How to configure CustomLoginModule in jps-config.xml

Question

Hi,
How can we configure a Custom Login Module using jps-config.xml, as we do not want to use weblogic custom authentication provider as it needs application jars(which we require fo authenticating the user) to be kept in weblogic classpath.
Is there any documentation on how to configure and use Custom Login Modules in jps-config.xml, I tried to create a LoginModule and specify it in jps-config.xml, but
My LoginModule is not getting called.
Jdev version: 11.1.1.3.0
Server : weblogic
my jps-config.xml is
              <?xml version = '1.0' encoding = 'Cp1252'?>
<jpsConfig xmlns="http://xmlns.oracle.com/oracleas/schema/11/jps-config-11_1.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.oracle.com/oracleas/schema/11/jps-config-11_1.xsd">
   <property value="doasprivileged" name="oracle.security.jps.jaas.mode"/>
   <property value="custom.provider" name="true"/>
   <propertySets/>
   <serviceProviders>
      <serviceProvider class="oracle.security.jps.internal.credstore.ssp.SspCredentialStoreProvider" name="credstore.provider" type="CREDENTIAL_STORE">
         <description>Credential Store Service Provider</description>
      </serviceProvider>
      <serviceProvider class="oracle.security.jps.internal.login.jaas.JaasLoginServiceProvider" name="jaas.login.provider" type="LOGIN">
         <description>
            Login Module Service Provider
         </description>
      </serviceProvider>
      <serviceProvider class="oracle.security.jps.internal.idstore.xml.XmlIdentityStoreProvider" name="idstore.xml.provider" type="IDENTITY_STORE">
         <description>XML-based IdStore Provider</description>
      </serviceProvider>
      <serviceProvider class="oracle.security.jps.internal.policystore.xml.XmlPolicyStoreProvider" name="policystore.xml.provider" type="POLICY_STORE">
         <description>XML-based PolicyStore Provider</description>
      </serviceProvider>
   </serviceProviders>
   <serviceInstances>
      <serviceInstance provider="credstore.provider" name="credstore">
         <property value="./" name="location"/>
      </serviceInstance>
      <serviceInstance provider="jaas.login.provider" name="CustomLoginModule">
         <property value="SUFFICIENT" name="jaas.login.controlFlag"/>
         <property value="SEVERE" name="log.level"/>
         <property value="org.calwin.view.CustomLoginModule" name="loginModuleClassName"/>
      </serviceInstance>
      <serviceInstance provider="idstore.xml.provider" name="idstore.xml">
         <property value="./jazn-data.xml" name="location"/>
         <property value="OBFUSCATE" name="jps.xml.idstore.pwd.encoding"/>
         <property value="jps" name="subscriber.name"/>
      </serviceInstance>
      <serviceInstance provider="policystore.xml.provider" name="policystore.xml">
         <property value="./jazn-data.xml" name="location"/>
      </serviceInstance>
   </serviceInstances>
   <jpsContexts default="TestMultiDatasource">
      <jpsContext name="TestMultiDatasource">
         <serviceInstanceRef ref="idstore.xml"/>
         <serviceInstanceRef ref="credstore"/>
         <serviceInstanceRef ref="policystore.xml"/>
      </jpsContext>
      <jpsContext name="anonymous">
         <serviceInstanceRef ref="credstore"/>
      </jpsContext>
   </jpsContexts>
</jpsConfig>My Login Module Class:
package org.calwin.view;
import java.io.IOException;
import java.security.Principal;
import java.util.Map;
import javax.security.auth.Subject;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.NameCallback;
import javax.security.auth.callback.PasswordCallback;
import javax.security.auth.callback.UnsupportedCallbackException;
import javax.security.auth.login.LoginException;
import javax.security.auth.spi.LoginModule;
import javax.servlet.http.HttpServletRequest;
import weblogic.security.auth.callback.ContextHandlerCallback;
import weblogic.security.principal.WLSUserImpl;
import weblogic.security.service.ContextHandler;
public class CustomLoginModule
    implements LoginModule
  // initial state
  private Subject subject;
  private CallbackHandler callbackHandler;
  // the authentication status
  private boolean succeeded = false;
  private boolean commitSucceeded = false;
  // username and password
  private String username;
  private String password;
  // testUser's SamplePrincipal
  private Principal userPrincipal;
   * Initialize this <code>LoginModule</code>.
