[ http://jira.jboss.com/jira/browse/JBSEAM-729?page=all ] Gavin King updated JBSEAM-729: ------------------------------ Summary: support container authorization in JBoss (was: support container authorization) Description: We should use the JBoss-specific Thread->Principal binding to integrate with container authorization. Make it extensible to support other containers in future. (was: We should re-authenticate on each request, so that you can use container authorization as well as Seam authorization,) -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ http://jira.jboss.com/jira/browse/JBSEAM-729?page=comments#action_12363355 ] Simon Gunzenreiner commented on JBSEAM-729: ------------------------------------------- If the problem is getting the caller Principal without having access to Java EE APIs, maybe this sample code, which uses a JACC mechanism, would help? Object obj = PolicyContext.getContext("javax.security.auth.Subject.container"); Subject subject = (Subject) obj; if (subject != null) { Set set = subject.getPrincipals(); // get the first principal of the Subject (assume we have only one) for (Iterator iter = set.iterator(); iter.hasNext();) { Principal principal = (Principal) iter.next(); return principal; } } -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ http://jira.jboss.com/jira/browse/JBSEAM-729?page=all ] Gavin King updated JBSEAM-729: ------------------------------ Fix Version/s: 1.3.0.BETA2 -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ http://jira.jboss.com/jira/browse/JBSEAM-729?page=all ] Gavin King updated JBSEAM-729: ------------------------------ Fix Version/s: 1.3.1.GA (was: 1.3.0.BETA2) -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ http://jira.jboss.com/jira/browse/JBSEAM-729?page=all ] Shane Bryzak updated JBSEAM-729: -------------------------------- Fix Version/s: 2.0.2.GA (was: 2.0.1.GA) -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ http://jira.jboss.com/jira/browse/JBSEAM-729?page=all ] Norman Richards updated JBSEAM-729: ----------------------------------- Fix Version/s: 2.1.0.GA (was: 2.1.0.A1) -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ http://jira.jboss.com/jira/browse/JBSEAM-729?page=comments#action_12403805 ] Guillaume Jeudy commented on JBSEAM-729: ---------------------------------------- Attached are a few files showing an example on how to propagate the subject to the container and use CallerIdentityLoginModule in conjunction with Seam. components.xml: <security:identity jaas-config-name="RDMRealm" /> jboss-web.xml: <jboss-web> <security-domain>java:/jaas/RDMRealm</security-domain> </jboss-web> jboss.xml (to protect the ejbs): <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE jboss PUBLIC "-//JBoss//DTD JBOSS 4.0//EN" "http://www.jboss.org/j2ee/dtd/jboss_4_2.dtd"> <jboss> <security-domain>java:/jaas/RDMRealm</security-domain> </jboss> login-config.xml in jboss server conf/: <application-policy name="OracleDbRealm"> <authentication> <login-module code="org.jboss.resource.security.CallerIdentityLoginModule" flag="required"> <module-option name="userName">defaultUser</module-option> <module-option name="password">defaultPass</module-option> <module-option name="managedConnectionFactoryName">jboss.jca:service=LocalTxCM,name=ReferenceDataManagerDS</module-option> </login-module> </authentication> </application-policy> <application-policy name = "RDMRealm"> <authentication> <login-module code="org.jboss.security.auth.spi.UsersLoginModule" flag = "required"> <module-option name="usersProperties">props/rdm-users.properties</module-option> </login-module> </authentication> </application-policy> pages.xml: <page view-id="/ssoauth.xhtml" action="#{ssoAuthenticator.checkLogin}" login-required="false"> <navigation from-action="#{ssoAuthenticator.checkLogin}"> <rule if-outcome="true"> <redirect view-id="/showpackages.xhtml"></redirect> </rule> </navigation> </page> <page view-id="/*" login-required="true"/> <exception class="org.jboss.seam.security.NotLoggedInException"> <redirect view-id="/ssoauth.xhtml"> <message severity="warn">You must be authenticated to use this application</message> </redirect> </exception> <exception class="org.jboss.seam.security.AuthorizationException"> <redirect view-id="/ssoauth.xhtml"> <message severity="warn">You must be authorized to use this application</message> </redirect> </exception> ssoAuthenticator seam component: public boolean checkLogin() { Identity identity = Identity.instance(); // user may already be logged in - check if (identity.isLoggedIn(false)) { return true; } return authenticate(); } public boolean authenticate() { boolean authenticated = false; // get the principal and password the way you want // in my case I retrieve the principal,password populated by an NTLM servlet filter Identity identity = Identity.instance(); try { WebAuthentication webAuth = new WebAuthentication(); if (!webAuth.login(principalName, password)) { FacesMessages.instance().add("Failed to authenticate credentials, user:#0 does not exist or has wrong user/pass combination.", principalName); log.error("Failed WebAuthentication.login() returned false for user: #0", principalName); return false; } // Identity must have 'fresh' credentials for authenticate() // call to proceed identity.setUsername(principalName); identity.setPassword(password); identity.authenticate(); // test try { Subject caller = (Subject) PolicyContext.getContext("javax.security.auth.Subject.container"); if (caller != null) { log.info("Subject is:" + caller); } } catch (PolicyContextException e) { // TODO Auto-generated catch block e.printStackTrace(); } // end test // set identity roles here authenticated = true; } catch (LoginException e) { log.error("Failed to authenticate", e); FacesMessages.instance().add("Failed to authenticate, user:#0. " + e.getMessage(), principalName); } } return authenticated; } -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ http://jira.jboss.com/jira/browse/JBSEAM-729?page=all ] Pete Muir updated JBSEAM-729: ----------------------------- Fix Version/s: 2.1.0.BETA2 (was: 2.1.0.GA) -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBSEAM-729?page=com.atlassian.jira.plu... ] Norman Richards updated JBSEAM-729: ----------------------------------- Fix Version/s: The future (was: 2.2.1.CR1) -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://issues.jboss.org/browse/JBSEAM-729?page=com.atlassian.jira.plugin... ] Marek Novotny closed JBSEAM-729. -------------------------------- closing as clean up -- This message is automatically generated by JIRA. For more information on JIRA, see: http://www.atlassian.com/software/jira