JAAS how to tell Glassfish which LoginModule to use?

Question

I want to use JAAS Authentification for my webapp.

For that i have the following classes:

UserPrincipal:

import java.security.Principal;

public class UserPrincipal implements Principal {

    private String name = "";

    public UserPrincipal(String name) {
        this.name = name;
    }

    public String getName() {
    return name;
    }

    public void setName(String name) {
    this.name = name;
    }
}

RolePrincipal:

import java.security.Principal;

public class RolePrincipal implements Principal {

    private String name = "";

    public RolePrincipal(String name) {
    this.name = name;
    }

    public String getName() {
    return name;
    }

    public void setName(String name) {
    this.name = name;
    }
}

LoginModule:

public class MyLoginModule implements LoginModule {
    private CallbackHandler callbackHandler = null;
    private Subject subject = null;
    private UserPrincipal userPrincipal = null;
    private RolePrincipal rolePrincipal = null;
    private String login = null;
    private List<String> userGroups = null;

    public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState, Map<String, ?> options) {
        this.callbackHandler = callbackHandler;
        this.subject = subject;
    }

    public boolean login() throws LoginException {
        Callback[] callbacks = new Callback[2];
        callbacks[0] = new NameCallback("login");
        callbacks[1] = new PasswordCallback("password", true);

        try {
            callbackHandler.handle(callbacks);

            String name = ((NameCallback)callbacks[0]).getName();
            String password = String.valueOf(((PasswordCallback) callbacks[1]).getPassword());

            if(name != null && name.equals("admin") && password != null && password.equals("admin")) {
                this.login = name;
                this.userGroups = new ArrayList<String>();
                this.userGroups.add("admin");

                return true;
            }

            throw new LoginException("Authentication failed");
        } catch (IOException e) {
            throw new LoginException(e.getMessage());
        } catch (UnsupportedCallbackException e) {
            throw new LoginException(e.getMessage());
        }
    }

    public boolean commit() throws LoginException {
        this.userPrincipal = new UserPrincipal(this.login);
        this.subject.getPrincipals().add(this.userPrincipal);

        if(this.userGroups != null && this.userGroups.size() > 0) {
            for(String groupName: this.userGroups) {
                this.rolePrincipal = new RolePrincipal(groupName);
                this.subject.getPrincipals().add(this.rolePrincipal);
            }
        }

        return true;
    }

    public boolean abort() throws LoginException {
        return false;
    }

    public boolean logout() throws LoginException {
        this.subject.getPrincipals().remove(this.userPrincipal);
        this.subject.getPrincipals().remove(this.rolePrincipal);

        return true;
    }
}

How do i have to tell my Glassfish server that he has to use MyLoginModule as the LoginModule?

My web.xml security configuration is that:

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Admin</web-resource-name>
        <url-pattern>/admin/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>admin</role-name>
    </auth-constraint>
</security-constraint>

<security-role>
   <role-name>admin</role-name> 
</security-role>

<login-config>
    <auth-method>FORM</auth-method>
    <realm-name>Admin</realm-name>
    <form-login-config>
        <form-login-page>/login.jsp</form-login-page>
        <form-error-page>/error.jsp</form-error-page>
    </form-login-config>
</login-config>

The Documentation i found is not really clear in what actually to do.

Hope someone knows!

Answer 1

Edit your config/login.conf and add your LoginModule for the realm you use. In your web.xml, you use the "Admin" realm (realm-name). So I guess your login.conf file should look like :

Admin {
  com.mycompany.MyLoginModule required;
}