Run JAAS Example with Tomcat 4

Question

Can someone explain me, how i can run the JAAS-Example from SUN with Tomcat.
Please so that i can understand it, step by step.
Thanks for your help and understand !!!

Answer 1

Here you go:
Environment Tomcat 4.1.10
These steps will configure Tomcat Admin app so that it uses
JAASRealm to authenticate.
To keep things simple, I wrote a MyLoginModule that succeeds with username,password pair "jaas","jaas".
Authentication information as well as role "admin" are hardcoded, so you do not have to worry about additional settings.
So compile following files, and put them into e.q. tomcat/server/classes or jar them and put them to some place where
tomcat finds them :
--------my.MyLoginModule.java---------------
package my;
import java.util.Map;
import java.security.Principal;
import javax.security.auth.login.LoginContext;
import javax.security.auth.Subject;
import javax.security.auth.callback.*;
import javax.security.auth.login.*;
import javax.security.auth.spi.LoginModule;
import java.io.IOException;
public class MyLoginModule implements LoginModule {
    protected CallbackHandler callbackHandler = null;
    protected boolean committed = false;
    protected boolean debug = false;
    protected Map options = null;
    protected Principal principal = null;
    protected Map sharedState = null;
    protected Subject subject = null;
    protected void log(String message) {
        System.out.print("MyLoginModule: ");
        System.out.println(message);
    public boolean abort() throws LoginException {
        log("abort");  
        return (true);
    public boolean commit() throws LoginException {
        log("commit phase");
        // If authentication was not successful, just return false
        if (principal == null){
            log("no principal commit fails");
            return (false);
        if (!subject.getPrincipals().contains(principal))
            subject.getPrincipals().add(principal);
        // add role principals
        subject.getPrincipals().add(new MyRolePrincipal("admin"));
        committed = true;
        log("commit succesful");
        return (true);
    public void initialize(Subject subject, CallbackHandler callbackHandler,
                           Map sharedState, Map options) {
        // Save configuration values
        this.subject = subject;
        this.callbackHandler = callbackHandler;
        this.sharedState = sharedState;
        this.options = options;
   public boolean login() throws LoginException {
        log("login phase");
        // Set up our CallbackHandler requests
        if (callbackHandler == null)
            throw new LoginException("No CallbackHandler specified");
        Callback callbacks[] = new Callback[2];
        callbacks[0] = new NameCallback("Username: ");
        callbacks[1] = new PasswordCallback("Password: ", false);
        // Interact with the user to retrieve the username and password
        String username = null;
        String password = null;
        try {
            callbackHandler.handle(callbacks);
            username = ((NameCallback) callbacks[0]).getName();
            password =
                new String(((PasswordCallback) callbacks[1]).getPassword());
        } catch (IOException e) {
            throw new LoginException(e.toString());
        } catch (UnsupportedCallbackException e) {
            throw new LoginException(e.toString());
        if (!authenticate(username,password))
            return false;
        principal  = new MyPrincipal(username);
        return true;
    public boolean logout() throws LoginException {
        subject.getPrincipals().remove(principal);
        committed = false;
        principal = null;
        return (true);
    boolean authenticate(String s,String p){
       return (s.compareTo("jaas") == 0) && (p.compareTo("jaas") == 0);  
    static public void main(String args[]) throws Exception{
        LoginContext ctx = new LoginContext("TomCatAdminApplication");
        ctx.login();
---------my/MyPrincipal.java-------------------
package my;
public class MyPrincipal implements java.security.Principal {
    String m_Name = new String("");
    public MyPrincipal(String name) {
        m_Name = name;
    public boolean equals(Object another) {
        try {
            MyPrincipal pm = (MyPrincipal)another;
            return pm.m_Name.equalsIgnoreCase(m_Name);
        } catch(Exception e){
            return false;  
    public String getName() {
        return m_Name;
    public int hashCode() {
        return m_Name.hashCode();
    public String toString() {
        return  m_Name;
------my/MyRolePrincipal.java-------------
package my;
public class MyRolePrincipal extends MyPrincipal {
    /** Creates a new instance of MyRolePrincipal */
    public MyRolePrincipal(String s) {
        super(s);
1. Configure Tomcat Administration Application in server.xml
<Context ..Tomcat Administration..>
     <Realm className="org.apache.catalina.realm.JAASRealm" debug="3" appName="TomCatAdminApplication" userClassNames="my.MyPrincipal" roleClassNames="my.MyRolePrincipal">
     </Realm>
</Context>
2. Configure the location of your JAAS configuration file in jre/lib/security/java.security
like this:
login.config.url.3=file:///d:/tomcats/tomcat410/auth.conf
3. Configure JAAS - sequence for "TomCatAdminApplication" in file:///d:/tomcats/tomcat410/auth.conf
like this:
TomCatAdminApplication {
my.MyLoginModule required;
4. Thats it. Restart Tomcat, and go to admin-app with "jaas","jaas" ....debug and enjoy. After you
got this working it is time to configure some more challenging login sequences....
Kullervo