JAAS in JBoss 7

[jamesviet]

Hi all,

I have a question about how to config JAAS in JBoss with application.

My application just a simple app. User can login with username, password. User name, pass already created and encrypt by MD5 before save to DB.

Then I would like to apply JAAS to do when I login to my application.

I found in the internet and saw some example of this in web.

I already configured security-domain in configuration file.


<subsystem xmlns="urn:jboss:domain:security:1.1">

    <security-domains>

        ...

        <security-domain name="jaasProject" cache-type="default">

            <authentication>

                <login-module code="Database" flag="required">

                    <module-option name="dsJndiName" value="java:jboss/datasources/dsJaasProject"/>

                    <module-option name="principalsQuery" value="select password from user where username=?"/>

                    <module-option name="rolesQuery" value="select role, 'Roles' from user_role ur inner join user u on  ur.user_id = u.id where u.username =?"/>

                    <module-option name="hashAlgorithm" value="MD5"/>

                    <module-option name="hashEncoding" value="base64"/>

                    <module-option name="unauthenticatedIdentity" value="guest"/>

                </login-module>

            </authentication>

        </security-domain>

    </security-domains>

</subsystem>

But in this example use j_security_check to check username, pass with JAAS.

Now I would like write a class look like this to check in my app.

Do you have any advice or example to do it?

Thanks,

[sfcoy]

james viet wrote:

...

Now I would like write a class look like this to check in my app.

...

What is it you want to be able to do in this class that you can't do by using container configured security?

In the meantime, I can also point out the existence of javax.servlet.http.HttpServletRequest#login(java.lang.String, java.lang.String), which became available in JavaEE 6. This may help you accomplish your objective.

[jamesviet]

Hi,

Thanks for your reply.

My mean is: when I login in app with user name, passowrd. It automatically uses configuration of  security-domain (encrypted password, compare with DB, ......).


[sfcoy]

That can be done with the request login method I suggested above.