JAAS Security in Jboss - Password Capture

[gregperry]

I am trying to find a way of capturing a user's password so that I can have the user login to one of my web applications (which acts as a client), and pass it to a second application (which acts as the server). Currently my applications are deployed in Tomcat and I am struggling to find a way to implement this.

If I was to migrate to JBoss, would the JAAS modules of JBoss allow me to grab the password during the authentication process? If so, would the password be encrypted, or would I be able to pass it as raw text to my second application?

I've read through the FAQs and can't find the answer. Any advice would be much appreciated.

[neelixx]

If the user is submitting their credentials in an HTML form, then you already have their credentials.

If you are using Browser-based logon, then you'll have to write your own LoginModule.

JBoss does have a way of doing SSO (Single Sign On) but I haven't delved too much into that aspect yet.

[niwhsa]

If you are using basic authentication then yes jboss can help. You can write your own/extend the existing loginmodules to get the password. It will nto be encrypted. Even if you end up using SSL by the time the password reaches the login module it should be decrypted already.

If you are using form based login, you can get the password even in tomcat. The easiest would be to put a filter to the j_security_check servlet. In the filter you can read j_password from the request.