JAAS, Servlets, and Authentication
Hi,
I've been trying to get JAAS authentication working in a web based application and am running into some problems - I'm hoping that someone can clarify.
Ideally, I would like to set up form-based authentication on the web app, authenticate the user ONCE, and the have the app server (servlet engine) remember that the user has been authenticated (Servlets 2.2 Single Sign-on style) and not require further logons. From there, it seems natural that the subject associated with the user would be fed as the context for any subsequent method calls requiring authorization.
All of the discussions and examples that I've seen involve a client java application instantiating the LoginContext and executing one or a series of method calls. My question is: What happens when you login through a servlet in a traditional web app and establish a session? Does the users have to pass his/her credentials every time? I could store the Subject on the HttpSession object and obtain the Subject and redo authentication each time but that seems silly. Is a sessioned web-based scenario not appropriate for JAAS or am I missing something?
Has anyone accomplished this with Tomcat/JBoss?
Also, what is the proper usage of the doAs() method and action class? It also seems odd that a client would have to call these methods prior to executing any code that required authorization (given that the user has a session). It seems like that would be a perfect job for an App Server to handle - right?
[1535 byte] By [
eglerk] at [2008-1-25]
One solution may be:
Create a wrapper login servlet that
try {
LoginContext lc = new LoginContext("servlet", new ServletCallBackHandler(request, resp));
lc.login();
} catch() {
// catch login failure and redirect to login page
}
Subject.doAs(lc.getSubject(), new WorkingClass(request, resp));
The ServletCallBackHandler will try to retrive session cookies and map to name/password, or get name/password from the request if no cookie.
I don't know if any servlet container use JAAS.
Hi
I also having difficulties to integrate my jaas module into servlet. I am not sure how to assign the jaas config file in to the servlet (if it is application we can specify using -D option). Not only that I am not sure the flow like when to call the loginContext and so on. Can you please explain me how these can be integrated together.
Can you please send some sample working codes, if you have.
Your interest in this regard is always appreciated.
Regards
Davis
Hi,
You can use the method:
System.setProperty("java.security.auth.login.config",
configFileLocation );
where
configFileLocation = getServletContext().getResource("/WEB-INF/jaas.config")
to get the absolute path from a relative url
BUT after that you may experience LoginConfiguration intiation error
because of the way JAAS loads this
file and loginModules !?
If you succeed in this last step just let me know .. I gave up !
This works for me:
String configFileLocation = getServletContext().getRealPath("/WEB-INF/jaas.conf");
System.err.println(configFileLocation);
System.setProperty("java.security.auth.login.config", configFileLocation );
Check
http://jakarta.apache.org/tomcat/tomcat-4.0-doc/servletapi/javax/servlet/ServletContext.html
getResource returns java.net.URL...
