Hi David,
Your explanation is excellent!
Could you write the manual for the web site?
Best regards,
Oleg
P.S. Just one addition: one may set authentication-module and
role-mapping-manager globally via standardjboss.xml
Maddison, David wrote:
>>>How does JBoss authenticate users? Does it use auth.conf? I've checked the
>>>code. It seems that the auth.conf is not used at all. Cause I want to
>>>implement my own authentication module in JBoss.
MD> auth.conf is used by the JAAS security manager. It is used in the code,
MD> however it is passed into JAAS by a global property
MD> 'java.security.auth.login.config' set in the /conf/jboss.properties file.
MD> 'java.security.auth.login.config==../conf/default/auth.conf'
MD> The auth.conf file tells JAAS which authentication modules to use for a
MD> particular realm. For example the default config come with a realm OTHER
MD> which has the authentication module
MD> org.jboss.security.SimpleServerLoginModule required;
MD> When JAAS is told to log the user into the realm OTHER it will check with
MD> the authentication module SimpleServerLoginModule by calling the login
MD> function. If the details, (i.e. usename + password) are OK the
MD> authentication module can add details to the users profile, and JAAS calls
MD> the next authentication module on the list. However if the credentials are
MD> wrong, the authentication module raises a LoginException and depending on
MD> the 'required' setting, JAAS will deny access.
MD> JBOSS uses the bean names as realms so if you have a bean called MyBean you
MD> could override the default security to specify authentication against say a
MD> company LDAP database. To do this, you would create a JAAS authentication
MD> module by implementing javax.security.auth.spi.LoginModule (from the JAAS
MD> package), and then add the following to the auth.conf file :
MD> MyBean {
MD> // Provides the default realm mapping
MD> org.myorg.security.LDAPAuthentication required
MD> LDAPServer="ldap.mycompany.com"
MD> };
MD> You would then specify, (in a container descriptor in the JBoss.xml file),
MD> that the bean should use the JAAS security manager for authentication,
MD> (probably best to do through EJX),i.e.
MD> <container-configurations>
MD> <container-configuration
MD> configuration-class="org.jboss.ejb.metadata.StatelessSessionContainerConfigu
ration">>
MD> <container-name>MyContainer</container-name>
MD> ...SNIP...
MD> <authentication-module>java:/jaas/MyBean</authentication-module>
MD> <role-mapping-manager>java:/jaas/MyBean</role-mapping-manager>
MD> ...SNIP...
MD> </container-configuration>
MD> </container-configurations>
MD> And then tell your bean to use this container, by setting the bean
MD> properties in JBoss.xml :
MD> <enterprise-beans>
MD> <session>
MD> <ejb-name>MyBean</ejb-name>
MD> <jndi-name>ejb/MyBean</jndi-name>
MD> <configuration-name>MyContainer</configuration-name>
MD> </session>
MD> </enterprise-beans>
MD> Apologies, I seem to have gone a little mad with my explination, (and
MD> someone will probably shoot me down anyway!)
MD> David Maddison
MD> --
MD> --------------------------------------------------------------
MD> To subscribe: [EMAIL PROTECTED]
MD> To unsubscribe: [EMAIL PROTECTED]
MD> Problems?: [EMAIL PROTECTED]
--
--------------------------------------------------------------
To subscribe: [EMAIL PROTECTED]
To unsubscribe: [EMAIL PROTECTED]
Problems?: [EMAIL PROTECTED]
