[jboss-user] [Security & JAAS/JBoss] - Re: JAAS Authentication from stand alone client

ragavgomatam do-not-reply at jboss.com
Mon Aug 25 10:44:16 EDT 2008

2 issues here. Lets take the first one. You will have to change your login module to extend jboss AbstractServerLoginModule as follows :- 

anonymous wrote : Here is my LoginModule 
  | final public class DbLoginModuleImpl implements LoginModule { 


anonymous wrote : final public class DbLoginModuleImpl implements AbstractServerLoginModule { 

There is a posting for this whole code somewhere earlier in this forum, on how to extend this jboss AbstractServerLoginModule & do a database authentication.

Second issue :- You cannot use a JAAS module only for authentication. JAAS stands for Authentication & Authorization. So as a part of logging in you will have to authenticate & also provide roles. These roles are then used by container in conjunction with j2ee artifacts  (web.xml & ejb-jar.xml) to provide role based declarative authorization.This whole process is  intimately tied with Roles in j2ee security architecture. Thats why you have anonymous wrote : role elements in web.xml and ejb-jar.xml. 

If, however you want to provide default Roles, then go ahead, provide default roles & use these in your module and the web.xml and ejb-jar.xml. However you WILL have to provide roles.

View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4172326#4172326

Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4172326

More information about the jboss-user mailing list