViewRoot.java:350)
     at org.apache.myfaces.lifecycle.LifecycleImpl.invokeApplication(LifecycleImpl.java:316)
     at org.apache.myfaces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:86)
     at javax.faces.webapp.FacesServlet.service(FacesServlet.java:106)
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
     at org.ajax4jsf.webapp.BaseXMLFilter.doXmlFilter(BaseXMLFilter.java:141)
     at org.ajax4jsf.webapp.BaseFilter.doFilter(BaseFilter.java:281)
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
     at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
     at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
     at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
     at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
     at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
     at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:263)
     at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)
     at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:584)
     at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
     at java.lang.Thread.run(Unknown Source)
my faces-config.xml
<navigation-rule>
          <display-name>pages/login</display-name>
          <from-view-id>/pages/login.xhtml</from-view-id>
          <navigation-case>
               <from-outcome>loginSuccess</from-outcome>
               <to-view-id>/pages/welcome.xhtml</to-view-id>
          </navigation-case>
     </navigation-rule>
<navigation-case>
               <from-outcome>errorpage</from-outcome>
               <to-view-id>
                    /pages/error.xhtml
               </to-view-id>
          </navigation-case>my command button in login.xhtml
                         <td align="center" colspan="2">
                              <h:commandButton value="Reset" type="reset"/>
                              <h:commandButton   action="loginSuccess"
                                   id="login" value="Login" />
                         </td>my actionlister
package com.alw.reports.jaas;
import javax.faces.component.UIOutput;
import javax.faces.context.FacesContext;
import javax.faces.event.AbortProcessingException;
import javax.faces.event.ActionEvent;
import javax.faces.event.ActionListener;
import javax.security.auth.Subject;
public class JAASActionListener implements ActionListener   {
     private ActionListener parent = null;
     public JAASActionListener(javax.faces.event.ActionListener parent) {
          System.out.println("-------------- in JAASActionListener ;");
       this.parent = parent;
     public void processAction(ActionEvent event)
       throws AbortProcessingException {
          System.out.println("-------------- in processAction ;");
       FacesContext context = FacesContext.getCurrentInstance();
       UIOutput comp = null;
       String userid = null, password = null;
       JAASHelper jaasHelper = new JAASHelper();
       // Check to see if they are on the login page.
       boolean onLoginPage = (-1 != context.getViewRoot().getViewId().lastIndexOf("login")) ? true : false;
       if (onLoginPage) {
         if (null != (comp = (UIOutput)
           context.getViewRoot().findComponent("helloForm:username"))) {
           userid = (String) comp.getValue();
         if (null != (comp = (UIOutput)
           context.getViewRoot().findComponent("helloForm:password"))) {
           password = (String) comp.getValue();
         // If JAAS authentication failed
         if (!jaasHelper.authenticate(userid, password)) {
           context.getApplication().getNavigationHandler().handleNavigation(context, null, "login");
           return;
         else {
           // Subject must not be null, since authentication succeeded
              System.out.println("----------- setting the subjects in context in  ActionListner ");
           assert(null != jaasHelper.getSubject());
           // Put the authenticated subject in the session.
           System.out.println("---- putting the authenicated subject in the seesion ");
           context.getExternalContext().getSessionMap().put("JAASSubject",jaasHelper.getSubject());
       parent.processAction(event);
       Subject subject=(Subject)context.getExternalContext().getSessionMap().get("JAASSubject");
      System.out.println("subject after parent process action>>>>>>>>>>>>>>>>>>>>>"+subject);
      assert(null != subject);
      if(!jaasHelper.permitionToAccessViewId(subject,context,context.getViewRoot().getViewId())){
          context.getApplication().getNavigationHandler().handleNavigation(context, null, "errorpage");
}can u please hint me where i did mistake
thanks in advance

Answer 1

gbabu wrote:
My doubt is based on that subject , how to write policy file and how to call doAsPrivileged() mehod on that Subject in order to navigate web pages.how to provide web pages permission for particular role in policy file..
For example i have three pages login.xhtml,user.xhtml,admin.xhtml.
1> if the logged in person is admin, then we want to display admin.xhtml
2> if the loggend is person is user , then we want to display user.xhtml
untill now i did and found who is logged in and what are his type( admin or user) .now i want configure the web.xml and faces-config.xml based on policy fileTo the best of my knowledge, there is nothing in the standard NavigationHandler which accounts for JAAS security. If you wanted, you could create a custom NavigationHandler to do this. If you think the idea is worthy enough, you could issue an enhancement request to the specification ([https://javaserverfaces-spec-public.dev.java.net/]).