问题
I would like to add a Login module to my Java EE 6 application.
I've read about JAAS, but I don't understand how I can use it. Do you know some tutorial or snippet that I can use to understand and implement my login module, using JAAS and Java EE 6?
I'm using glassfish 3.1.2, eclipselink as JPA implementation and MySQL.
回答1:
The Glassfish FAQ about login module is there, but I agree it's not very deep. http://glassfish.java.net/javaee5/security/faq.html#pluglogin
Thare two things to distinguish with JAAS framework. The realm and the login module. A realm defines more or less where crendentials are stored. A login module defines more or less how credential are verified.
For instance, you might use a username/password login module, that use credentials stored in a database realm. Or you could have a login module that uses smart card authentication, and uses credentials stored in ActiveDirectory.
That's the theory. From the FAQ, it says that a Glassfish login module must extend com.sun.appserv.security.AppservPasswordLoginModule, so only username/password is supported.
But you can plug your own realm, that inherits com.sun.appserv.security.AppservRealm. You can read this article to see how to define and configure an ActiveDirectory realm. Here is an article on how to create your custom realm with Sun App Server (what became Glassfish later). I hope this part didn't change much.
回答2:
I think, than you can try this article (you can also download jaastutorial.zip - it was very helpful for me). But there is no recipe to plug it to Java EE application in this article.
来源：https://stackoverflow.com/questions/10204358/java-ee-6-login-module