CachingLoginCredentials

[milkygto]

From my understanding of the document, all the user principals can be cache and obtains from here.

MBeanServer server = ...;
String jaasMgrName = "jboss.security:service=JaasSecurityManager";
ObjectName jaasMgr = new ObjectName(jaasMgrName);
Object[] params = {domainName};
String[] signature = {"java.lang.String"};
List users = (List) server.invoke(jaasMgr, "getAuthenticationCachePrincipals",
 params, signature);

However, I still don't understand how can I just remove one of the user by username and principals. I noticed there is a "flushAuthenticationCache" option, but it will flush all the users away.

I am new to JAAS and don't know what will be the best way of retrieving the cached principals.

Thanks,

Michael

[milkygto]

public Principal getPrincipal(String securityDomain, Principal principal);

Maybe I should just use this to get the principal and logout()?

[milkygto]

Never mind, I found it

 String domain = "jmx-console";
 Principal user = new SimplePrincipal("javaduke");
 ObjectName jaasMgr = new ObjectName("jboss.security:service=JaasSecurityManager");
 Object[] params = {domain, user};
 String[] signature = {"java.lang.String", Principal.class};
 MBeanServer server = (MBeanServer) MBeanServerFactory.findMBeanServer(null).get(0);
 server.invoke(jaasMgr, "flushAuthenticationCache", params, signature);

[milkygto]

This code work fine. I just wonder if flushing the user cache is equal to logging out? How can I log out the user?

 private void logout(Principal user) {

 try {

 String domainName = "domain";

 MBeanServer server = (MBeanServer) MBeanServerFactory
 .findMBeanServer(null).get(0);
 String jaasMgrName = "jboss.security:service=JaasSecurityManager";
 ObjectName jaasMgr = new ObjectName(jaasMgrName);
 Object[] params = { domainName };
 String[] signature = { "java.lang.String" };
 List users = (List) server.invoke(jaasMgr,
 "getAuthenticationCachePrincipals", params, signature);

 for (int i = 0; i < users.size(); i++) {
 SimplePrincipal principal = (SimplePrincipal) users.get(i);

 log.info("user = " + principal);

 if (user.equals(principal)) {

 log.info("Logging out");

 Object[] pParams = { domainName, user };
 String[] pSignature = { "java.lang.String", "java.security.Principal"};
 server.invoke(jaasMgr, "flushAuthenticationCache", pParams,
 pSignature);

 }
 }
 } catch (MalformedObjectNameException e) {
 log.error("Malformed Object", e);
 } catch (NullPointerException e) {
 log.error("Null Pointer", e);
 } catch (InstanceNotFoundException e) {
 log.error("Instance not found", e);
 } catch (MBeanException e) {
 log.error("MBean Exception", e);
 } catch (ReflectionException e) {
 log.error("Reflection Exception", e);
 }

 }

[milkygto]

I am so stupid...

HttpSession session = request.getSession();
session.invalidate();

it is all you need to log out the session. I thought i need to clear the cache or something. So how come even I clear the cache, I am still in the session?

[starksm64]

Sessions integrate with the jboss security layer, not the other way around since tomcat can run without jboss.