Jaas + custom policy

Question

I want to source my JAAS policy files from a database.
I extended java.security.Policy and I can dynamically assign permissions to a codesource. I also have JAAS authorization running without any problems. What I can't figure out is how I can associate a dynamic principal with a protection domain so that getPermissions(ProtectionDomain) will magically work with Subject.doAs without re-writing half of sun.security. Has anyone accomplished something like this? I'm concentrating on 1.4, altho I'm not above using a 1.3 specific solution.

Answer 1

I think I've worked it out (I don't think anyone cares anymore though). This post is just up here so people hit it when they search.
If you subclass Policy and set it (e.g. using Policy.setPolicy or with properties files), then you implment the
boolean implies(ProtectionDomain dom, Permission perm)Method, then it pretty much works!
Whenever you do some action with Subject.doAsPrivileged, for example, an array or principals is given you your implies method available in the ProtectionDomain, i.e. with
boolean implies(ProtectionDomain dom, Permission perm)
  Principal[] prins = dom.getPrincipals();
  for (int i = 0; i < prins.length; i++)
     if (prins[i] instanceof MyPrincipal) {
       MyPrincipal p = (MyPrincipal) prins;
return UserPermissions.getPermissionSetFor(p).contains(perm); // or something. Havn't worked out exactly what happens here
return false;
I think that's how it works.
Here's some code I wrote to test these ideas out. When you run it, you notice that none of the other Policy methods (getPermissions() in particular) are ever called.
import javax.security.auth.Subject;
import java.security.Policy;
import java.security.PrivilegedAction;
import java.io.FileInputStream;
import java.io.File;
import java.io.IOException;
import java.util.Set;
import java.util.HashSet;
import java.util.logging.Logger;
public class JaasExperiment {
    public static void main(String args[])
        Policy.setPolicy(new MyPolicy());
        Set pubcred = new HashSet();
        Set privcred = new HashSet();
        Set princips = new HashSet();
        princips.add(new MyPrincipal("keith"));
        Subject keith = new Subject(false, princips, pubcred, privcred);
        Subject.doAsPrivileged(keith, new MyAction(), null);
        Set mprincips = new HashSet();
        mprincips.add(new MyPrincipal("michelle"));
        Subject michelle = new Subject(false, mprincips, pubcred, privcred);
        Subject.doAsPrivileged(michelle, new MyAction(), null);
        Logger.global.info("Finished");
    private static class MyAction implements PrivilegedAction
        public Object run() {
             try {
                FileInputStream in = new FileInputStream(new File("src/JaasExperiment.java"));
                int ch;
                while ((ch = in.read()) != -1)
                    System.out.print((char)ch);
                in.close();
            } catch (IOException e) {
                e.printStackTrace();
            return null;
import java.security.*;
import java.util.logging.Logger;
public class MyPolicy extends Policy
    boolean checking = true;
    private static Logger log = Logger.getLogger("MyPolicy");
    static {
        log.info("MyPolicy loaded");
    public PermissionCollection getPermissions(ProtectionDomain domain) {
        log.info("getPermissions domain:"+domain.toString());
        return null;
    public PermissionCollection getPermissions(CodeSource codesource)
        log.info("getPermissions codewsource:"+codesource);
        return null;
    public boolean implies(ProtectionDomain domain, Permission permission) {
        //log.entering("MyPolicy", "implies");
        log.finest("Domain codsource is:"+domain.getCodeSource().toString());
        log.fine("Permission "+ permission.getClass().getName() +":"+permission.getName() + " Requested");
        if (domain instanceof Object) {
            Object o = (Object) domain;
        Principal[] ppls= domain.getPrincipals();
        for (int i=0; i < ppls.length; i++)
            log.info("Principal "+i+" is " + ppls.getName());
if (checking)
checking = false;
//log.info("Domain:"+domain.toString());
//log.info("permission:"+permission.toString());
//log.exiting("MyPolicy", "implies");
return true;
public void refresh()
import java.security.Principal;
public class MyPrincipal implements Principal{
private final String name;
public MyPrincipal(String name)
this.name = name;
public String getName() {
return name;