JAAS in Web Applications

Question

Hi,
I am new to JAAS and was implementing the Tomcat JAAS realm in web application,I am stuck with the invocation of life cycle methods flow like,login(),handle(),commit(),abort() and logout().
Please help me.
In the server.xml,JAAS realm is set.
In the web.xml,login config is set as FORM(action=j_security_check)
So when certain URL(like/*) is set under <security-constraint>,and the request is of /* ,the <form-login-page> of the FORM would be displayed and then the username and password would be obtained by the web container.I want this username and password to be get authenticated and authorised by JAAS framework.But how those username and password retreived by the wecontainer from the user is passed to the Jass CallBackHandlers.
If JAAS realm is used we have callbakchandlers for getting the credentials(username and password) from the user.But if the FORM custom JSP is used ,we get the username and password in j_username and j_password parameters.So how the callbackhandlers get these info from the web container OR whether callbakchandlers are not needed in this case? Please clarify me.
This is with reference to Cote's free jassbook chapter 09.

Answer 1

Hello,
Did you get any further with your implementation, I am trying to integrate JAAS into our system too and have roadblocks. I have gone through Cote's JAAS book and am stuck as to how to authenticate the JAAS login context on top of my existing authentication that cannot be changed. I am trying to implement a login module that will set the principals and creds for the user but do not know how to invoke this separately from the existing login.
Also after I set the loginContext and get the subject with the principals that have the permissions that I require how do I persist it for all future calls. Making it part of the session seems to the only option. I was under the impression that JAAS can make this persistable, any ideas there.
Thanks for any help,
Pravin