My LoginModule needs more than just j_username and j_passwor

[nigelwhite]

I have written a custom login module to authenticate against our legacy (and it's really old, and non-standard!) back end.

This needs a company name parameter from the login form - in fact, it needs to be able to access the HttpSession to get and set attributes in it..

Now that I am trying to use container-handled FORM based authentication, I can't get this information.

Before I did form based auth, I used to use a Filter, and have the filter invoke a JSP when it detected an unlogged-in session which would submit to my own login servlet which created a LoginContext passing it a special CallbackHandler initialized with all the needed information which could handle all kinds of custom Callback subclasses to get the info it neeed.

Is it possible to do this? Surely someone must have realized that you often need more than just username/password to do authentication????

[nigelwhite]

Well? Gurus?

Surely there must be many cases where a LoginHandler needs more than just username/password?

This is a major shortcoming, and means we can't use container-managed form based authentication.

[starksm64]

http://wiki.jboss.org/wiki/Wiki.jsp?page=CustomizingSecurityUsingValves

[nigelwhite]

I'm surprised that you suggest such a complex hack.

In fact, using static methods of the the JACC javax.security.jacc.PolicyContext object, you can use

HttpServletRequest request = (HttpServletRequest)PolicyContext.getContext("javax.servlet.http.HttpServletRequest");

Using javax.security.jacc.PolicyContext.getHandlerKeys(), in my LoginModule, I find

PolicyContext has "javax.ejb.arguments"
PolicyContext has "javax.servlet.http.HttpServletRequest". It is a org.apache.catalina.connector.RequestFacade
PolicyContext has "javax.security.auth.Subject.container"
PolicyContext has "javax.xml.soap.SOAPMessage"
PolicyContext has "org.jboss.ejb.BeanMetaData"
PolicyContext has "javax.ejb.EnterpriseBean"

Most of the keys return null, only the "javax.servlet.http.HttpServletRequest" key returns anything.

On Logout, I find

PolicyContext has "javax.ejb.arguments"
PolicyContext has "javax.servlet.http.HttpServletRequest". It is a org.apache.catalina.connector.RequestFacade
PolicyContext has "javax.security.auth.Subject.container". It is a javax.security.auth.Subject
PolicyContext has "javax.xml.soap.SOAPMessage"
PolicyContext has "org.jboss.ejb.BeanMetaData"
PolicyContext has "javax.ejb.EnterpriseBean"

So, looks like you can find the Subject any time using the "javax.security.auth.Subject.container" key.

[pdesai]

I am using Jboss 3.2.7 and I am trying to solve a similar problem. I am writing Custom JAAS LoginModule and want to access HttpSession in the LoginModule to store some information.

Using static methods of the the JACC javax.security.jacc.PolicyContext object is a good solution, but it is available only in J2ee1.4. Is there a way to do this in JBoss 3.27?

[starksm64]

http://wiki.jboss.org/wiki/Wiki.jsp?page=CustomizingSecurityUsingValves still applies.