[jboss-user] [Security & JAAS/JBoss] - Re: JAAS Authentication from stand alone client

[ragavgomatam]

2 issues here. Lets take the first one. You will have to change your login module to extend jboss AbstractServerLoginModule as follows :- 

anonymous wrote : Here is my LoginModule 
  | 
  | final public class DbLoginModuleImpl implements LoginModule { 

to 

anonymous wrote : final public class DbLoginModuleImpl implements AbstractServerLoginModule { 

There is a posting for this whole code somewhere earlier in this forum, on how to extend this jboss AbstractServerLoginModule & do a database authentication.

Second issue :- You cannot use a JAAS module only for authentication. JAAS stands for Authentication & Authorization. So as a part of logging in you will have to authenticate & also provide roles. These roles are then used by container in conjunction with j2ee artifacts  (web.xml & ejb-jar.xml) to provide role based declarative authorization.This whole process is  intimately tied with Roles in j2ee security architecture. Thats why you have anonymous wrote : role elements in web.xml and ejb-jar.xml. 


If, however you want to provide default Roles, then go ahead, provide default roles & use these in your module and the web.xml and ejb-jar.xml. However you WILL have to provide roles.




View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4172326#4172326

Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4172326