Security
JBoss Authentication
The authentication process can be triggered by a call to the standard servlet login mechanism specified in the servlet specification, ie a form submitting to the action j_security_check. The first step is therefore to create a login page, containing a form like this:
1
2
3
4
5
| <form action="j_security_check" method="post">
Username: <input type="text" name="j_username" size="22"/>
Password: <input type="password" name="j_password" size="22"/>
<input type="submit" value="Login" />
</form> |
The username and password will be intercepted by the JBoss SecurityInterceptor and passed to the
JAASSecurityManager class as Principal and Credential objects. It is worth noting here that if a user bookmarks a login page, or uses the browser back button to reach the page, they will see an error. This is a feature of the Tomcat implementation of the j_security_check mechanism. The next step is to set up the web.xml file as follows:
1
2
3
4
5
6
7
| <login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/login_error.html</form-error-page>
</form-login-config>
</login-config> |
Login modules within an application policy are chained . the .flag. value specifies whether they are required to succeed or not. The ClientLoginModule should be specified if you wish to use EJB security - it passes the username and credentials obtained during login to the org.jboss.security.SecurityAssociation class so that each EJB method invocation is associated with the given username and credentials. See below for details on how custom login modules work On login, the
JAASSecurityManager will create a LoginContext for the security domain specified and attempt to authenticate the specified Principal by calling the login modules configured for that domain. Internally, this looks something like the following:
1
2
3
4
5
| String name = getSecurityDomain();
CallbackHandler handler = new org.jboss.security.plugins.SecurityAssociationHandler();
handler.setSecurityInfo(principal, credential);
LoginContext lc = new LoginContext(name, handler);
lc.login(); |
The security domain should be specified in the jboss-web.xml and jboss.xml files, with a declaration like this:
<security-domain>java:/jaas/security-example</security-domain>
The JAASSecurityManager will then get a a javax.security.Subject from the LoginContext, which will contain a Principal called username and a javax.security.Group called Roles (containing an array of this user's roles) will be created. This is what allows methods like isUserInRole and getCallerPrincipal in the servlet and EJB containers to verify the current user.
JBoss 5.0 gestion des sessions HttpSession
!
Répondre avec citation
Envoyé par MaxLaMenaX
!
Partager