Ignoring security in JAAS based on Subject

Question

Hi,
I'm using JDK1.3 and I've JAAS-jar installed into JAVA.HOME\jre\lib\ext\.
I tried to make simple JAAS-based application.
Below is the code:
package security1;
import javax.security.auth.*;
import java.security.*;
public class Main {
public static void main(String[] args) {
Subject subject = new Subject();
Principal principal = new com.sun.security.auth.NTUserPrincipal("testUser");
subject.getPrincipals().add(principal);
Subject.doAs(subject, new PrivilegedAction() {
public Object run() {
System.out.println("User.home: "+System.getProperty("user.home"));
return null;
In addition to this code I have two files:
1. The first file is sample_java2.policy with the following content:
grant codeBase "file:${java.home}/lib/ext/*" {
permission java.security.AllPermission;
grant codebase "file:d:/winnt/profiles/pledniko.000/jbproject/security1/-" {
permission java.security.AllPermission;
2. The second file is sample_jaas.policy with the following content:
grant principal com.sun.security.auth.NTUserPrincipal "testUser" {
permission java.util.PropertyPermission "user.home", "read";
To run my app I use the following string:
D:\jbuilder5\jdk1.3\bin\java -classpath
"D:\WINNT\Profiles\pledniko.000\jbproject\Security1\classes;D:\jbuilder5\jdk1.3\demo\jfc\Java2D\Java2Demo.jar;D:\jbuilder5\jd
k1.3\jre\lib\i18n.jar;D:\jbuilder5\jdk1.3\jre\lib\jaws.jar;D:\jbuilder5\jdk1.3\jre\lib\rt.jar;D:\jbuilder5\jdk1.3\jre\lib\sun
rsasign.jar;D:\jbuilder5\jdk1.3\lib\dt.jar;D:\jbuilder5\jdk1.3\lib\tools.jar;D:\j2sdkee\lib\j2ee.jar;D:\orant\ora817\jdbc\lib
\classes12.zip;D:\jbuilder5\jdk1.3\jre\lib\ext\jaas.jar" -Djava.security.manager
-Djava.security.policy==d:\winnt\profiles\pledniko.000\jbproject\security1\config\sample_java2.policy
-Djava.security.auth.policy==d:\winnt\profiles\pledniko.000\jbproject\security1\config\sample_jaas.policy security1.Main
It works good and prints: "User.home: D:\WINNT\Profiles\pledniko.000"
But when I comment string "permission java.util.PropertyPermission "user.home", "read";" in the second file and
run my app again it again prints: "User.home: D:\WINNT\Profiles\pledniko.000" instead of throwing access denied exception.
So it seems that security based on Subject is ignoring.
Can you please explain what's the problem or what I'm doing wrong?
Any suggestions would be greatly appreciated.
Pavel Lednikov,
Software developer.
[email protected]

Answer 1

Privet Pavel!
See thread
http://forum.java.sun.com/thread.jsp?forum=60&thread=169227
I think the cure there is the same as for your problem.
So use
   Subject.doAsPrivileged(subject,action,null);instead of
   Subject.doAs(subject,action);see documentation of doAsPrivileged.
Happy coding,
Kullervo