Using JAAS with Weblogic 10.3

Question

Hi all,
we're porting our application from oc4j r2 to weblogic 10.3 and the last piece of the puzzle seems to be jaas. There's a small problem in that we use our own security model, so we need jaas only to be able to use getCallerPrincipal() from an EJB. So we don't really want to perform authentication, only to save the principal.
We tried adding our own login module and callback handler and called weblogic.security.services.Authentication.login to get a subject and then weblogic.servlet.security.ServletAuthentication.runAs to save the user. From what I saw the server tries to use the embedded LDAP, so I started looking into security realms. It seems I need to create a dummy authentication provider? Is there an easier way for the dummy login?
Thanks

Answer 1

I'm not sure about Authentication Provider. I'll look into it. On the other hand I wrote 3 simple classes, one simple principal, one login module and one simple callback handler.
Even though I get no exception and finally I call loginContext.login(). But still getCallerPrincipal() from the ejb context returns weblogic's admin.
In my LoginModule's commit method, I have this:
    public boolean commit() throws LoginException {
        if (succeeded == false) {
            return false;
        } else {
            // add a Principal (authenticated identity)
            // to the Subject
            // assume the user we authenticated is the SamplePrincipal
            userPrincipal = new DummyPrincipal(username);
            if (!subject.getPrincipals().contains(userPrincipal)) {
                subject.getPrincipals().add(userPrincipal);
            log.debug("Added principal " + username + " to the subject");
            if (debug) {
                log.debug("Login Module Principals:");
                for (Iterator i = subject.getPrincipals().iterator(); i.hasNext();) {
                    log.debug("Principal: " + ((Principal)i.next()).getName());
            // in any case, clean out state
            username = null;
            password = "";
            password = null;
            commitSucceeded = true;
            return true;
    }which is essentially taken from Sun's tutorial. It just seems that weblogic does not take into consideration the login I perform through jaas. Do I need to call runAs, doPrivilegedAction, each time an http request is made?