JAAS. BEA, when and how should I use it?

Question

Hi,
I am confused and I hope someone at BEA sees this post or someone who knows the
answer steps up and clarifies this issue for me - please.
I have a basic web application, WLS 7, using Struts, Toplink, Oracle 8i. Pretty
standard. In 6.0 we used RDBMS realms to Authenticate and Authorize our users.
We used the web.xml to indicate we were using FORM based authentication and the
SECURITY CONSTRAINTS were using role names that matched what the RDBMS Realms
were pulling from Oracle.
As I read the docs and look at the examples I see all the old stuff is deprecated,
I do see I have the option of running in compatability mode - however I don't
want to do this if this is not the way things will be done in the future.
I followed the steps in the excellent post by Aaron Mulder "Weblogic 7 RDBMS Realm
Procedure" and create my own Authentication provider, deployed it and it seems
to be running. However I am now having problems getting the web.xml to "kick"
when I try and access a resticted resource I am not sent to my FORM Based authentication
login page... shouldn't I be? I would think the security constraints would be
loaded correctly and same with the LOGIN config stuff and that WLS would just
use all the providers but that it would know what to do for things like _security
check and all the contraints in the web.xml.
Am I going down the correct path? Do I just need to now write an Authorization
provider too? In my test in my Authentication provider I put everyone into the
"Administrators" group and use that in my web.xml. I would expect I would be sent
to the login page first, then WLS would upon form submittal, check the Authentication
provider, then my code would say all users are "Administrators", then it would
check that with the web.xml security constraint, then if the role matched would
send me on to the page.
Help :> I just want to get this working and make sure I am using the correct paradigm.
Thanks,
Jerry Rodgers

Answer 1

You use JAAS when running in the app maybe, that is up to the container. It
is transparent to the developer. If your writing a J2EE app, you do not need
to write JAAS modules. Use j_security_check and the rest is handled through
the container.
You don't need that runAs() shit or LoginContxt.login() etc.
Only if you are outside the container.
Go head, reinvent the wheel. JAAS is meant for people who write containers,
not for people who use them.
Way to add confusion to an already clouded issue.
Also, let me explain J2EE authorization
You said: "As far as I know, J2EE does not specify how the authentication
is performed, so I don't know how you can say that JAAS goes
against the J2EE spec."
Dude, you define security restraints (authorization) to whatever resources
you want through a web.xml or ejb-jar.xml by asigning roles to them.
Im doing it as we speak.
Mike
"Wayne M Adams" <[email protected]> wrote in message
news:[email protected]...
>
Michael:
Please see my posts (8771 and 8772). You do use JAAS
when running an app within the WLS container. In fact,
you already are, whether you use the OOTB "new" security
SPI authentication providers or are in Compatibility
Security, in which case you're using JAAS through an adapter
to your old-style Realm.
Concerning "standard" authentication, the J2EE spec says:
"The web client forwards the authentication data to
the web server, where it is validated by the web
server... The validation mechanism may be local to
the server, or it may leverage the underlying
security services. On the basis of the validation,
the web server sets a credential for the user."
(Also, see section J2EE.3.3.2, "Non Goals").
As far as I know, J2EE does not specify how the authentication
is performed, so I don't know how you can say that JAAS goes
against the J2EE spec. WLS chose to use JAAS for authentication
because it's a Java-based implementation of a "standard" (PAM)
and Java security developers are familiar with it...
Jerry, it sounds like you're doing the right thing. You
will want to move away from the old Realm and get out of
Compatibility mode. I'm not sure what specific problem
you're having - if you're not being directed to your login
form page, my guess would be something else is wrong. That
is, I wouldn't expect to see a problem in the new ATN provider
crop up until after you had submitted your form info to
j_security_check. If you're not getting to the login page
at all, it would seem there might be a problem with a URL
mapping in a web resource collection, or something like that.
Just a guess.
Also, I don't think you need to implement your own provider
unless the one that's there doesn't meet your needs. In other
words, I can't see any reason why your authentication provider
couldn't work just fine with all the other WLS OOTB security
providers.
wayne
"Michael Lee" <[email protected]> wrote:
Dont use JAAS when running an app within your container. That goes
against
the J2EE spec.
Read my 32423432 previous posts here.
Mike
"Jerry Rodgers" <[email protected]> wrote in message
news:[email protected]...
Hi,
I am confused and I hope someone at BEA sees this post or someone whoknows the
answer steps up and clarifies this issue for me - please.
I have a basic web application, WLS 7, using Struts, Toplink, Oracle8i.
Pretty
standard. In 6.0 we used RDBMS realms to Authenticate and Authorizeour
users.
We used the web.xml to indicate we were using FORM based authenticationand the
SECURITY CONSTRAINTS were using role names that matched what the RDBMSRealms
were pulling from Oracle.
As I read the docs and look at the examples I see all the old stuffis
deprecated,
I do see I have the option of running in compatability mode - howeverI
don't
want to do this if this is not the way things will be done in the
future.
>>>
I followed the steps in the excellent post by Aaron Mulder "Weblogic7
RDBMS Realm
Procedure" and create my own Authentication provider, deployed it andit
seems
to be running. However I am now having problems getting the web.xmlto
"kick"
when I try and access a resticted resource I am not sent to my FORMBased
authentication
login page... shouldn't I be? I would think the security constraintswould
be
loaded correctly and same with the LOGIN config stuff and that WLSwould
just
use all the providers but that it would know what to do for thingslike
_security
check and all the contraints in the web.xml.
Am I going down the correct path? Do I just need to now write anAuthorization
provider too? In my test in my Authentication provider I put everyoneinto
the
"Administrators" group and use that in my web.xml. I would expect Iwould
be sent
to the login page first, then WLS would upon form submittal, checkthe
Authentication
provider, then my code would say all users are "Administrators", thenit
would
check that with the web.xml security constraint, then if the role
matched
would
send me on to the page.
Help :> I just want to get this working and make sure I am using thecorrect paradigm.
Thanks,
Jerry Rodgers