Using oc4j Jaas with external user-base

Question

Hi,
Im evaluating the possibility of migrating my application from BEA Weblogic 7.00 to Oracle9iAS. I Use OC4j 9.0.3 for the migration proof.
My Weblogic application uses a LoginModule, written by us which access our existing user-base (stored in an rdbms).
We use proprietary Principal classes and update the Subject when a login 'transaction' is committed.
Our EJB code (which is the resource we want to protect) includes role definitions and the specific weblogic deployment-descriptors includes mapping between the roles defined in the ejb dd and the principal names we return with the login-module.
I have some questions:
1. How can i perform a similar mapping (propriatary principal names to ejb roles), do i have to declare all those principals in jazn.data?, where do I have to declare them?
2. Can i disregard the UserManager concept?
3. Do i have to implement a LoginContext on my own?
4. Do I need to explicitly call LoginCOntext.login in my login code or is it automatically done (please elaborate)?
5. Do i have to keep using RealmLoginManager along with my LoginModule?
6. Where is the preferable place for putting the login module (application’s ear file?)
7. Can i use any LoginModule which simply implements the JAAS LoginModule interface?, are there any specific oracle behavior/requirement i should know about?
8. What is the class name for the JAZN class which serves as the default LoginContext?
Note: I dont want to integrate with OID or manage the user-base using Oracles JAZN-XML, i want to simply integrate with my own existing user authentication data and use it for authorizing calls to EJBS.
Thanks in advanced,
Yuval.

Answer 1

sorry for delay in repsonding.
I only use my LDAP directory to manage poeple and groups but not organisational units.
When a user logs in using BPM, you view the details for a person in process administrator or view a groups members etc that information is then stored in the bpm database. That information is refreshed whenever the directory service is polled. The frequency of this is determined by the value of 'Directory Polling Interval' set under the Other tab of your engine.
I don't belive the user passwords etc are stored in the bpm database only meta information about people and groups and therefore your directory service must be available whenever a user tries to login to workspace etc.
Hope that helps,
Mike.