Permissions with two jar files

Question

Hello,
I've run across a interesting problem. I'm using Java 1.3.1 with JAAS 1.0. I've written a LoginModule, Principal, and CallbackHandler that reside in one jar, authentication.jar. The class that use the authentication.jar is in another jar file, client.jar. When ever I run client.jar, I always get:
Exception in thread "main" java.security.AccessControlException: access denied (
javax.security.auth.AuthPermission createLoginContext)
at java.security.AccessControlContext.checkPermission(Unknown Source)
at java.security.AccessController.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPermission(Unknown Source)
at javax.security.auth.login.LoginContext.init(LoginContext.java:154)
at javax.security.auth.login.LoginContext.<init>(LoginContext.java:319)
at test.authenticate.Authenticator
.<init>(Authenticator.java:38)
at test.authenticate.Authenticator
.getInstance(Authenticator.java:58)
at JaasAuthTest.main(JaasAuthTest.java:14)
If I move the JaasAuthTest class from client.jar to the Authentication.jar, everything works fine. I've been messing with permissions and I can't seem to find configuration that works. I've tried granting AllPermission and .AuthPermission "createLoginContext" to each of may jar files with no success. Is there any reason I can't have my JAAS code in one jar and my client code in another? Has anyone else seen this before?
Thanks,
-Jon

Answer 1

The JAVA class loader puts all code in a so called Protection Domain depending on its origin and class loader.
Class files from different jars are typically put in different domains as they have a different origin and propably class loader.
If you set up an appropriate policy file with permissions for the second jar file as the code base, it should be working fine, I believe.
Oliver