Private Credentials and how to get them back

Question

How to extract back the private credentials in a clean way from weblogic?
We are currently working with bea weblogic version 7
and have developed an authentication module and a credential mapper module
The authentication is fairly simple : the user types in a username and password
and we come into the Authenticator Provider which we configered in our realm
The partial signature of the interface interface javax.security.auth.spi.LoginModule
public void initialize(Subject subject,CallbackHandler callbackHandler,Map sharedState,Map
options)
in the initialize method we store the subject in a private variable
public boolean commit()
in the commit method we add a principal to the subject via
     subject.getPrincipals().add(new Principal(username))
and we add the private credentials as
     subject.getPrivateCredentials().add(new PasswordCredential(username,password))
Now ,
some time later when the user want's to access an ejb that is using a JCA connector
component
and want's to retrieve a connection, we will pass via the Credential Mapper that
we configured in the realm.
The method signature is
public Vector getCredentials(Subject requestor,Subject initiator,Resource resource,String[]
credentialTypes)
The initiator subject represents the user that authenticated himself
I can extract the principal with the method subject.getPrincipals
but when i try to extract subject.getPrivateCredentials i get an empty set.
The questions is of course did weblogic hide away the private credentials or not.
I can work around this but stuffing the password in the principal at the moment
of authentication , but i would prefer a cleaner solution.
Any ideas
Blyau Gino
[email protected]

Answer 1

Is the Subject created in the Authenticator ever serialized or passed across
the wire? If so, anything stored in the private or public credentials will
be removed as part of the serialization process. This is documented in the
JAAS specifications from Sun.
Paul Patrick
"gino blyau" <[email protected]> wrote in message
news:[email protected]...
>
How to extract back the private credentials in a clean way from weblogic?
We are currently working with bea weblogic version 7
and have developed an authentication module and a credential mapper module
The authentication is fairly simple : the user types in a username andpassword
and we come into the Authenticator Provider which we configered in ourrealm
>
The partial signature of the interface interfacejavax.security.auth.spi.LoginModule
>
public void initialize(Subject subject,CallbackHandlercallbackHandler,Map sharedState,Map
options)
in the initialize method we store the subject in a private variable
public boolean commit()
in the commit method we add a principal to the subject via
subject.getPrincipals().add(new Principal(username))
and we add the private credentials as
subject.getPrivateCredentials().add(newPasswordCredential(username,password))
>
>
Now ,
some time later when the user want's to access an ejb that is using a JCAconnector
component
and want's to retrieve a connection, we will pass via the CredentialMapper that
we configured in the realm.
The method signature is
public Vector getCredentials(Subject requestor,Subjectinitiator,Resource resource,String[]
credentialTypes)
The initiator subject represents the user that authenticated himself
I can extract the principal with the method subject.getPrincipals
but when i try to extract subject.getPrivateCredentials i get an emptyset.
The questions is of course did weblogic hide away the private credentialsor not.
>
I can work around this but stuffing the password in the principal at themoment
>
of authentication , but i would prefer a cleaner solution.
Any ideas
Blyau Gino
[email protected]