   * <p>
   * @param subject the <code>Subject</code> to be authenticated. <p>
   * @param callbackHandler a <code>CallbackHandler</code> for communicating
   *      with the end user (prompting for user names and
   *      passwords, for example). <p>
   * @param sharedState shared <code>LoginModule</code> state. <p>
   * @param options options specified in the login
   *      <code>Configuration</code> for this particular
   *      <code>LoginModule</code>.
  public void initialize(Subject subject, CallbackHandler callbackHandler,
                         Map sharedState, Map options) {
    this.subject = subject;
    this.callbackHandler = callbackHandler;
   * Authenticate the user by prompting for a user name and password.
   * <p>
   * @return true in all cases since this <code>LoginModule</code>
   *    should not be ignored.
   * @exception FailedLoginException if the authentication fails. <p>
   * @exception LoginException if this <code>LoginModule</code>
   *    is unable to perform the authentication.
  public boolean login() throws LoginException {
    if (callbackHandler == null)
      throw new LoginException("Error: no CallbackHandler available " +
                               "to garner authentication information from the user");
    Callback[] callbacks = new Callback[3];
    callbacks[0] = new NameCallback("user name: ");
    callbacks[1] = new PasswordCallback("password: ", false);
    callbacks[2]=new ContextHandlerCallback();
      try {
        callbackHandler.handle(callbacks);
      } catch (UnsupportedCallbackException uce) {
          throw new LoginException("Callback Not Supported");
      } catch (IOException ioe) {
          throw new LoginException("I/O Failed");
      username = ((NameCallback)callbacks[0]).getName();
      char[] tmpPassword = ((PasswordCallback)callbacks[1]).getPassword();
      if (tmpPassword == null) {
        tmpPassword = new char[0];
      password = new String(tmpPassword);
      ((PasswordCallback)callbacks[1]).clearPassword();
    // verify the username/password
    boolean usernameCorrect = true;
    boolean passwordCorrect = true;
    succeeded = true;
    return true;
   * <p> This method is called if the LoginContext's
   * overall authentication succeeded
   * (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules
   * succeeded).
   * <p> If this LoginModule's own authentication attempt
   * succeeded (checked by retrieving the private state saved by the
   * <code>login</code> method), then this method associates a
   * <code>SamplePrincipal</code>
   * with the <code>Subject</code> located in the
   * <code>LoginModule</code>.  If this LoginModule's own
   * authentication attempted failed, then this method removes
   * any state that was originally saved.
   * <p>
   * @exception LoginException if the commit fails.
   * @return true if this LoginModule's own login and commit
   *    attempts succeeded, or false otherwise.
  public boolean commit() throws LoginException {
    if (succeeded == false) {
      return false;
    } else {
      userPrincipal = new WLSUserImpl(username);
      if (!subject.getPrincipals().contains(userPrincipal))
        subject.getPrincipals().add(userPrincipal);
      // in any case, clean out state
      username = null;
      password = null;
      commitSucceeded = true;
      return true;
   * <p> This method is called if the LoginContext's
   * overall authentication failed.
   * (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules
   * did not succeed).
   * <p> If this LoginModule's own authentication attempt
   * succeeded (checked by retrieving the private state saved by the
   * <code>login</code> and <code>commit</code> methods),
   * then this method cleans up any state that was originally saved.
   * <p>
   * @exception LoginException if the abort fails.
