Version 14

    JACC is the Java Authorization for Container Contracts specification. This allows one to externalize the implementation of the class that is used to authorize the JACC defined permission. The JACC specification can be found here: Java Authorization Contract for Containers


    The JBoss JACC Integration Service is the service which installs a implementation that handles the JACC permission checks.

    On startup this service looks to the JACC defined system property. If this is not specified, it defaults to which is the JAAS based implementation described below.


    The SecurityService also installs the PolicyContextHandler key for the active Subject handler to provide access to the authenticated subject in the context of a call.


    A minimal configuration for the SecurityService would be:

      <!-- JACC security manager and realm mapping -->
      <mbean code=""
        name="" xmbean-dd="">
          <description>The JACC security Policy service</description>
            <description>The start lifecycle operation</description>
            <description>The stop lifecycle operation</description>



    In JBoss Application Server v5.x, you can specify this using the Microcontainer notation with jacc-jboss-beans.xml



    <deployment xmlns="urn:jboss:bean-deployer:2.0">
        <bean name="JaccPolicyProvider"
            <constructor factoryMethod="getInstance"
        <bean class=""
            <property name="policy"><inject bean="JaccPolicyProvider" property="policyProxy"/></property>

    JBoss Application Server v5.x and EAP 5.x


    Starting JBoss AS 5.x, we provide the flexibility to define a JACC Authorization Module as default for all web/ejb applications or at individual security domain level.



    Use Case 1:  Apply JACC to all web applications deployed on JBoss AS

    This is when you want JACC to be the default authorization stack for your web applications.


    In JBAS/server/<conf>/deploy/security/security-policies-jboss-beans.xml,   under the jboss-web-policy,  change to:


      <policy-module code="" flag="required"/>



    Use Case 2: Apply JACC to a web application with a security domain "xxx"


    Your security domain configuration should look something like this:


    <deployment xmlns="urn:jboss:bean-deployer:2.0">
      <application-policy xmlns="urn:jboss:security-beans:1.0" name="xxx">
         <login-module code="..." />
             <policy-module code="" flag="required"/>





    Use Case 3:  Apply JACC to all ejb applications deployed on JBoss AS

    This is when you want JACC to be the default authorization stack for your ejb applications.


    In JBAS/server/<conf>/deploy/security/security-policies-jboss-beans.xml,   under the jboss-ejb-policy,  change to:



      <policy-module code="" flag="required"/>




    Use Case 4: Apply JACC to an ejb application governed by security domain "xxx"


    Please follow the configuration in Use Case 2 above.

    JBoss Application Server v4.x and EAP 4.x

    To actually incorporate this into the ejb and web containers requires

    modifying the security layers of each. In the ejb container configurations,

    the org.jboss.ejb.plugins.SecurityInterceptor needs to be replaced with the org.jboss.ejb.plugins.JaasAuthenticationInterceptor + org.jboss.ejb.plugins.JaccAuthorizationInterceptor pair as illustrated here:


       <container-name>Standard Stateless SessionBean/JACC</container-name>
         <!-- Replaced the SecurityInterceptor with the JaasAuthenticationInterceptor
         JaccAuthorizationInterceptor pair
         <!-- CMT -->
         <interceptor transaction="Container">org.jboss.proxy.ejb.NoTxPropagationInterceptor</interceptor>
         <interceptor transaction="Container">org.jboss.ejb.plugins.TxInterceptorCMT</interceptor>
         <interceptor transaction="Container">org.jboss.ejb.plugins.CallValidationInterceptor</interceptor>
         <interceptor transaction="Container" metricsEnabled="true">org.jboss.ejb.plugins.MetricsInterceptor</interceptor>
         <interceptor transaction="Container">org.jboss.webservice.server.ServiceEndpointInterceptor</interceptor>
         <interceptor transaction="Container">org.jboss.ejb.plugins.StatelessSessionInstanceInterceptor</interceptor>
         <!-- BMT -->
         <interceptor transaction="Bean">org.jboss.ejb.plugins.StatelessSessionInstanceInterceptor</interceptor>
         <interceptor transaction="Bean">org.jboss.ejb.plugins.TxInterceptorBMT</interceptor>
         <interceptor transaction="Bean">org.jboss.ejb.plugins.CallValidationInterceptor</interceptor>
         <interceptor transaction="Bean" metricsEnabled="true">org.jboss.ejb.plugins.MetricsInterceptor</interceptor>
         <interceptor transaction="Bean">org.jboss.webservice.server.ServiceEndpointInterceptor</interceptor>


    In the web container you need to edit the jbossweb-tomcat50.sar/server.xml and enable the JaccAuthorizationRealm over the default JBossSecurityMgrRealm as shown here:

             <!-- The JAAS based authentication and authorization realm implementation
             that is compatible with the jboss 3.2.x realm implementation.
             <Realm className=""></Realm>
             <!-- A subclass of JBossSecurityMgrRealm that uses the authentication
             behavior of JBossSecurityMgrRealm, but overrides the authorization
             checks to use JACC permissions with the current
             to determine authorized access.
             <Realm className=""></Realm> 


    The JAAS Based JACC Implementation

    As of the 4.0.0 release, the default JACC implementation bundled with jboss is a mapping from the 3.2.x overloading of the JAAS authentication pattern which loads the user's declarative roles into the authenticated Subject. This is coupled to the default implementation class The complete set of classes making up the default JACC implementation include:






    A XACML based JACC Implementation

    This does not currently exist. Its an alternate implementation.

    Feature Request: JBAS-2673

    UPDATE:  JBAS packages an XACML engine and has native support for XACML for Web and EJB applications. ( Link1 Link2 )


    Delegation to JACC providers for unsecured web resources

    Starting jboss-4.0.4.GA, due to the feature request JBAS-2519, we can delegate to JACC provider for unsecured resources. JaccDelegationForUnsecuredWebResources


    Bypass Authorization Checks in an external JACC Provider

    Starting JBoss-4.2, due to feature request[JBAS-1824|], for role-name of  assigned to any security constraint in web.xml, the container generates a WebResourcePermission(uri,null). Based on this permission allocated to role name "", the policy provider may decide to bypass authorization.


    Example: Test Policy