Complete configuration of JAAS with JBOSS using database

Question

JAAS Configuration
1.     Database
     Create following table:
a.     Principals table consists of usernames (PrincipalID) and their passwords.
CREATE TABLE Principals (PrincipalID VARCHAR (64) PRIMARY KEY,
Password VARCHAR (64))
Insert data
INSERT INTO Principals VALUES ('java', 'echoman')
INSERT INTO Principals VALUES ('duke', 'javaman')     
b.     Roles table consists of usernames (PrincipalID) and their Role and the
RoleGroup they belong.
CREATE TABLE Roles (PrincipalID VARCHAR (64), Role
VARCHAR (64), RoleGroup VARCHAR (64))
Insert data
INSERT INTO Roles VALUES ('java', 'Echo', 'Roles')
INSERT INTO Roles VALUES ('java', 'caller_java', 'CallerPrincipal')
INSERT INTO Roles VALUES ('duke', 'Java', 'Roles')
INSERT INTO Roles VALUES ('duke', 'Coder', 'Roles')
INSERT INTO Roles VALUES ('duke', 'caller_duke', 'CallerPrincipal')
INSERT INTO Roles VALUES ('duke', 'Echo', 'Roles')
2.     login-config.xml
This file is located in jboss-3.2.1\server\default\conf
a.     add the following lines
                         <application-policy name="example2">
                              <authentication>
                                   <login-module code="org.jboss.security.ClientLoginModule" flag="required">
                              </login-module>
                         <login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule"
                         flag="required">
                         <module-option name="managedConnectionFactoryName">
                    jboss.jca:service=LocalTxCM,name=SybaseDB
                                   </module-option>
                                   <module-option name="dsJndiName">
                                        java:/SybaseDB
                                   </module-option>
          <module-option name="principalsQuery">
          Select Password from Principals where PrincipalID =?
          </module-option>
                                   <module-option name="rolesQuery">
                                        Select Role 'Roles', RoleGroup 'RoleGroups' from Roles where                                              PrincipalID =?
                                   </module-option>
                         </login-module>
                    </authentication>
               </application-policy>
3.     jboss-web.xml
     Create a file jboss-web.xml and place the following code
          <?xml version="1.0" encoding="UTF-8"?>
          <jboss-web>
               <security-domain>java:/jaas/example2</security-domain>
          </jboss-web>
example2 is the name of the security domain which we specified in application policy of login-config.xml
Copy this file in your applications WEB-INF folder
4. auth.conf
     Create a file auth.conf and place it in jboss-3.2.1\client.
client-login
          org.jboss.security.ClientLoginModule required;
example2
          org.jboss.security.ClientLoginModule required;
org.jboss.security.auth.spi.DatabaseServerLoginModule required;
5.     auth.conf
     Create another auth.conf and place it in jboss-3.2.1\server\default\conf
// The JBoss server side JAAS login config file for the examples
client-login
          org.jboss.security.ClientLoginModule required;
example2
          org.jboss.security.ClientLoginModule required;
     org.jboss.security.auth.spi.DatabaseServerLoginModule
required
          dsJndiName="java:/SybaseDB"
principalsQuery="Select Password from Principals where PrincipalID =?"
rolesQuery="Select Role 'Roles', RoleGroup 'RoleGroups' from Roles where PrincipalID =?"
5.     jndi
     Path jboss-3.2.1\server\default\conf
     java.naming.factory.initial=org.jnp.interfaces.NamingContextFactory
java.naming.factory.url.pkgs=org.jboss.naming:org.jnp.interfaces
# Do NOT uncomment this line as it causes in VM calls to go over
# RMI!
java.naming.provider.url=localhost:1099
#localhost
6.     web.xml
Place the following code in your web.xml.(Change it according to your application requirements).
     <security-constraint>
          <web-resource-collection>
               <web-resource-name>action</web-resource-name>
               <description>Declarative security tests</description>
               <url-pattern>*.do</url-pattern>
               <http-method>HEAD</http-method>