   * @return false if this LoginModule's own login and/or commit attempts
   *    failed, and true otherwise.
  public boolean abort() throws LoginException {
    if (succeeded == false) {
      return false;
    } else if (succeeded == true && commitSucceeded == false) {
      // login succeeded but overall authentication failed
      succeeded = false;
      username = null;
      if (password != null) {
        password = null;
      userPrincipal = null;
    } else {
      // overall authentication succeeded and commit succeeded,
      // but someone else's commit failed
      logout();
    return true;
   * Logout the user.
   * <p> This method removes the <code>SamplePrincipal</code>
   * that was added by the <code>commit</code> method.
   * <p>
   * @exception LoginException if the logout fails.
   * @return true in all cases since this <code>LoginModule</code>
   *          should not be ignored.
  public boolean logout() throws LoginException {
    subject.getPrincipals().remove(userPrincipal);
    succeeded = false;
    succeeded = commitSucceeded;
    username = null;
    if (password != null) {
      password = null;
    userPrincipal = null;
    return true;
}My adf-config.xml:
<sec:adf-security-child xmlns="http://xmlns.oracle.com/adf/security/config">
    <CredentialStoreContext credentialStoreClass="oracle.adf.share.security.providers.jps.CSFCredentialStore"
                            credentialStoreLocation="../../src/META-INF/jps-config.xml"/>
    <sec:JaasSecurityContext initialContextFactoryClass="oracle.adf.share.security.JAASInitialContextFactory"
                             jaasProviderClass="oracle.adf.share.security.providers.jps.JpsSecurityContext"
                             authorizationEnforce="true"
                             authenticationRequire="true"/>
  </sec:adf-security-child>My jazn.xml:
<?xml version = '1.0' encoding = 'UTF-8' standalone = 'yes'?>
<jazn-data xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:noNamespaceSchemaLocation="http://xmlns.oracle.com/oracleas/schema/jazn-data-11_0.xsd">
  <jazn-realm default="jazn.com">
    <realm>
      <name>jazn.com</name>
    </realm>
  </jazn-realm>
</jazn-data>My web.xml:
<filter>
    <filter-name>JpsFilter</filter-name>
    <filter-class>oracle.security.jps.ee.http.JpsFilter</filter-class>
    <init-param>
      <param-name>enable.anonymous</param-name>
      <param-value>true</param-value>
    </init-param>
    <init-param>
      <param-name>remove.anonymous.role</param-name>
      <param-value>false</param-value>
    </init-param>
  </filter>
<servlet>
    <servlet-name>adfAuthentication</servlet-name>
    <servlet-class>oracle.adf.share.security.authentication.AuthenticationServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
  </servlet>
<servlet-mapping>
    <servlet-name>adfAuthentication</servlet-name>
    <url-pattern>/adfAuthentication</url-pattern>
  </servlet-mapping>
<security-constraint>
    <web-resource-collection>
      <web-resource-name>adfAuthentication</web-resource-name>
      <url-pattern>/adfAuthentication</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>valid-users</role-name>
    </auth-constraint>
  </security-constraint>
  <login-config>
    <auth-method>FORM</auth-method>
    <form-login-config>
      <form-login-page>/login.html</form-login-page>
      <form-error-page>/error.html</form-error-page>
    </form-login-config>
  </login-config>
  <security-role>
    <role-name>valid-users</role-name>
  </security-role>weblogic.xml:
  <security-role-assignment>
    <role-name>valid-users</role-name>
    <principal-name>users</principal-name>
  </security-role-assignment>Regards,
Saikiran

Answer 1

Ours is not a Desktop Application, but we want to handle Authentication(Which authenticates the userid and password by making a Tuxedo call) and add the Principal to Subject in session, so that ADF Authorization and securityContext can be used as is,
but doing this with Custom Authentication Provider in weblogic needs me to have a lot of Tuxedo Service related jars in weblogic/system classpath which i feel is not right thing to do, as the same jars are required in application also, which means i will have the jars in class path twice and i need to deploy the jars to both places everytime there is any change.
Is there any way by which i can set Authenticated principal to Subject in the created session from within Application?