JAAS Container managed versus code managed auth

[bezdomny]

Hi all,
I'm new to JBoss as well as the idea of "container managed" login authentication using stuff like web.xml to protect resources. I come from a java shop that still uses stone knives and bear skins, and handles all things like login and resource protecting in the code using session based cookie solution.
I've have used JAAS, based on this article:
http://www.javaworld.com/javaworld/jw-09-2002/jw-0913-jaas.html
and some of this code:
http://www.javaworld.com/javaworld/jw-09-2002/jaas/jw-0913-jaas.zip

I am using this successfully using the Resin application server, but JBoss doesn't like it.

Basically, I've wrapped the login process in a java bean that gets called on every jsp. The code in the bean checks to make sure the user has a valid session and if not, then it sends them to the login screen. When the user logs in from the log in screen, the Login bean actually uses JAAS to call my custom LoginModule to log the user in, then it sets my SessionLoginContext in the http session as an attribute.
Each call to the a subsequent page the bean calls "checklogin" which gets the login context from the session and checks to be sure the session has the proper role. if it does, the app carries on, if not, it makes the user log in again.

I know this may be counter to the container managed way, but it works great and once the user is logged in, they stay logged in until the session goes away. Can I get the same sort of functionality using the container managed way? Can someone please help me figure out where to start. If you see my other post, I have made attempts to configure my custom login module, but Jboss is having trouble recognizing it. That is a separate issue. I'm looking for a good pattern to follow I guess, to use JAAS with http sessions or something like it using the container.

Thanks!

B

[j2ee_junkie]

If you want to use Tomcat embedded in JBoss and use container managed security. Just read chapter 8 of the server guide. Embedded Tomcat security is handled by JBoss. So what you need to learn is how JBoss handles security.

[bezdomny]

Thanks,
I've got the server guide for 4.0 but I haven't read it all, though I haven't seen anything yet that describes exactly what I think I need. For instance, how does the container determine if a user is still logged while they are browsing through "protected" pages. I need secure ALL my pages.

B

[bezdomny]

I'm still having issues here. Is the idea to use some code to always check request.isUserInRole("user"), or does the container do that?

B

[j2ee_junkie]

B,

If you are using Container Authentication then yes, the container does that for you. Chapter 8 really does describe what you need well if you do not have any unusual circumstances. To summarize...

1.) create your web app and add security-constraints to you web.xml
2.) specify your authentication method (i.e. auth-method) in your web.xml
3.) specify what security domain your web application will use. This is the security-domain in your jboss-web.xml
4.) finally, specify what login modules your security domain will use in $JBOSS_SERVER/conf/login_config.xml

You do not need your Bean in the jsp.

later, cgriffith

[bezdomny]

Thanks for the help! One more question though. . . Do I need to extend JBoss's JAAS class, I think AbstractServerLoginContext, to get JBoss to recognize my custom LoginModule? Thanks again for the help.

B

[j2ee_junkie]

B,

There is no requirement to extend AbstractServerLoginModule. However, your login modules are required to use the Subject usage pattern employed by JBoss. Extending this module ensures this pattern is used. Otherwise, just follow directions at http://docs.jboss.org/jbossas/jboss4guide/r4/html/ch8.chapter.html#ch8.custom.sect
in your custom modules.

enjoy, cgriffith

[bezdomny]

Will do, and thanks for the useful information. I really hate being a noob at something!!! (especially and app server)

B