Multiple login modules - LDAP and DB failover

[deanouk]

Hi all.

I'm wondering how best to implement a fail over login system.

We have a client who wishes for LDAP authentication and we also use a locally stored DB as an authentication store.

Both LoginModules have been written, but instead of combining the DB one into the LDAP module, how can I go about the system checking the authentication credentials in the local DB if they fail authentication in the LDAP server (or if it's down).

Thanks in advance.

[jhedden]

did you ever resolve this? I am trying to implement something similar.

[deanouk]

No not as yet, I still need to do it at some point though, so if you find anything let me know - and vice versa.

[jc7442]

In your login-config.xml you can create a policy with modules flagged sufficient. i do that to authenticate user on several LDAP:

<authentication>
 <login-module code=".. LoginModule"
 flag="sufficient">
 ...
 </login-module>
 <login-module code=".. LoginModule2"
 flag="sufficient">
 ...
 </login-module>

 </authentication>
 </application-policy>

[deanouk]

But if a user doesn't give any login information - he'll still be 'authenticated' because both are only marked as sufficient.

[deanouk]

Here:
http://java.sun.com/j2se/1.5.0/docs/api/javax/security/auth/login/Configuration.html
I read:
"If no Required or Requisite LoginModules are configured for an application, then at least one Sufficient or Optional LoginModule must succeed."

But that's not what's happening - both are failing but the user is still able to login (authentication passes but then they cannot access the resources).