<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<body link="#355491" alink="#4262a1" vlink="#355491" style="background: #e2e2e2; margin: 0; padding: 20px;">
<div>
<table cellpadding="0" bgcolor="#FFFFFF" border="0" cellspacing="0" style="border: 1px solid #dadada; margin-bottom: 30px; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td>
<table border="0" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF" style="border: solid 2px #ccc; background: #dadada; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td bgcolor="#000000" valign="middle" height="58px" style="border-bottom: 1px solid #ccc; padding: 20px; -moz-border-radius-topleft: 3px; -moz-border-radius-topright: 3px; -webkit-border-top-right-radius: 5px; -webkit-border-top-left-radius: 5px;">
<h1 style="color: #333333; font: bold 22px Arial, Helvetica, sans-serif; margin: 0; display: block !important;">
<!-- To have a header image/logo replace the name below with your img tag -->
<!-- Email clients will render the images when the message is read so any image -->
<!-- must be made available on a public server, so that all recipients can load the image. -->
<a href="https://community.jboss.org/index.jspa" style="text-decoration: none; color: #E1E1E1">JBoss Community</a></h1>
</td>
</tr>
<tr>
<td bgcolor="#FFFFFF" style="font: normal 12px Arial, Helvetica, sans-serif; color:#333333; padding: 20px; -moz-border-radius-bottomleft: 4px; -moz-border-radius-bottomright: 4px; -webkit-border-bottom-right-radius: 5px; -webkit-border-bottom-left-radius: 5px;"><h3 style="margin: 10px 0 5px; font-size: 17px; font-weight: normal;">
WebJASPIOptionalAuthenticator, spec compliant?
</h3>
<span style="margin-bottom: 10px;">
created by <a href="https://community.jboss.org/people/atijms">arjan tijms</a> in <i>PicketBox Development</i> - <a href="https://community.jboss.org/message/797150#797150">View the full discussion</a>
</span>
<hr style="margin: 20px 0; border: none; background-color: #dadada; height: 1px;">
<div class="jive-rendered-content"><p>I "discovered" the valve WebJASPIOptionalAuthenticator in the JBoss AS (7.1.1, 7.1.3) source code. It doesn't seem to be documented anywhere, but judging from the code and from trying out it appears to do authentication for unprotected resources.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>The comment above the class says that authentication of unprotected resources is optional, but I couldn't find a reference to this in the source code. Regardless, all other JASPIC/JASPI/JSR 196 implementations that I tested (GlassFish, Geronimo, WebSphere) always call the SAM for unprotected resources. See:</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><pre class="jive-pre"><code class="jive-code jive-java"><font color="darkgreen">/**
* <p>
* This class implements a JASPI authenticator for unprotected resources. In the JASPI Servlet profile, authentication
* for unprotected resources is optional but it is still allowed. When performed, the JASPI authentication modules must
* grant access to the unprotected resources irrespective of the caller, which may be anonymous (i.e, no security info
* supplied).
* </p>
*
* @author <a href="mailto:sguilhen@redhat.com">Stefan Guilhen</a>
*/</font>
@SuppressWarnings(<font color="red">"unused"</font>)
<font color="navy"><b>public</b></font> <font color="navy"><b>class</b></font> WebJASPIOptionalAuthenticator <font color="navy"><b>extends</b></font> ValveBase <font color="navy">{</font>
 
</code></pre><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>Additionally, while the class is called when configured in jboss-web.xml for unprotected resources, it doesn't seem to actually work. From the source code, it's clear that the callbackhandler isn't being processed:</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><pre class="jive-pre"><code class="jive-code jive-java">  <font color="navy"><b>boolean</b></font> isValid = sam.isValid(messageInfo, <font color="navy"><b>new</b></font> Subject(), messageLayer, appContext, cbh);
  <font color="navy"><b>if</b></font> (isValid) <font color="navy">{</font>
      WebLogger.WEB_SECURITY_LOGGER.debugf(<font color="red">"JASPI validation for unprotected request context %s succeeded"</font>, request.getServletPath());
      sam.secureResponse(messageInfo, <font color="navy"><b>new</b></font> Subject(),  messageLayer, appContext, cbh);
  <font color="navy">}</font>
 
</code></pre><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>Compare this to the corresponding fragment in WebJASPIAuthenticator, which does process the callbackhandler:</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><pre class="jive-pre"><code class="jive-code jive-java">       <font color="navy"><b>if</b></font> (sam != <font color="navy"><b>null</b></font>) <font color="navy">{</font>
            result = sam.isValid(messageInfo, clientSubject, messageLayer, appContext, cbh);
        <font color="navy">}</font>
 
        <font color="darkgreen">// the authentication process has been a success. We need to register the principal, username, password and roles</font>
        <font color="darkgreen">// with the container</font>
        <font color="navy"><b>if</b></font> (result) <font color="navy">{</font>
            PasswordValidationCallback pvc = cbh.getPasswordValidationCallback();
            CallerPrincipalCallback cpc = cbh.getCallerPrincipalCallback();
 
            <font color="darkgreen">// get the client principal from the callback.</font>
            Principal clientPrincipal = cpc.getPrincipal();
            <font color="navy"><b>if</b></font> (clientPrincipal == <font color="navy"><b>null</b></font>) <font color="navy">{</font>
                clientPrincipal = <font color="navy"><b>new</b></font> SimplePrincipal(cpc.getName());
            <font color="navy">}</font>
 
            <font color="darkgreen">// if the client principal is not a jboss generic principal, we need to build one before registering.</font>
            <font color="navy"><b>if</b></font> (!(clientPrincipal <font color="navy"><b>instanceof</b></font> JBossGenericPrincipal))
                clientPrincipal = this.buildJBossPrincipal(clientSubject, clientPrincipal);
 
            this.register(request, response, clientPrincipal, authMethod, pvc.getUsername(),
                    <font color="navy"><b>new</b></font> String(pvc.getPassword()));
 
            <font color="navy"><b>if</b></font> (this.secureResponse)
                sam.secureResponse(messageInfo, <font color="navy"><b>new</b></font> Subject(), messageLayer, appContext, cbh);
        <font color="navy">}</font>
 
</code></pre></div>
<div style="background-color: #f4f4f4; padding: 10px; margin-top: 20px;">
<p style="margin: 0;">Reply to this message by <a href="https://community.jboss.org/message/797150#797150">going to Community</a></p>
<p style="margin: 0;">Start a new discussion in PicketBox Development at <a href="https://community.jboss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2088">Community</a></p>
</div></td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
</body>
</html>