               <http-method>GET</http-method>
               <http-method>POST</http-method>
               <http-method>PUT</http-method>
               <http-method>DELETE</http-method>
          </web-resource-collection>
          // the role which can access these resources
          <auth-constraint>
               <role-name>Echo</role-name>
               <!--<role-name>Java</role-name>-->
          </auth-constraint>
          <user-data-constraint>
               <description>no description</description>
               <transport-guarantee>NONE</transport-guarantee>
          </user-data-constraint>
     </security-constraint>
          //the login page in case of Basic authentication
     <!--<login-config>
          <auth-method>BASIC</auth-method>
          <realm-name>JAAS Tutorial Servlets</realm-name>
     </login-config>-->
     //the login page in case of form based authentication
     <login-config>
          <auth-method>FORM</auth-method>
          <form-login-config>
               <form-login-page>/logon.do</form-login-page> //path to login page
               <form-error-page>/logoff.do</form-error-page> //path in case login fails
          </form-login-config>
     </login-config>
     <security-role>
          <description>A user allowed to invoke echo methods</description>
          <role-name>Echo</role-name>
     </security-role>
     <!--
     <security-role>
          <description>A user allowed to invoke echo methods</description>
     <role-name>Java</role-name>
     </security-role>
     -->
7.     login.jsp
<%@ page contentType="text/html; charset=UTF-8" %>
<%@ page language="java" %>
<html >
<HEAD>
<TITLE></TITLE>
<!-- To prevent caching -->
<%
response.setHeader("Cache-Control","no-cache"); // HTTP 1.1
response.setHeader("Pragma","no-cache"); // HTTP 1.0
response.setDateHeader ("Expires", -1); // Prevents caching at the proxy server
%>
<SCRIPT>
function submitForm() {
var frm = document. logonForm;
// Check if all the required fields have been entered by the user before
// submitting the form
if( frm.j_username.value == "" ) {
alert("blank");
frm.j_username.focus();
return ;
if( frm.j_password.value == "" ) {   
alert("blank");
frm.j_password.focus();
return ;
frm.submit();
</SCRIPT>
</HEAD>
<BODY>
<FORM name="logonForm" action="logon.do" METHOD=POST>
<TABLE width="100%" border="0" cellspacing="0" cellpadding=
"1" bgcolor="white">
<TABLE width="100%" border="0" cellspacing=
"0" cellpadding="5">
<TR align="center">
<TD align="right" class="Prompt"></TD>
<TD align="left">
<INPUT type="text" name="j_username" maxlength=20>
</TD>
</TR>
<TR align="center">
<TD align="right" class="Prompt"> </TD>
<TD align="left">
<INPUT type="password"
name="j_password" maxlength=20 >
<BR>
<TR align="center">
<TD align="right" class="Prompt"> </TD>
          <TD align="left">     
     <input type="submit" onclick="javascript:submitForm();" value="Login">
</TD>
</TR>
</TABLE>
</FORM>
</BODY>
</html>
8. Your action class should contain the following code
     a. Pacakages to be imported
import java.util.Set;
import javax.security.auth.Subject;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import org.jboss.security.SimplePrincipal;
import org.jboss.security.auth.callback.SecurityAssociationHandler;
     try
SecurityAssociationHandler handler = new
SecurityAssociationHandler();
user = new SimplePrincipal(username);
handler.setSecurityInfo(user, password.toCharArray());
LoginContext loginContext = new LoginContext("example2",
(CallbackHandler)handler);
loginContext.login();
Subject subject = loginContext.getSubject();
Set principals = subject.getPrincipals();
principals.add(user);
}catch(LoginException e)
{ errors.add("loginerror", new ActionError("Wrong Username or  Password")); saveErrors(request, errors);
//other login related code

Answer 1

Hi,
Can I just first of all say how useful I found this article.
It has been a great help in explaining what I need to do.
I just had a couple of questions about the details...
1) The jndi.properties file appears to be much the same except for the line...
java.naming.provider.url=jnp://localhost:1099
Are you saying we need to add that line to the jndi.properties or else all calls will go through rmi ?
2) Should the line be java.naming.provider.url=jnp://localhost:1099 or url=localhost:1099 ?
Thanks again for the article
Dave