JAAS/Tomcat - providing more login information than just username/password

Question

Sorry if this is a vague question or that I seem lazy, but I have been asked to say if an easy solution is available by the end of the day so I thought I would ask some of the experts!
I currently have a tomcat application which is protected by basic FORM protection with user name and password held within the database.
This application is to be rolled out and accessed by multiple clients, non of which should have access to each others data.
All of this is in place and a username is currently associated with a client. However we have been asked if the login can be changed so that the user logs in as
client-name/user-name/password for two reasons - firstly to avoid the possibility of the same username existing for more than one client and secondly as we now have a user who will be able to log in to more than one of the clients and creating two separate user names is not seen as the answer.
My guess is that this may be possible using JAAS though I have found no example showing this yet (and as always have not had much time to do so!)
Could anyone tell me if they think this is possible?
Many thanks in advance

Answer 1

ToddTobin wrote:
We are developing a custom SSPI module for our weblogic servers, and i have a concern
with remote logins for remote ejb calls.
The documentation statest that the UsernamePasswordLoginModule is a good way to
remotely log into a different BEA server so that ejb calls can be made from the
Security.runAs context. However, i need to have more information passed than
just the username password combination. e.g. applicationId that is making the
call, in addition to the userid.
The docs recommend creating your own login module, which is fine, but if i am
correct the UsernamePasswordLoginModule uses the environment object and Authenticate.athenticate,
to perform the login to my sspi. in that case the name is somehow translated
into a NameCallback and (credential) Password to a PasswordCallback. If i want
to add a different callback, "CallingAppCallback" where is that set in the environment
object? In the properties? and if so, how is that then accessed by my LoginModule
or AuthenticationProviderImpl?
I just dont see how to extend the functionality of UsernamePasswordLoginModule,
for remote-server logins?Yes, this is a major limitation. I had a similar limitation when I
implemented a kerberos client. If you can't fit what you want into two
string fields, you are stuffed. BEA really need to open up the API for
client-side login modules. To be fair to BEA, JAAS is useless so they
weren't working with something that was designed for distributed systems
in the first place.
Anyway I worked around it by base 64 encoding my data (which was binary
obviously). I suggest you come up with some way of encoding the
application id in the username, e.g user@id or something along those lines.
If you do come up with a better solution I'd be very interested to know!
Robert