How to Use Weblogic6.1 JAAS Sample in Servlet???

Question

Hi there,
I am now developing JAAS security service based on weblogic. Here is the problem I met with:
1. There is no problem when invoking JAAS sample from application.
But Subject.doAs() is denied when moving the application to servlet.
2. It is said that when invoking JAAS from servlet,
an authenticated subject will be returned using:
Subject subjectTest = loginContext.getSubject();
How can I store the subject into the session and be called later?
3. getUserPrincipal(), isUserInRole() are two important
methods in authenticaion on web services.
How is the user principal and role stored in the session?
4. Where can I find some tutorials on invoking JAAS service from servlet?
Thanks.
============================================================
This is my source code
package examples.security.jaas;
import javax.servlet.*;
import javax.servlet.http.*;
import javax.naming.Context;
import javax.naming.InitialContext;
import java.io.*;
import java.util.*;
import javax.security.auth.Subject;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.TextOutputCallback;
import javax.security.auth.callback.TextInputCallback;
import javax.security.auth.callback.NameCallback;
import javax.security.auth.callback.PasswordCallback;
import javax.security.auth.callback.UnsupportedCallbackException;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import javax.security.auth.login.FailedLoginException;
import javax.security.auth.login.AccountExpiredException;
import javax.security.auth.login.CredentialExpiredException;
public class SampleServlet extends HttpServlet
public void doGet(HttpServletRequest req, HttpServletResponse res)
throws ServletException, IOException
doPost(req, res);
System.out.println("1\n");
public void doPost(HttpServletRequest req, HttpServletResponse res)
throws ServletException, IOException
HttpSession session = req.getSession(true);
res.setContentType("text/html");
PrintWriter out = res.getWriter();
System.out.println("2\n");
String username = req.getParameter("username");
String password = req.getParameter("password");
String url = req.getParameter("url");
LoginContext loginContext = null;
Context ctx = null;
try
// Set server url for SampleLoginModule
Properties property = new Properties(System.getProperties());
property.put("weblogic.security.jaas.ServerURL", "http://localhost:7001");
System.setProperties(property);
property = new Properties(System.getProperties());
property.put("weblogic.security.SSL.ignoredHostnameVerification", "TRUE");
System.setProperties(property);
// Set configuration class name to load SampleConfiguration
property = new Properties(System.getProperties());
property.put("weblogic.security.jaas.Configuration", "examples.security.jaas.SampleConfig");
System.setProperties(property);
// Set configuration file name to load sample configuration policy file
property = new Properties(System.getProperties());
property.put("weblogic.security.jaas.Policy", "Sample.policy");
System.setProperties(property);
// Create LoginContext; specify username/password login module
loginContext = new LoginContext("SamplePolicy", new MyCallbackHandler());
catch(SecurityException se)
se.printStackTrace();
System.exit(-1);
catch(LoginException le)
le.printStackTrace();
System.exit(-1);
System.out.println("SampleServlet:" + username + "\n");
// Attempt authentication
try
// If we return without an exception, authentication succeeded
loginContext.login();
catch(FailedLoginException fle)
out.println("Authentication Failed, " + fle.getMessage());
System.exit(-1);
catch(AccountExpiredException aee)
out.println("Authentication Failed: Account Expired");
System.exit(-1);
catch(CredentialExpiredException cee)
out.println("Authentication Failed: Credentials Expired");
System.exit(-1);
catch(Exception e)
out.println("Authentication Failed: Unexpected Exception, " + e.getMessage());
e.printStackTrace();
System.exit(-1);
// Retrieve authenticated subject, perform SampleAction as Subject
out.println("Authentication succeeded " );
System.out.println("===============start to trace333\n");
Subject subject = loginContext.getSubject();
System.out.println("Subject:"+subject.toString()+"\n");
System.out.println("Subject.getclass:" + subject.getClass().getName());
SampleAction sampleAction = new SampleAction();
Subject.doAs(subject, sampleAction);
System.out.println("4\n");
// System.exit(0);
========================================================
void doPost(
HttpServletRequest req,
HttpServletResponse resp) {
Principal p =
req.getUserPrincipal();
auditCall(p.getName());
if (req.isUserInRole(
"ManagersRole")) {
// Do some Manager stuff
} else if
(ctx.isUserInRole(
"SalesRole")) {
// Do some Sales stuff
I'll describe where JAAS fits in to the web app model but please note that some of this should be automatically handled by your Servlet container.
Servlet engine (or your MVC servlet controller) receives a request for a protected resource.
It then checks for the existence of an "authenticated" token in the HttpSession.
If that token doesn't exist then it forwards the user to the login page.
The user fills in the form, and the login servlet receives the username and password at which point the JAAS Login Module is called with two callback objects: one that returns the username and one that returns the password.
The JAAS Module checks to see if the credentials are valid, if not, it throws an authentication exception.
Once control is returned to the Login Servlet, the Login Servlet would add the authenticated "Subject" to the HttpSession and if necessary, an authentication "token".
So, JAAS is really only called ONCE, not for every web request, and it's called
by the "logical" Login Servlet AFTER the user submits their login information.
JAAS is not used to check for whether the user is authenticated already or not.
the weblogic 6.1 server side exception
username: joeuser
password: joepass
<May 25, 2002 11:05:20 PM PDT> <Error> <HTTP> <[WebAppServletContext(2169486,exa
mplesWebApp,/examplesWebApp)] Servlet failed with Exception
java.lang.SecurityException: Attempting Privileged Action With Unauthenticated S
ubject
at javax.security.auth.Subject.doAs(Subject.java:74)
at examples.security.jaas.SampleClient.startWeb(SampleClient.java:200)
at jsp_servlet.__poc1._jspService(__poc1.java:92)
at weblogic.servlet.jsp.JspBase.service(JspBase.java:27)
at weblogic.servlet.internal.ServletStubImpl.invokeServlet(ServletStubIm
pl.java:265)
at weblogic.servlet.internal.ServletStubImpl.invokeServlet(ServletStubIm
pl.java:200)
at weblogic.servlet.internal.WebAppServletContext.invokeServlet(WebAppSe
rvletContext.java:2495)
at weblogic.servlet.internal.ServletRequestImpl.execute(ServletRequestIm
pl.java:2204)
at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:139)
at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:120)
>

Answer 1

If anyone of you, has got any answers related to the above mentioned problem, Post it here, Will folks from SUN respond to this at any time.
Regards
Jayendran