Hi,

I am using jboss 4.2.2 with seam 2.0.1. I need to leverage

org.jboss.resource.security.CallerIdentityLoginModule

in order to allow database sign-on based on caller authenticated subject. I was able to make this work in a simple webapp with BASIC auth, a security-constraint in web.xml and simple UsersRolesLoginModule with properties file to match the user/pass entered by the user. I grab a Connection from the Datasource looked up with JNDI in a test servlet and it is using my user/pass, thanks to

Criteria=ByContainer

support in JBoss.

Now making this work with Seam is a different beast, I tried using the simple seam identity in order to achieve this.

components.xml

<security:identity

          authenticate-method="#{ssoAuthenticator.authenticate}" />

If I call:

Subject sbj = (Subject)PolicyContext.getContext("javax.security.auth.Subject.container");

right after the authenticate-method has been called, the subject is null. Does this mean SeamLoginModule does not support integration with JBossSX and proper subject propagation ?

What would be the recommended approach to solve this problem? Should I implement my own javax.security.auth.spi.LoginModule and make seam's identity component point to my custom securityDomain like so?

<security:identity jaas-config-name="myConfig"/>

In order to integrate with the company's auth model; I need to access the servlet session to retrieve the principal (preauthenticated) by NtlmServletFilter (jcifs class). I need to call a remote web service to get a list of authorized roles, then I need the subject to be propagated normally to CallerIdentityLoginModule which takes care of passing the user/pass information to the datasource and initiate a db connection with these credentials.

Would subclassing SeamLoginModule be a better alternative ?

Seam experts, please advise.

Thanks,
-Guillaume