Programmatic JAAS Authentication for Web/EJBs on WebLogic 12c

Question

Technologies: JSPs, Servlets, EJBs (version 2.1)
Database: Oracle 11g Database
Application Server: WebLogic 12c
I am working on a project where the users and roles are stored on an Oracle database (as database users with roles granted to them). We therefore need a custom authentication method (the default WebLogic UsernamePasswordLoginModule won't cut it). We created a DatabaseUserLoginModule prior to migrating from a 10g enviroment to 11g/12c.
public class DatabaseUserLoginModule implements LoginModule
     public boolean login() throws LoginException
          Connection conn = null;
          try
               s
               InitialContext ic = new InitialContext();
               DataSource ds = (DataSource)ic.lookup(jndiDSName);
               conn = ds.getConnection(username, password);
               List dbauth = new ArrayList();
               String rolesSQL = "SELECT GRANTED_ROLE FROM USER_ROLE_PRIVS UNION SELECT GRANTED_ROLE FROM ROLE_ROLE_PRIVS";
               Statement rolesStmt = conn.createStatement();
               ResultSet results = rolesStmt.executeQuery(rolesSQL);
               dbauth.add(new DBUserPrincipal(username));
               while (results.next())
                    String roleName = results.getString("GRANTED_ROLE");
                    DBRolePrincipal dbRolePrincipal = new DBRolePrincipal(roleName);
                    dbauth.add(dbRolePrincipal);
               authPrincipals = (Principal[])dbauth.toArray(new Principal[dbauth.size()]);
          catch (Exception e)
               throw new LoginExcpetion(e.getMessage());
          finally
               try
                    conn.close();
               catch (Exception e)
                    throw new LoginExcpetion(e.getMessage());
          return true;
     public boolean commit() throws LoginException
          for (int i = 0; i < authPrincipals.length; i++)
               subject.getPrincipals().add(authPrincipals[i]);
          return true;
The getConnection() method on the datasource works with a database username and password thanks to the new "Use Database Credentials" option for WebLogic datasources and granting CONNECT THROUGH (datasource user) privilege for each user.
We have configured a JAAS context to use this login module by creating a jaas.conf file and setting JAVA_OPTIONS to include "-Djava.security.auth.login.config=%DOMAIN_HOME%\bin\jaas.conf". The file looks like this:
Test {
xxxx.controller.security.loginmodule.DatabaseUserLoginModule required;
When the user logs in, the application uses a LoginContext object to perform authentication:
    PassiveCallbackHandler cbh = new PassiveCallbackHandler(username, password);
    lc = new LoginContext("Test", cbh);
    lc.login();
This successfully uses the DatabaseUserLoginModule to authenticate the user and populate the Subject with the appropriate roles.
The next step is to use an InitialContext to lookup an EJB and call a method. We have permissions in ejb-jar.xml for each method, based on database roles:
<method-permission>
     <role-name>XXXX_USER</role-name>
     <method>
          <ejb-name>AccessControl</ejb-name>
          <method-intf>Home</method-intf>
         <method-name>create</method-name>
         <method-params>
               <method-param>java.lang.String</method-param>
         </method-params>
     </method>
     <method>
         <ejb-name>AccessControl</ejb-name>
         <method-intf>Remote</method-intf>
         <method-name>remove</method-name>
     </method>
     <method>
         <ejb-name>AccessControl</ejb-name>
         <method-intf>Remote</method-intf>
         <method-name>processFailedLogin</method-name>
         <method-params>
               <method-param>java.lang.String</method-param>
         </method-params>
     </method>
     <method>
         <ejb-name>AccessControl</ejb-name>
         <method-intf>Remote</method-intf>
         <method-name>processSuccessfulLogin</method-name>
         <method-params>
               <method-param>java.lang.String</method-param>
         </method-params>
     </method>
</method-permission>
Hashtable env = new Hashtable();
env.put(Context.INITIAL_CONTEXT_FACTORY, "weblogic.jndi.WLInitialContextFactory");
env.put(Context.PROVIDER_URL, "t3://localhost:7101");
env.put(Context.SECURITY_PRINCIPAL, username);
env.put(Context.SECURITY_CREDENTIALS, password);
InitialContext ic = new InitialContext(env);
ic.lookup("EJBName");
The problem is that when the InitialContext is initialised I get the following error:
javax.naming.AuthenticationException [Root exception is javax.security.auth.login.FailedLoginException: [Security:090304]Authentication Failed: User XXXX_USER] javax.security.auth.login.FailedLoginException: [Security:090302]Authentication Failed: User XXXX_USER denied]
It looks like the InitialContext is attempting to authenticate the user through WebLogic's default authenticator. How do I tell it to use the JAAS context (with the custom login module) I have already set up?
If I use the default constructor (new InitialContext()) then I get a different error when calling an EJB method:
<java.rmi.AccessException: [EJB:010160]Security violation: User <anonymous> has insufficient permission to access EJB type=<ejb>, application=TestApplication, module=TestEJB.jar, ejb=AccessControl, method=processSuccessfulLogin, methodInterface=Remote, signature={java.lang.String}.>
In this case, how do I propagate the Subject after using LoginContext so that the user calling EJB methods is not anonymous?

Answer 1

This is the JDev & ADF forum. Your question is better asked in one of the WebLogic forums!
Timo