>>How does JBoss authenticate users? Does it use auth.conf? I've checked the
>>code. It seems that the auth.conf is not used at all. Cause I want to
>>implement my own authentication module in JBoss.
auth.conf is used by the JAAS security manager. It is used in the code,
however it is passed into JAAS by a global property
'java.security.auth.login.config' set in the /conf/jboss.properties file.
'java.security.auth.login.config==../conf/default/auth.conf'
The auth.conf file tells JAAS which authentication modules to use for a
particular realm. For example the default config come with a realm OTHER
which has the authentication module
org.jboss.security.SimpleServerLoginModule required;
When JAAS is told to log the user into the realm OTHER it will check with
the authentication module SimpleServerLoginModule by calling the login
function. If the details, (i.e. usename + password) are OK the
authentication module can add details to the users profile, and JAAS calls
the next authentication module on the list. However if the credentials are
wrong, the authentication module raises a LoginException and depending on
the 'required' setting, JAAS will deny access.
JBOSS uses the bean names as realms so if you have a bean called MyBean you
could override the default security to specify authentication against say a
company LDAP database. To do this, you would create a JAAS authentication
module by implementing javax.security.auth.spi.LoginModule (from the JAAS
package), and then add the following to the auth.conf file :
MyBean {
// Provides the default realm mapping
org.myorg.security.LDAPAuthentication required
LDAPServer="ldap.mycompany.com"
};
You would then specify, (in a container descriptor in the JBoss.xml file),
that the bean should use the JAAS security manager for authentication,
(probably best to do through EJX),i.e.
<container-configurations>
<container-configuration
configuration-class="org.jboss.ejb.metadata.StatelessSessionContainerConfigu
ration">
<container-name>MyContainer</container-name>
...SNIP...
<authentication-module>java:/jaas/MyBean</authentication-module>
<role-mapping-manager>java:/jaas/MyBean</role-mapping-manager>
...SNIP...
</container-configuration>
</container-configurations>
And then tell your bean to use this container, by setting the bean
properties in JBoss.xml :
<enterprise-beans>
<session>
<ejb-name>MyBean</ejb-name>
<jndi-name>ejb/MyBean</jndi-name>
<configuration-name>MyContainer</configuration-name>
</session>
</enterprise-beans>
Apologies, I seem to have gone a little mad with my explination, (and
someone will probably shoot me down anyway!)
David Maddison
--
--------------------------------------------------------------
To subscribe: [EMAIL PROTECTED]
To unsubscribe: [EMAIL PROTECTED]
Problems?: [EMAIL PROTECTED]
