AbstractServerLogin module.logout and cached principals

[maggu]

Hi all,
I am implementing a very simple web application and adding a custom class extending from the DatabaseLoginModule. All it does is extend initialize() by adding a few more variables, and extend login() by adding some checking logic before and after a call to super.login(). So, I have not modifed login() in any other way.

One thing I am doing is: 1) I log in with proper credentials (eg: john/1234), the credentials get stored in cache.
2) I login without proper password (eg: john/qqqqqq), the login method throws a FailedLoginException.
3) During this failed login exception, I am trying to remove the previously authenticated entry from the cache. I was calling AbstactServerLogin's logout() method, thinking this should do the trick, but realize that the principals Set the method looks up is different (?) from the one used in commit method.

How then , can I get back to the cached principal and remove it from the cache?

[ragavgomatam]

jboss caches the Principal only on successful authentication. So don't bother clearing the cache. Also you cannot call logout(). It is provided on the LoginModule for the container to call.

[maggu]

thanks for the reply ragavgomatam. but the problem I am trying to look at is removal of the successful login from the cache. From my example above. Lets say:
1) My DefaultCacheTimeout in jboss-service.xml is set to default (30 mins).
2)I log in as john successfully (username:john, password 1234). Principal john gets cached.
3) I close my browser in 2 minutes. I open my browser after 10 mins. I am prompted with a login screen.
4) I log in, but *incorrectly*. username:john, password 1111. The error page I have defined in my web.xml kicks in.
*At this point, I also want to remove from the cache, the successful login from step 2.*
5) So, now, if john goes back to the login page and logs in correctly, I want to authenticate against my database instead of the cache.

For this I needed a way to go through the subjects, catch the correct subject, get the correct principal and remove it from the correct principal set, yes? That is where I am a bit stuck in, how does one get to all the subjects? I can see the principal being set in the commit method, but in logout, the Set is blank. I believe this is because on my second login attempt, the subject is different that the previous one (successful attempt at step 2).

Another question is: If we cannot call the logout, how do I log out of my web application? Would I need to try session invalidation? I am confused as to how this will remove the principal from JBoss cache.
thanks.

[ragavgomatam]

2)I log in as john successfully (username:john, password 1234). Principal john gets cached.
3) I close my browser in 2 minutes. I open my browser after 10 mins. I am prompted with a login screen.

When user closes browser, send a ajax request to server & do a HttpSession.invalidate(). This will clear your cached Principal from Jboss.

Another question is: If we cannot call the logout, how do I log out of my web application? Would I need to try session invalidation? I am confused as to how this will remove the principal from JBoss cache.
thanks.

Yes HttpSession invalidation is the way to clear the cache from jboss

[maggu]

I see....but is there no way to directly get at a subject from my previous login, inside my customloginmodule?
thanks

[ragavgomatam]

LoginModules should be used for what they are :- Authentication & RoleMapping. Nothing more. Invalidating the PrincipalCache should be done via the HttpSesion

[maggu]

ragavgomatam, if I do programatic flushing via JMX in my custom login module, wouldn't that be equivalent? do you see any dis advantage of doing this?
I am looking at these options because I wanted to remove the subject from the cache only based on some condition and not everytime the user closes the browser.
let me know your thoughts

http://wiki.jboss.org/wiki/CachingLoginCredentials

[ragavgomatam]

Yes possible this way too. Though it has nothing to do with the LoginModule. You will have to invoke the Jboss JaasSecurityManager with JMX.This way you can bypass HttpSession invalidation to clear the security cache .