Propagating transport specific info to authorization module

[paper57]

I need to be able to propagate transport specific information (ex: HTTP Headers) ultimately into a custom JAAS authentication module.

I have reviewed much of the source for axis, jboss, and their integration and while I am confident I could make it work, I want to do it the "right" way (even though I'm already breaking some of the rules).

Can anyone shed some light on a recommended method of implementation?

[thomas.diesler]

Have you considerd using client/server side handlers that read/write application specific header elements?

[paper57]

Setting/getting that information in handlers I have had no problem doing. What I am unsure is how best to access that information from the authentication side.

Just as the JAAS code uses a callback to retrieve a username and password, I need to do the same to get an application specific piece of data. I can't figure out the best way to accomplish that.

[thomas.diesler]

Not sure if I understand. Can a server side handler not use the JAAS callback mechanism to pass the information from the header elements to JAAS?

[paper57]

Is this only accomplished by replacing the CallbackHandler registered with the JaasSecurityManager service, perhaps using additional thread locals to propogate the additional information, much like the SecurityAssociation class does now?