Propagating JAAS Subject for startup classes

Question

Do startup classes have to login before they can access secured
resources in WLS 6.0? I notice that WLS 6.0 asks for a password before
starting the server. Is the "subject" created by that login somehow
propagated to startup class threads (and their thread offspring) or does
this have to be done manually?
I want to try to set up startup classes using a security style similar
to the Unix init process. It starts up as root and then starts its
services/daemons using something like:
su - foo-user foo-daemon
The foo-daemon runs as foo-user and, in Unix, so does every process
forked by the foo-daemon. I would like to use a parallel approach in
WLS. Can it be done?
Thanks,
Tim Taylor

Answer 1

Hi,
That's what I think too. I guess the only way to get the credentials is to
use a weblogic specific class that allows you to login an user from a servlet/jsp.
It does returns the Subject instead of a principal, so you can get the credentials...
seems like we'd need to change the J2EE api to further integrate JAAS with it.
Welll... back to handling security on my own :\
Regards,
Leonardo Bueno
"Utpal" <[email protected]> wrote:
I think EJBContext.getCallerPrincipal() and
HttpServletRequest.getRemoteUser() are the only method
to get the principal. I don't think subject can be accessed in the
EJB/Servlet using standard APIs.
-utpal
"Leonardo Bueno" <[email protected]> wrote in message
news:3ef74da0$[email protected]..
Hi,
I have to write a security framework for my J2EE application and ithas to
be
portable between appservers. I`m thinking about using JAAS andprogrammatic security.
I`ve written a LoginModule that does user authetication and loads alluser
credentials.
These credentials are app specific classes like WindowPermission.
How can I have access to these credentials from a servlet/EJB? Is therea
way
to get the Subject and not just the Principal from a servlet/EJB?
Thanks,
Leonardo