Hi,
Now I have made some progress.
My policy file is
grant CodeBase "file:C:/apache-tomcat-5.5.15/webapps/struts-blank" Principal
* * {
permission javax.security.auth.AuthPermission "
createLoginContext.WhitePaper";
permission java.util.PropertyPermission "java.home", "read";
permission com.paper.security.filter.URLPermission "/index.jsp";
permission com.paper.security.filter.URLPermission "/struts-blank/";
permission com.paper.security.filter.URLPermission"/struts-blank/index.jsp";
permission com.paper.security.filter.URLPermission"/struts-blank/Welcome.do";
};
and I am using code like this.
final SecurityManager sm;
if (System.getSecurityManager() == null) {
sm = new SecurityManager();
} else {
sm = System.getSecurityManager();
}
Subject.doAsPrivileged(s, new PrivilegedExceptionAction() {
public Object run() {
sm.checkPermission(p);
return null;
}
},null);
Now after JAAS authentication, I get access denied (
com.paper.security.filter.URLPermission /struts-blank/)
Thanks,
Mohan
On 2/17/06, Mohan Radhakrishnan <[EMAIL PROTECTED]> wrote:
>
> Hi,
>
> I have anabled authentication usng JAASRealm in Tomcat 5.x
>
> The steps are
>
> 1. Security constraints in web.xml - Working
> 2. JAAS LoginModule implementation - Working because I am able to login.
> 3. Policy file like this
>
>
>
> grant CodeBase "file:./struts-blank.war" Principal
> com.paper.security.filter.Principal "mohan" {
> permission com.xor.auth.perm.URLPermission "/index.jsp";
> permission com.xor.auth.perm.URLPermission "/struts-blank/index.jsp";
> permission com.xor.auth.perm.URLPermission "/struts-blank/Welcome.do";};
>
>
>
>
> 4. Struts filter like this
>
>
>
> HttpServletRequest httpReq = (HttpServletRequest) req;
> LoginContext lc = *new* LoginContext("WhitePaper",
> *new* WhitePaperCallbackHandler(
> httpReq.getRemoteUser(),
>
> "javatech" ));
> logger.info( "Authenticating [" +
> httpReq.getRequestURI() );
> lc.login();
> logger.info( "Authenticated" );
> Subject s = lc.getSubject();
> javax.security.auth.Policy policy =
> javax.security.auth.Policy.getPolicy();
> CodeSource cs = *new* CodeSource(*new*
> URL("file:./struts-blank.war"),
> (CodeSigner[])*null*);
> PermissionCollection perms = policy.getPermissions( s, cs );
>
> *if*( perms!= *null* ) {
> Enumeration e = perms.elements();
> *while*( e.hasMoreElements()) {
> logger.info( "[" + e.nextElement() + "]");
> }
> }
>
> Subject.doAsPrivileged(s, *new* PrivilegedExceptionAction() {
> *public* Object run() {
> proceed( req,res,chain );
> *return* *null*;
> }
> }, *null*);
>
>
>
>
> The problem is that I am not able to print any permissions. So I am
> assuming there is a configuration problem. I am able to login and JAAS
> itself works fine.
>
> Now I am able to type a URL that is not mentioned in the policy file and
> access it. So my policy file is not taking effect ??
>
> Appreciate any help.
>
> Thanks,
> Mohan
>
