Implemention of JAAS+servlet+jboss+sql database

Question

Hi,
I am trying to implement JAAS for login module using code and CallbackHandler( ie lc = logincontext(...).), but i got a sample code which is used for commandline execution, but i need to implement in web application, what all are the files that i need to configure to implement JAAS in web application?, so that i can check the user name and password which is entered by the user against the value that inside my sql database. it would be appreciated if anyone send some sample code to start work on JAAS.
Regards
kumar

Answer 1

Kumar,
i am trying to do the same thing, but i am having a slight problem, maybe between the two of us we can figure it out. here is what i have come up with so far:
1. edit web.xml to specifiy which directories and pages are secured and accessed only by specific user roles (Optional)
2. edit login-config.xml which is found in JBOSS_directory/server/default/conf or JBOSS_directory/server/all/conf depending on which version of the server you are using. you need to add the following to login-config.xml file, to include the JAAS DatabaseServerLoginModule, the configuration is as follows:
<application-policy name = "testDB"> <! -- this is the name of the secrurity policy which you refer to in jboss-web.xml
<authentication>
<login-module code = "org.jboss.security.auth.spi.DatabaseServerLoginModule"
flag = "required">
<module-option name = "unauthenticatedIdentity">guest</module-option>
<module-option name = "dsJndiName">java:/testDB</module-option> <! -- this is the datasource the is used to connect to your database
<module-option name = "principalsQuery">SELECT password from Principals where PrincipalID =?</module-option>
<module-option name = "rolesQuery">SELECT Role, Rolegroup FROM roles WHERE principalid=?</module-option>
</login-module>
</authentication>
</application-policy>3. you edit jboss-web.xml with the following code
<jboss-web>
<security-domain>java:/jaas/testDB</security-domain>
<context-root>/testJBOSSsecurity</context-root>
</jboss-web>4. Create a Login Form with the action pointing to the servlet you will create in the next step
5. create the servlet that handles logging the user in
****loginservlet.java*****
import java.security.Principal;
import java.security.PrivilegedAction;
import java.util.Locale;
import javax.servlet.*;
import javax.servlet.http.*;
import java.util.Set;
import javax.security.*;
import org.jboss.security.SimplePrincipal;
import org.jboss.security.auth.callback.SecurityAssociationHandler;
try {
SecurityAssociationHandler handler = new
SecurityAssociationHandler();
Principal user = new SimplePrincipal(request.getParameter("j_username"));
handler.setSecurityInfo(user, request.getParameter("j_password"));
LoginContext loginContext = new LoginContext("testDB",(CallbackHandler)handler);
loginContext.login();
Subject subject = loginContext.getSubject();
Set principals = subject.getPrincipals();
principals.add(user);
out.println(subject.toString());
//response.sendRedirect("securepage.java");
}6. create two database tables: one to hold the principalid (primary key) and password. this table is called pricipals. create another table to hold the user roles. call this table roles, and it has three fields. principalid as a primary key and a foreign key from the principals table, role and rolegroup
this is what i have so far, but it's not working, i have posted my problem in this link [http://forum.java.sun.com/thread.jspa?threadID=5293266|http://forum.java.sun.com/thread.jspa?threadID=5293266] as well an other forums since two nights ago, but so far no replies. so read the post and you will get a better picure and try it out, if you have luck wiith it, please let me know
Sam