[JBoss-user] [Security JAAS/JBoss] - Re: Can I create a J2EE-generic authentication module?
With JBoss, as part of your login module, if you want to specify what are the roles of the user, you need to create a Group class instance (agree, it does not need to be the one form JBoss) with a specific name (JBoss specific). The fact that this Group instance with this specific name is used to specify the user roles is 100% JBoss specific and is not portable. If you are using your own Group class, yes, your code will compile with another application server and yes you will be able to configure your module with another app server, but it will not work if you also want to specify the roles of the user (for example, WebLogic does it differently). Thomas View the original post : http://www.jboss.org/index.html?module=bbop=viewtopicp=3891561#3891561 Reply to the post : http://www.jboss.org/index.html?module=bbop=postingmode=replyp=3891561 --- SF.Net email is Sponsored by the Better Software Conference EXPO September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices Agile Plan-Driven Development * Managing Projects Teams * Testing QA Security * Process Improvement Measurement * http://www.sqe.com/bsce5sf ___ JBoss-user mailing list JBoss-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/jboss-user
[JBoss-user] [Security JAAS/JBoss] - Re: Can I create a J2EE-generic authentication module?
Thanks for the tips. I decided I don't mind implementing a jboss-specific class for now and porting it later. I read the docs and I think I understand how to extend UsernamePasswordLoginModule. However I've never tried to integrate authentication with a J2EE application server before, so I find myself asking a couple of questions which are probably pretty basic: (1) A user submits a name and password on a form in a web application. How do I present these to JBoss for authentication via my module? (2) A user is authenticated in a web application. Does the authentication become associated with the HTTP session? If so, how do I access it on subsequent requests? Thanks. View the original post : http://www.jboss.org/index.html?module=bbop=viewtopicp=3891568#3891568 Reply to the post : http://www.jboss.org/index.html?module=bbop=postingmode=replyp=3891568 --- SF.Net email is Sponsored by the Better Software Conference EXPO September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices Agile Plan-Driven Development * Managing Projects Teams * Testing QA Security * Process Improvement Measurement * http://www.sqe.com/bsce5sf ___ JBoss-user mailing list JBoss-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/jboss-user
[JBoss-user] [Security JAAS/JBoss] - Re: Can I create a J2EE-generic authentication module?
Unfortunately, not really. The JAAS basic capabilities are common to all application server, but when writing your own custom JAAS login modules, in order to fully integrate it with the app server, you will have to write some app server specific code: - If you want to specify what are the roles of the user during the authentication, this is done in an app server specific way (a Group with a specific name for JBoss, an instance of a specific class for WebLogic, etc...). - If you want to have you JAAS login module to interact with other JAAS login modules of the app server (for example, you just want to extend some capabilities of the app server existing JAAS login module), then this will also be some app server specific code (the JAAS login modules shared state mechanism is used in most cases, but how it is used - what you have to put in it - is app server specific). Thomas View the original post : http://www.jboss.org/index.html?module=bbop=viewtopicp=3891492#3891492 Reply to the post : http://www.jboss.org/index.html?module=bbop=postingmode=replyp=3891492 --- SF.Net email is Sponsored by the Better Software Conference EXPO September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices Agile Plan-Driven Development * Managing Projects Teams * Testing QA Security * Process Improvement Measurement * http://www.sqe.com/bsce5sf ___ JBoss-user mailing list JBoss-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/jboss-user
[JBoss-user] [Security JAAS/JBoss] - Re: Can I create a J2EE-generic authentication module?
You can write your own JAAS login module and plug it into the conf/login-config.xml file. If you want complete portability ensure that you custom implement the Principal and Group classes and dont use the ones from JBoss. I have done this successfully. There is no issue with that. Once you have done this, you can take this LoginModule anywhere as its fully portable and not dependant on JBoss. View the original post : http://www.jboss.org/index.html?module=bbop=viewtopicp=3891549#3891549 Reply to the post : http://www.jboss.org/index.html?module=bbop=postingmode=replyp=3891549 --- SF.Net email is Sponsored by the Better Software Conference EXPO September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices Agile Plan-Driven Development * Managing Projects Teams * Testing QA Security * Process Improvement Measurement * http://www.sqe.com/bsce5sf ___ JBoss-user mailing list JBoss-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/jboss-user
