Developing a custom AuthenticationProvider without idstore or credentials

Question

From the thread: How to integrate a SSO based in cookie with ADF Security
==========================================================
At work they asked me to integrate a existing SSO based in cookie with the new ADF + Jdeveloper 11g + WLS. After google for days and read a lot of blogs and official documentation I've made a custom LoginModule. I made it very simple, it's just an "if" inside the login() function with the username, if the username is "john" I put to the Subject some Principals. My steps are:
1- Create a new app based on "Fusion application" template.
2- Make a new ADF Taskflow with only one view inside (the entry point of the taskflow). The jspx only contains a welcome message.
3- Run the ADF Security wizard, all the steps with the default option, I don't change anything.
4- Put some users and some roles in jazn-data.xml, and maping them to an application role. Then I grant permissions to the application role to view the previous task flow.
At this point everything is ok. I run the taskflow and a basic login popup prompts me to write my username and password. Now I try to remove everything useless for me, like idstore, credentials, anonymous, etc. I only want a LoginModule that get the HttpRequest and passes it to an already done class that returns a true/false depending if the cookie is correct or not but, as I said before, my LoginModule is so simple now and even didn't try to do something more complicated than an if. The steps I try are:
in jps-config.xml
5- Remove idstore.xml and credentials.
6- (loginmodule tab) Make a new login module, and put here my class. The class is in the ViewController project and JDeveloper find it navigating through the heriarchy, so I have visibility. I put REQUIRE flag, add all roles and debug mode.
7- In the security context unmark the idstore.loginmodule and mark myLoginModule. Also delete the anonymous security context.
All that I got until now is a 500 error (Internal server error - Authorization Exception). Sometimes (the close i've ever been to do something correct) the browser ask me for user/password but then only recognizes the users that already are in WLS (idstore from previous tests), but NOT the "john" user that is inside my custom LoginModule. Even more, if I run the WLS from JDeveloper 11g in debug mode, the runtime never stops at breakpoints inside my custom login module. It seems that my LoginModule isn't deployed or I made some error maping the roles.
So, my questions are:
- I'm in the good way? If I want an authentication based in cookie/httprequest I have to do a custom LoginModule? My goal is to do a re-usable code, and re-use the code that my co-workers have done. They have a class that with only the HttpRequest determines if a user is logged or not.
- If I'm in the good way... how can I put my custom LoginModule in the WLS? I tried to search something in the Administration Panel (localhost:7101/console) but I did'nt find nothing.
- In case I'd got the custom LoginModule working fine in WLS... how can I get a HttpRequest from a LoginModule and avoid the username/password dialog? I've to make a filter and pass it to the my LoginModule? If it's correct... how?
I don't post my code because is so simple, it's based on DBTableLoginModule but without all the database access code.
Thanks to all!
P.D.: If this message isn't in the correct forum, I'm sorry. Feel free to move it.
P.D.2: Sorry about my english, I'm spanish. I know i've to practise a lot :)
===========================================================
After a week working in the problem I didn't solved it. I managed to write an AuthenticationProvider, a LoginModule and a Principal classes and I've put them into WLS, so "myAuthenticator" shows in the combo box ready to be used. But it doesn't work :( The server always shows me an exception (the last one tells me my class isn't a valid JAAS authenticator, but the MBean maker didn't complain). Is there any way to implement an Authenticator that doesn't use any credentials, idstore or callbacks? For example, can I implement an AuthenticatorProvider that grants me Principals only based in the hour of the day, or based in a boolean returned from a custom class, without any interaction with the user? It's really a must to have the user in the weblogic embedded LDAP or can I read the username from a cookie like in my case? Any advice will be very helpful, or some code would be awesome.
Another question related: Why the ADF Security wizard doesn't deploy well with the embedded WLS? The wizard lets me create a custom LoginModule and add it with the "+" button, but it simply doesn't deploy. Will be fixed in future releases or I'm doing something wrong?
Thanks to all.
Riveck.

Answer 1

So, since the ADF application is just using WLS Authentication, you're on the right path with the Authentication Provider.
What you need though, is an IdentityAsserter. The identity asserter tells the container you want to authenticate, but you don't have a password, you have a token...in your case some HTTP Header foo=john.
The good news is that there is already an identity asserter that you can use to start with...the SimpleSampleIdentityAsserter.
[https://codesamples.samplecode.oracle.com/servlets/tracking?id=S224]
This is the link to the samples.
I think what you want to do, is configure your LoginModule to be called when the IdentityAsserter gets called...this can be done in the getAssertionModuleConfiguration() method. Return an AppConfigurationEntry that references your login module.
Once you've got your identity asserter configured, what should happen is that when you access a protected page in ADF, JEE security will get triggered and the IdentityAsserter should get called, if you configure the login-method in web.xml to CLIENT_CERT.
JB