JAAS + Sun Application Server 9 + Enterprise app Web Module

Question

Hi!
I've got a little problem with JAAS in enterprise application (with web module): i've configured SAS 9.0 with my custom security realm. I've 2 classes - one extends AppservPasswordLoginModule and the other one extends AppservRealm. In app-server-domain-dir/config/login.conf i've configured my login module. In SAS -> configuration -> Security -> Realm i've added new entry for my realm (and provide it with my realm class name).
In configuration of my enterprise application (sun-application.xml) i've a security realm and roles configured.
Now: everything works fine, if the authentication to my application is done by a jsp file with:
<form action="j_security_check">
<input type="text" name="j_username">
<input type="password" name="j_password">
</form>
But i need to implement authentication in a servlet, so i've done this (in servlet):
LoginContext lc = new LoginContext( NAME, new WebCallbackHandler(username, password);
lc.login();
Problem is: if i specify NAME as a name form domain-dir/config/login.config it throws an exception: LoginException: No credentials.
If i specify NAME as a name from SAS configuration -> security -> realm name, it throws an exception: LoginException: No LoginModules
Now i'm really confused... anyone has an idea?
Thanks!

Answer 1

Hi!
I've got a little problem with JAAS in enterprise application (with web module): i've configured SAS 9.0 with my custom security realm. I've 2 classes - one extends AppservPasswordLoginModule and the other one extends AppservRealm. In app-server-domain-dir/config/login.conf i've configured my login module. In SAS -> configuration -> Security -> Realm i've added new entry for my realm (and provide it with my realm class name).
In configuration of my enterprise application (sun-application.xml) i've a security realm and roles configured.
Now: everything works fine, if the authentication to my application is done by a jsp file with:
<form action="j_security_check">
<input type="text" name="j_username">
<input type="password" name="j_password">
</form>
But i need to implement authentication in a servlet, so i've done this (in servlet):
LoginContext lc = new LoginContext( NAME, new WebCallbackHandler(username, password);
lc.login();
Problem is: if i specify NAME as a name form domain-dir/config/login.config it throws an exception: LoginException: No credentials.
If i specify NAME as a name from SAS configuration -> security -> realm name, it throws an exception: LoginException: No LoginModules
Now i'm really confused... anyone has an idea?
Thanks!