JAAS Principals and subject

Question

Hi,
I am not sure on what is the correct way to use subject and principals for jaas authentication.
Assume I have my custom Login Module.
This is the simple unit test I have done:
// create the header to authenticate.
          HeaderT header = new HeaderT();          
          header = HeaderUtils.setNVSInHeader(header, HeaderConstants.USERNAME, "user");
          header = HeaderUtils.setNVSInHeader(header, HeaderConstants.PASSWORD, "password");
          LoginContext ctx = new LoginContext("mtosi", new HeaderCallbackHandler(header));          
          //login
          ctx.login();
          header = new HeaderT();          
          header = HeaderUtils.setNVSInHeader(header, HeaderConstants.USERNAME, "user2");
          header = HeaderUtils.setNVSInHeader(header, HeaderConstants.PASSWORD, "password2");
          LoginContext ctx2 = new LoginContext("mtosi", new HeaderCallbackHandler(header));
          ctx2.login();
          assertEquals(2, ctx2.getSubject().getPrincipals().size());The header contains the username and password info that are authenticated in a custom LoginModule.
What I expected was that calling the LoginContext login somehow the different users would have been stored in the subject. So that the second time I would have called the login (on a different insance of Login Context) I would have had the 2 principals authenticated.
The first Principal gets lot instead.
What I am missing?
Where should the Principals have to be stored?
Does the Login Context maintains a list of the Principals that get authenticated or they are new each time I call a login on a different instance of Login Context?
thanks
Edited by: Davide_Gesino on Feb 7, 2008 7:37 AM

Answer 1

danielm26,
You can create a class that implements the Pricipal interface, adding anything that you want to it. Populate the object at login method from your LoginModule and add it to the subject object - subject.getPrincipals().add(yourPrincipal).
In you jsp page you can retrieve this subject as fallows:
Subject subject = (Subject) PolicyContext.getContext("javax.security.auth.Subject.container");
Then iterate subject.getPrincipal() testing if the Principal object is an instance of your Principal class, cast the found one and be happy.
Pedro.