JAAS Authentication

Question

Hi,
how can JAAS be used with sjsws? Are there JAAS-Howtos or other documents dealing with JAAS? Examples?
I have an already implemented JAAS-Login module using the javax.security.auth.spi.LoginModule interface.
Is it possible to use it with sjsws? How? Where can I configure what Principals are possible?
Can I use JAAS to authenticate webdav-users? How?
Yours
Arne
Edited by: Arne.v.Irmer on Nov 22, 2007 8:02 AM

Answer 1

Hi mv,
our JAAS-LoginModule is too complex to post it here. I made a small example, that is near to what we do here.
It authenticates the user "user" with the role/principal "userRole" and the user "admin" with the role "adminRole". Both have the principal "authenticateduser". Passwords are the same as the account.
Here is the LoginModule:
package sample.security.jaas;
import java.io.IOException;
import java.util.Map;
import javax.security.auth.Subject;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.NameCallback;
import javax.security.auth.callback.PasswordCallback;
import javax.security.auth.callback.UnsupportedCallbackException;
import javax.security.auth.login.LoginException;
import javax.security.auth.spi.LoginModule;
public class TestLoginModule implements LoginModule {
     private CallbackHandler callbackHandler;
     private Subject subject;
     private boolean success;
     public boolean abort() throws LoginException {
        // Clean out state
        success = false;
        logout();
        return true;
     public boolean commit() throws LoginException {
          if (success){
               //Add a general principal
               subject.getPrincipals().add(new TestPrincipal("authenticateduser"));
               System.out.println("authenticateduser");
          return true;
     public void initialize(Subject subject, CallbackHandler callbackHandler,
               Map<String, ?> sharedState, Map<String, ?> options) {
        // save the initial state
        this.callbackHandler = callbackHandler;
        this.subject = subject;
     public boolean login() throws LoginException {
        // Setup default callback handlers.
        Callback[] callbacks = new Callback[] {
                new NameCallback("Username: "),
                new PasswordCallback("Password: ", false)
        try {
            callbackHandler.handle(callbacks);
        } catch (IOException e) {
        } catch (UnsupportedCallbackException e) {
        String username = ((NameCallback)callbacks[0]).getName();
        String password = new String(((PasswordCallback)callbacks[1]).getPassword());
        ((PasswordCallback)callbacks[1]).clearPassword();
        //Check passwords and add principals
        if(username!=null){
             success = username.equalsIgnoreCase("admin") && password.equals("admin");
             if(success){
                  subject.getPrincipals().add(new TestPrincipal("adminRole"));
             }else{
                 success = username.equalsIgnoreCase("user") && password.equals("user");
                 if(success){
                      subject.getPrincipals().add(new TestPrincipal("userRole"));
        } else
             success=false;
        callbacks[0]=callbacks[1]=null;
        return true;
     public boolean logout() throws LoginException {
        // remove the principals
        subject.getPrincipals(TestPrincipal.class).removeAll(subject.getPrincipals(TestPrincipal.class));
          return false;
}And here is the Principal:
package sample.security.jaas;
import java.io.Serializable;
import java.security.Principal;
public class TestPrincipal implements Principal, Serializable {
    private String uniqueIdentifier;
    public TestPrincipal(String uniqueIdentifier) {
        this.uniqueIdentifier = uniqueIdentifier;
    public String getName() {
        return this.uniqueIdentifier;
}You can download this code in a small project at
http://ews2.uni-dortmund.de/installation/jaas-src.tgz_
or if you want a tomcat 5.5.23 using this LoginModule to authenticate under
http://ews2.uni-dortmund.de/installation/jaastest.tgz_
I'm curious about your answer.
Yours
Arne