<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<body link="#355491" alink="#4262a1" vlink="#355491" style="background: #e2e2e2; margin: 0; padding: 20px;">
<div>
<table cellpadding="0" bgcolor="#FFFFFF" border="0" cellspacing="0" style="border: 1px solid #dadada; margin-bottom: 30px; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td>
<table border="0" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF" style="border: solid 2px #ccc; background: #dadada; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td bgcolor="#000000" valign="middle" height="58px" style="border-bottom: 1px solid #ccc; padding: 20px; -moz-border-radius-topleft: 3px; -moz-border-radius-topright: 3px; -webkit-border-top-right-radius: 5px; -webkit-border-top-left-radius: 5px;">
<h1 style="color: #333333; font: bold 22px Arial, Helvetica, sans-serif; margin: 0; display: block !important;">
<!-- To have a header image/logo replace the name below with your img tag -->
<!-- Email clients will render the images when the message is read so any image -->
<!-- must be made available on a public server, so that all recipients can load the image. -->
<a href="http://community.jboss.org/index.jspa" style="text-decoration: none; color: #E1E1E1">JBoss Community</a></h1>
</td>
</tr>
<tr>
<td bgcolor="#FFFFFF" style="font: normal 12px Arial, Helvetica, sans-serif; color:#333333; padding: 20px; -moz-border-radius-bottomleft: 4px; -moz-border-radius-bottomright: 4px; -webkit-border-bottom-right-radius: 5px; -webkit-border-bottom-left-radius: 5px;"><h3 style="margin: 10px 0 5px; font-size: 17px; font-weight: normal;">
Re: AS7 : Authentication and Authorization
</h3>
<span style="margin-bottom: 10px;">
created by <a href="http://community.jboss.org/people/darran.lofthouse%40jboss.com">Darran Lofthouse</a> in <i>PicketBox Development</i> - <a href="http://community.jboss.org/message/582748#582748">View the full discussion</a>
</span>
<hr style="margin: 20px 0; border: none; background-color: #dadada; height: 1px;">
<div class="jive-rendered-content"><p>I have also thought for a while that this area needs an overhaul, I think the pattern imposed by the UsernamePasswordLoginModule really complicates writing login modules that can have the pure authentiction step handled by one module and the Principal association handled by the other modules.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>Also when discussing these modules I think it is probably best not to discuss them as handling authorization, that is something that happens outside of the authentication process when the modules are called, the modules populate the Principals in the Subject that can be used for authorization but the actualy authorization is seperate.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>When writing some of the modules within JBoss Negotiation I had to make some decisions regarding chaining or extending that may have some bearing on your work here: -</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><ul><li>Connection Sharing</li><li>Pre-authentication queries</li></ul><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>So for the connection sharing a number of modules establish a connection to something remote such as an LDAP server or a database, the current modules use the same connection for the pure authentication and the subsequent loading of roles - a subsequent switch to split modules could benefit also from a mechanism to share these connections whilst taking into account issues such as ensuring no leaks.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>For the second issue with pre-authentication queries I found myself that in the case of having an LDAP login module chained after another module that had perfomed the authentication the LDAP module still needed to perform almost the same set of queries to identify the user before the roles searching could begin - in the end for the AdvancedLdapLoginModule in JBoss Negotiation when chained the only thing actually skipped was the password verification the remaining 99% of code was still called as if it was not chained.</p></div>
<div style="background-color: #f4f4f4; padding: 10px; margin-top: 20px;">
<p style="margin: 0;">Reply to this message by <a href="http://community.jboss.org/message/582748#582748">going to Community</a></p>
<p style="margin: 0;">Start a new discussion in PicketBox Development at <a href="http://community.jboss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2088">Community</a></p>
</div></td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
</body>
</html>