Re: [security-dev] Picketbox Authenticating with no principal
On 03/30/2014 07:21 PM, Stuart Douglas wrote:
Hi,
I have a question about Picketbox, and how I can setup a security
context when I don't have a real credential for an account.
Basically my use case is an apache server in front of Undertow, where
the apache server performs the authentication and just forwards the
authenticated principal to Undertow. From an Undertow point of view
it is easy to setup that principal as the current user, however I have
no way to then setup the Picketbox SecurityContext object, as it appears
that the only way to do this is with a credential.
You can create a security
context directly and set it on the
SecurityContextAssociation.
You should not authenticate via PicketBox in this case.
You will need to authorize the web resources. This implies you will need
to get the roles
for the principal in question.
Stefan can guide more.
The only way I can think of that maybe we can use a custom login
module,
that does not require a credential?
Apparently this used to work, however I have not been able to find a
working config anywhere, and I can't see any LoginModule implementation
in the source that look like they would do this, so I am not really sure
how to best approach this.
Stuart