this mapping has to happen before any security context is set up for
propagating the identity to other subsystems such as EJBs. I think you
are in agreement.
The Undertow security framework has to have some callback mechanism to
switch the identity with which the authentication call was made.
Let me dig into the undertow code using your email as guidance.
On 09/04/2013 02:34 AM, Stuart Douglas wrote:
At the moment we don't have the ability to do this, but we could
potentially add it.
It does get a bit tricky however, say we just expand the SecurityNotification mechanism
to allow you to wrap the account after login. This would work from Undertow's
perspective, however it is likely that there is other code that expects the account to be
of a certain type, that will now fail because of the wrapper.
We would also have to look carefully at how this would with with the
JAASIdentityManagerImpl in the Wildfly code base, as it appears that we will be stuck with
that for a while yet. To make this work properly with the rest of Wildfly we would
probably actually need to implement this inside the JAAS IDM itself, to make sure the
Picketbox SecurityContext is setup correctly.
----- Original Message -----
> From: "Anil Saldhana" <Anil.Saldhana(a)redhat.com>
> To: undertow-dev(a)lists.jboss.org
> Sent: Tuesday, 3 September, 2013 4:58:25 PM
> Subject: [undertow-dev] Principal mapping after authentication
> Hi All,
> one of the challenges we had with JBossWeb was principal mapping
> after authentication. It was hard as hell to do that. I wished for a
> mechanism where the authentication call would have a post authentication
> callback to see if the original principal has been mapped to something
> else. This is a use case seen in integration with third party security
> systems including commercial vendors.
> I have not dug into Undertow security codebase to see if this is
> possible yet but I wanted to put this to the dev list so that we can
> discuss it.