Changes to Realm Interface sought

[anil.saldhana]

Remy/Mladen, I propose the following method addition to the Realm interface for Tomcat 6. This would take care of the needs for header based authentication (which may include some form of SSO/Identity Management usecases) and JSR-196 (Java Authentication Container SPI) needs.

public Principal authenticate(Request request, Response response,
 LoginConfig loginConfig) throws Exception;

The current limitation with the Realm interface is the loss of the request object during authentication.

[j2ee_junkie]

sweet! That would really allow authentication to open up to more than just a username and password. The only argument that I could make would be if a Realm is an abstraction of a set of principals and the roles/permissions they are allowed, should a realm really have any knowledge of a httpServletRequest/Response?

later, cgriffith

[rmaucher]

No, this seems more like a job for a custom authenticator.

[starksm64]

This is needed to support custom authenticators. The current hard-coded mapping of authentication credentials to the Realm interface does not allow for authentication mechanisms outside of those currently understood by the servlet spec.

[anil.saldhana]

AFAICT, introduction of a custom authenticator , will not make the call-out to a realm mandatory, because there is no requirement on the custom authenticator to call the realm interface. It can do its job inhouse. But this will lead to a lot of duplication in authenticator code.

It certainly does not make sense for the realm interface to have scaled down information plucked from the request object.

[j2ee_junkie]

Bypassing the realm as you state has another possible side-effect. It will break current Tomcat authorization calls (which are made to the Realm). So that is not good.

[anil.saldhana]

Hence the need for support in Realm interface (or atleast RealmBase with an extra method I suggested) to support authentication greater than the four stripped down authenticate methods that are legacy.

When JSR-196 becomes mandatory for JEE6, there will be a push for this anyway.