jaas

JBoss JAAS custom Login Module

由 99封情书 提交于 2019-12-05 02:43:23
问题 I'm trying to use a custom JAAS authentication module for a web based application hosted on JBoss 5.1.0.GA . So everything seems to be working fine, until the number of users increases and sessions (so it think) start getting mixed. The reason i'm using the custom JAAS is because of a custom authentication backend and the need to pass back the password for futher usage in the application. When i call request.getUserPrincipal in servlets i get an object of type SimplePrincipal instead on my

Relative path for JAAS keytab configuration

由 拟墨画扇 提交于 2019-12-05 00:37:09
问题 I have a system wherein .NET clients authenticate against a Java server with Kerberos. Everything works, but I'm trying to improve the server configuration. Currently a keytab file is required in the root of C:\ because my jaas.conf looks like this: Server { com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true storeKey=true isInitiator=false keyTab="///C:/keytab" principal="XXX"; }; I am trying to make the keyTab property a relative path, but am having no luck. What I've tried

Tomcat-Jaas - How to retrieve subject?

由 十年热恋 提交于 2019-12-05 00:33:10
问题 I'm studying JAAS and I'm implementing a simple example to use in a webapp using Tomcat with a JaasRealm. Now my problem is that I don't know how to retrieve the subject since code like Subject subject = Subject.getSubject(AccessController.getContext()); always returns null. I'm using Tomcat 7.0.27. Is there something I've missed? In other terms how can I manage authorization in Java EE with JAAS? For example how can I implement an action within the secure context of JAAS? 回答1: i knew that

Role vs RoleGroup in JBoss DataBaseServerLoginModule

由 给你一囗甜甜゛ 提交于 2019-12-04 17:08:44
Part A: Role vs RoleGroup Can someone explain the difference between a Role and a RoleGroup in the jboss DatabaseServerLoginModule ? I'm confused after looking at the examples in the JBoss 6 documentation One area of confusion is when they describe the logical tables the user to role mapping table has three columns: Table Principals(PrincipalID text, Password text) Table Roles(PrincipalID text, Role text, RoleGroup text) But the example they offer only uses two columns: CREATE TABLE Users(username VARCHAR(64) PRIMARY KEY, passwd VARCHAR(64)) CREATE TABLE UserRoles(username VARCHAR(64),

Spring Security JAAS Authentication Authorization Issue

由 不问归期 提交于 2019-12-04 16:04:22
In Spring Security am using DefaultJaasAuthenticationProvider Configuration for login authentication with linux username/password. JpamLoginModule is used for authentication. I am successfull with authentication but i had problem in authoriztion(ROLE_USER,ROLE_ADMIN), am getting HTTP Status 403 - Access is denied Error. Following Configuration i used in spring-security.xml <security:authentication-manager> <security:authentication-provider ref="jaasAuthProvider" /> </security:authentication-manager> <bean id="jaasAuthProvider" class="org.springframework.security.authentication.jaas

j_security_check with Primefaces

由 て烟熏妆下的殇ゞ 提交于 2019-12-04 13:17:25
问题 How to implement j_security_check with Primefaces ? Normally in JSP if you want to use JAAS for login, the login form generally is: <form action="j_security_check" method="POST"> Username:<input type="text" name="j_username"><br> Password:<input type="password" name="j_password"> <input type="submit" value="Login"> </form> But how do we implement it in JSF or in Primefaces! What will be the action How do we get rid of id or name like formId:componentId Also the p:commandButton is ajaxified in

Web Service authentication in Java EE

由 白昼怎懂夜的黑 提交于 2019-12-04 11:41:52
When developing a Web service(Hospital Management System) using Java EE, is it necessary that for each Web Service call, it has to be checked that the user is logged in?? Which authentication method is the best JAAS, WS-Security, SAML, or a combination or using own tokens ?? It all depends on how is your web service implemented/or its going to be. If you still have a choice I would recommend going with REST approach, authenticate the user with some kind of login functionality and then maintain users session. Timo89 You can use filters. Here's an example of how to use filters: http://viralpatel

Login a user programmatically via JAAS

由 倖福魔咒の 提交于 2019-12-04 06:22:28
I'm trying to run code within JBoss Container under a different authentication by programatically logging in a user like that (stripped exception handling): LoginContext ctx = ctx = new LoginContext("MyLoginSchema", new UsernamePasswordCallbackHandler("newuser", "") ); ctx.login(); Subject.doAs(ctx.getSubject(), new PrivilegedAction<T>() { @Override public T run() { Subject.getSubject(AccessController.getContext()); InitialContext ic = new InitialContext(); EJBContext sctxLookup = (EJBContext) ic.lookup("java:comp/EJBContext"); Principal principal = sctxLookup.getCallerPrincipal(); } }); Login

Warning: JACC: For the URL pattern xxx, all but the following methods were uncovered: POST, GET

由 不羁岁月 提交于 2019-12-04 05:06:28
In javax.faces.webapp.FacesServlet docs, it is mentioned, Allowable HTTP Methods The JSF specification only requires the use of the GET and POST http methods. If your web application does not require any other http methods, such as PUT and DELETE, please consider restricting the allowable http methods using the <http-method> and <http-method-omission> elements. Please see the Security of the Java Servlet Specification for more information the use of these elements. My application indeed does not depend upon other HTTP methods (except GET and POST ). Therefore, I am trying to use <http-method>

Custom Annotation JSF

由 时间秒杀一切 提交于 2019-12-03 21:53:28
问题 I wanted to make a custom annotation to check security on some functions for my JSF web application. For security I use Tomcat security with JaaS, so I have no application managed security to my disposal. What actually want to do is make an annotation for my methods in the Backing Beans like Spring Security (@Secured("role")). My security system is implemented so that every function is a role and you can dynamically make "user roles" these are stored in the DB and when somebody logs in all
订阅 jaas