proprietary authentication mechanisms

[new4jboss]

Does JBoss allows the insertion of proprietay authentication mechanisms, (eg. a message that embedds the credentials in some proprietary format). How ? Through a Callback handler ??...how do I access the message from there ?

Thanks

[new4jboss]

I really need help on this. Maybe a litle background info helps you helping me :)

This question fits in the context of a project where the possibility of using a load balancer working as a SSL acelerator (aka "SSL offloader") is being weighted against the power to leverage J2EE native HTTP authentication mechanisms (basic/digest/form). This is a problem because all the load balancers I'm aware of authenticate and transfer the user identity (even the certificate itself) via proprietary mechanisms (eg. special HTTP headers). So since I'm not interested in programming a security infrastructure myself, I wandered whether JBoss highly modular architecture couldn't come to the rescue with some way of plugin-in an authentication mechanism recognized by the rest of the container's security infrastructure, so that after successfull authentication, it still enabled authorization via declarative specs.

Any help whatsoever would be higly appreciated.
Nuno

[nigelwhite]

You can plug in your own JAAS LoginModule, so yes, you can authenticate any old way you want!

[starksm64]

Read the security chapter in the app server guide docs to get started:
http://www.jboss.com/products/jbossas/docs

[new4jboss]

Thanks for your help but I've been through all of that already.

I finally found an answer (unfortunately a negative one) in the thread
http://www.jboss.com/index.html?module=bb&op=viewtopic&t=73966

Thanks

[new4jboss]

Thanks for your help but I've been through all of that already.

I finally found an answer (unfortunately a negative one) in the thread
http://www.jboss.com/index.html?module=bb&op=viewtopic&t=73966

Thanks

[new4jboss]

Also found this: http://jira.jboss.com/jira/browse/JBAS-2283
The definite NO...

[starksm64]

There is no such thing as a definite no if you want to code.
http://wiki.jboss.org/wiki/Wiki.jsp?page=CustomizingSecurityUsingValves

Get involved with the devlopment of the generalization if you don't want to roll your own independent work.