Jaas Login module does not work

Question

Hello,
I am developing simple web application wich uses jaas for authentication, but something strange happens, i have written security information in my web.xml:
<security-constraint>
          <web-resource-collection>
               <web-resource-name>simple</web-resource-name>
               <url-pattern>/security/*</url-pattern>
          </web-resource-collection>
          <auth-constraint>
               <role-name>admin</role-name>
          </auth-constraint>
     </security-constraint>
     <login-config>
          <auth-method>FORM</auth-method>
          <form-login-config>
               <form-login-page>/login.seam</form-login-page>
               <form-error-page>/login.seam</form-error-page>
          </form-login-config>
     </login-config>
     <security-role>
          <role-name>admin</role-name>
     </security-role>my login module looks like this:
package com.auth.security;
public class SimpleLoginModule implements LoginModule {
     // initial state
     private Subject subject;
     private CallbackHandler callbackHandler;
     private Map sharedState;
     private Map options;
     // the authentication status
     private boolean succeeded = false;
     private boolean commitSucceeded = false;
     // login info
     private static final String[] userNames = { "admin", "guest", "user1", "user2" };
     private static final String[] passwords = { "admin", "sesame", "pass1", "pass2" };
     // current user
     private String username;
     private char[] password;
     // user's principal object
     private SimplePrincipal userPrincipal;
     public void initialize(Subject subject, CallbackHandler callbackHandler, Map sharedState, Map options) {
          System.out.println("INITIALIZE");
          this.subject = subject;
          this.callbackHandler = callbackHandler;
          this.sharedState = sharedState;
          this.options = options;
     }// end initialize()
          public boolean login() throws LoginException {
          System.out.println("LOGIN");
          // prompt for a user name and password
          if (callbackHandler == null)
               throw new LoginException("Error: no CallbackHandler available " + "to garner authentication information from the user");
          Callback[] callbacks = new Callback[2];
          callbacks[0] = new NameCallback("\nuser name: ");
          callbacks[1] = new PasswordCallback("password: ", false);
          try {
               callbackHandler.handle(callbacks);
               username = ((NameCallback) callbacks[0]).getName();
               char[] tmpPassword = ((PasswordCallback) callbacks[1]).getPassword();
               if (tmpPassword == null) // treat a NULL password as an empty
                    // password
                    tmpPassword = new char[0];
               password = new char[tmpPassword.length];
               System.arraycopy(tmpPassword, 0, password, 0, tmpPassword.length);
               ((PasswordCallback) callbacks[1]).clearPassword();
          } catch (java.io.IOException ioe) {
               throw new LoginException(ioe.toString());
          } catch (UnsupportedCallbackException uce) {
               throw new LoginException("Error: " + uce.getCallback().toString() + " not available to authenticate user.");
          boolean usernameCorrect = false;
          boolean passwordCorrect = false;
          String passwordString = new String(password);
          for (int x = 0; x < userNames.length; x++) {
               if (username.equals(userNames[x]))
                    usernameCorrect = true;
               if (usernameCorrect && passwordString.equals(passwords[x])) {
                    // authentication succeeded!!!
                    passwordCorrect = true;
                    succeeded = true;
                    break;
               } else {
                    // authentication failed -- clean out state
                    succeeded = false;
                    usernameCorrect = false;
               }// end if/else
          }// end for( int x = 0; x < userNames.length; x++ )
          return succeeded;
     }// end login()
     public boolean commit() throws LoginException {
          System.out.println("COMMIT");
          if (!succeeded) {
               return false;
          } else {
               // add a Principal (authenticated identity)
               // to the Subject
               // assume the user we authenticated is the SimplePrincipal
               userPrincipal = new SimplePrincipal(username);
               if (!subject.getPrincipals().contains(userPrincipal))
                    subject.getPrincipals().add(userPrincipal);
               // in any case, clean out state
               username = null;
               password = null;
               commitSucceeded = true;
               return true;
          }// end if( succeeded == false )
     }// end commit()
     public boolean abort() throws LoginException {
          System.out.println("ABORT");
          if (succeeded == false) {
               return false;
          } else if (succeeded == true && commitSucceeded == false) {
               // login succeeded but overall authentication failed
               succeeded = false;
               username = null;
               if (password != null)
                    password = null;
               userPrincipal = null;
          } else {
               // overall authentication succeeded and commit succeeded,
               // but someone else's commit failed
               logout();
          }// end if/else
          return true;
     public boolean logout() throws LoginException {
          System.out.println("LOGOUT");
          subject.getPrincipals().remove(userPrincipal);
          succeeded = false;
          succeeded = commitSucceeded;
          username = null;
          if (password != null)
               password = null;
          userPrincipal = null;
          return true;
}I am using Jboss-4.2.3.GA and configured login-config.xml like this:
    <application-policy name="simpleLoginModule">
     <authentication>
      <login-module code="com.security.auth.simpleLoginModule" flag="required">
      </login-module>
     </authentication>
    </application-policy>I have jboss-web.xml also correctly configured.
The problem is that when i type correct username/password happens the error:
HTTP Status 403 - Access to the requested resource has been denied
So can anyone help me? What i have to change/modify in my loginmodule java code?

Answer 1

Hi,
no need to change the authschemes.xml file when you don't know if your code works (you can perfectly break logon to other applications when doing so).
Configure your application to use declarative authentication; this is done in the web.xml of the application:
http://help.sap.com/SAPhelp_nw70/helpdata/en/08/0f0e4d1ffece4d8b9c5b84793aac50/content.htm
http://help.sap.com/SAPhelp_nw70/helpdata/en/40/97ffdb74939747b402b0200780cab5/content.htm
http://help.sap.com/SAPhelp_nw70/helpdata/en/b9/9482887ddb3e47bd1a738c3e900195/content.htm
example:
     <login-config>
          <auth-method>FORM</auth-method>
          <realm-name>REALM</realm-name>
          <form-login-config>
               <form-login-page>logon.jsp</form-login-page>
               <form-error-page>error.jsp</form-error-page>
          </form-login-config>
     </login-config>
With declarative authentication the AS Java will use the logon modules you confired in the VA for the application.
br,
Tobias