Where to place security configuration file in WAR?

Question

I'm trying to use JAAS for authentication in my WAR. I understand that my configuration file (another link) should be placed somewhere (as explained here). Unfortunately, I can't understand where exactly, if we're talking about WAR? And how to name the file?

// JAAS has to find the file and retrieve "foo" from it
LoginContext ctx = new LoginContext("foo", this);

Answer 1

I had the same problem and I wanted to see if I couldn't dynamically set this property based on the current classpath (which would be located inside the war itself).

public class SecurityListener implements ServletContextListener {
    public SecurityListener() {
    }

    @Override
    public void contextDestroyed(ServletContextEvent arg0) {
    }

    @Override
    public void contextInitialized(ServletContextEvent arg0) {
        if(System.getProperty("java.security.auth.login.config") == null) {
            String jaasConfigFile = null;
            URL jaasConfigURL = this.getClass().getClassLoader().getResource("login.conf");
            if(jaasConfigURL != null) {
                jaasConfigFile = jaasConfigURL.getFile();
            }
            System.setProperty("java.security.auth.login.config", jaasConfigFile);
        }
    }
}

Obviously, you need to add the listener to your web.xml:

<listener>
    <listener-class>example.SecurityListener</listener-class>
</listener>

What this does is set the property java.security.auth.login.config upon instantiation of the web application if it has not yet been defined. This means you could throw it in your source folder and load it automatically if not otherwise redefined elsewhere. I have tested this and it works on Tomcat 6.

So, for example if your tomcat installation was in "C:\program files\tomcat6\" with your war deployed in "C:\program files\tomcat6\webapps\mywar", the path it would find would be "C:\program files\tomcat6\webapp\mywar\WEB-INF\classes" which is always accurate. Not sure if this solution also works with other web applications, but I would imagine so since login.conf is going to be where the classpath root is.

Hope that helps!

Answer 2

You can encapsulate the client_jaas.conf in the jar, and use the code to specify the configuration dynamically

System.setProperty("java.security.auth.login.config", XXX.class.getClassLoader().getResource("client_jaas.conf").toString());

Answer 3

Unfortunately the only way I was able to get it to work was to create a file jass.conf and specify it using either:

• In the Tomcat java parameters:

  -Djava.security.auth.login.config==c:\\path\\To\\file.conf
  

• or from within the Java code:

  System.setProperty("java.security.auth.login.config","c:\\path\\To\\file.conf");
  

I'd also like to know a better way to specify the configuration. I want to package that configuration in my WAR.