| java.lang.Object
 org.apache.catalina.realm.RealmBase
org.apache.catalina.realm.JAASRealm
| JAASRealm | | public class JAASRealm extends RealmBase (Code) | | Implmentation of Realm that authenticates users via the Java
Authentication and Authorization Service (JAAS). JAAS support requires
either JDK 1.4 (which includes it as part of the standard platform) or
JDK 1.3 (with the plug-in jaas.jar file).
The value configured for the appName property is passed to
the javax.security.auth.login.LoginContext constructor, to
specify the application name used to select the set of relevant
LoginModules required.
The JAAS Specification describes the result of a successful login as a
javax.security.auth.Subject instance, which can contain zero
or more java.security.Principal objects in the return value
of the Subject.getPrincipals() method. However, it provides
no guidance on how to distinguish Principals that describe the individual
user (and are thus appropriate to return as the value of
request.getUserPrincipal() in a web application) from the Principal(s)
that describe the authorized roles for this user. To maintain as much
independence as possible from the underlying LoginMethod
implementation executed by JAAS, the following policy is implemented by
this Realm:
- The JAAS
LoginModule is assumed to return a
Subject with at least one Principal instance
representing the user himself or herself, and zero or more separate
Principals representing the security roles authorized
for this user.
- On the
Principal representing the user, the Principal
name is an appropriate value to return via the Servlet API method
HttpServletRequest.getRemoteUser().
- On the
Principals representing the security roles, the
name is the name of the authorized security role.
- This Realm will be configured with two lists of fully qualified Java
class names of classes that implement
java.security.Principal - one that identifies class(es)
representing a user, and one that identifies class(es) representing
a security role.
- As this Realm iterates over the
Principals returned by
Subject.getPrincipals(), it will identify the first
Principal that matches the "user classes" list as the
Principal for this user.
- As this Realm iterates over the
Princpals returned by
Subject.getPrincipals(), it will accumulate the set of
all Principals matching the "role classes" list as
identifying the security roles for this user.
- It is a configuration error for the JAAS login method to return a
validated
Subject without a Principal that
matches the "user classes" list.
author:
Craig R. McClanahan
author:
Yoav Shapira
version:
$Revision: 1.6.2.1 $ $Date: 2004/08/21 15:49:53 $ |
| Field Summary | |
| protected String | appName
The application name passed to the JAAS LoginContext,
which uses it to select the set of relevant LoginModules. | | final protected static String | info
Descriptive information about this Realm implementation. | | final protected static String | name
Descriptive information about this Realm implementation. | | protected String | roleClassNames
Comma-delimited list of javax.security.Principal classes
that represent security roles. | | protected ArrayList | roleClasses
The list of role class names, split out for easy processing. | | final protected static StringManager | sm
The string manager for this package. | | protected boolean | useContextClassLoader
Whether to use context ClassLoader or default ClassLoader. | | protected String | userClassNames
Comma-delimited list of javax.security.Principal classes
that represent individual users. | | protected ArrayList | userClasses
The set of user class names, split out for easy processing. |
| appName | | protected String appName(Code) | | The application name passed to the JAAS LoginContext,
which uses it to select the set of relevant LoginModules.
|
| info | | final protected static String info(Code) | | Descriptive information about this Realm implementation.
|
| name | | final protected static String name(Code) | | Descriptive information about this Realm implementation.
|
| roleClassNames | | protected String roleClassNames(Code) | | Comma-delimited list of javax.security.Principal classes
that represent security roles.
|
| roleClasses | | protected ArrayList roleClasses(Code) | | The list of role class names, split out for easy processing.
|
| useContextClassLoader | | protected boolean useContextClassLoader(Code) | | Whether to use context ClassLoader or default ClassLoader.
True means use context ClassLoader, and True is the default
value.
|
| userClassNames | | protected String userClassNames(Code) | | Comma-delimited list of javax.security.Principal classes
that represent individual users.
|
| userClasses | | protected ArrayList userClasses(Code) | | The set of user class names, split out for easy processing.
|
| authenticate | | public Principal authenticate(String username, String credentials)(Code) | | Return the Principal associated with the specified username and
credentials, if there is one; otherwise return null.
If there are any errors with the JDBC connection, executing
the query or anything we return null (don't authenticate). This
event is also logged, and the connection will be closed so that
a subsequent request will automatically re-open it.
Parameters:
username - Username of the Principal to look up
Parameters:
credentials - Password or other credentials to use inauthenticating this username |
| createPrincipal | | protected Principal createPrincipal(String username, Subject subject)(Code) | | Construct and return a java.security.Principal instance
representing the authenticated user for the specified Subject. If no
such Principal can be constructed, return null.
Parameters:
subject - The Subject representing the logged in user |
| getAppName | | public String getAppName()(Code) | | getter for the appName member variable
|
| getName | | protected String getName()(Code) | | Return a short name for this Realm implementation.
|
| getPassword | | protected String getPassword(String username)(Code) | | Return the password associated with the given principal's user name.
|
| getPrincipal | | protected Principal getPrincipal(String username)(Code) | | Return the Principal associated with the given user name.
|
| isUseContextClassLoader | | public boolean isUseContextClassLoader()(Code) | | Returns whether to use the context or default ClassLoader.
True means to use the context ClassLoader.
The value of useContextClassLoader |
| setAppName | | public void setAppName(String name)(Code) | | setter for the appName member variable
|
| setRoleClassNames | | public void setRoleClassNames(String roleClassNames)(Code) | | |
| setUseContextClassLoader | | public void setUseContextClassLoader(boolean useContext)(Code) | | Sets whether to use the context or default ClassLoader.
True means use context ClassLoader.
Parameters:
useContext - True means use context ClassLoader |
| setUserClassNames | | public void setUserClassNames(String userClassNames)(Code) | | |
| start | | public void start() throws LifecycleException(Code) | | Prepare for active use of the public methods of this Component.
exception:
LifecycleException - if this component detects a fatal errorthat prevents it from being started |
| stop | | public void stop() throws LifecycleException(Code) | | Gracefully shut down active use of the public methods of this Component.
exception:
LifecycleException - if this component detects a fatal errorthat needs to be reported |
| Methods inherited from org.apache.catalina.realm.RealmBase | final public static String Digest(String credentials, String algorithm)(Code)(Java Doc)
public void addLifecycleListener(LifecycleListener listener)(Code)(Java Doc)
public void addPropertyChangeListener(PropertyChangeListener listener)(Code)(Java Doc)
public Principal authenticate(String username, String credentials)(Code)(Java Doc)
public Principal authenticate(String username, byte[] credentials)(Code)(Java Doc)
public Principal authenticate(String username, String clientDigest, String nOnce, String nc, String cnonce, String qop, String realm, String md5a2)(Code)(Java Doc)
public Principal authenticate(X509Certificate certs)(Code)(Java Doc)
public void destroy()(Code)(Java Doc)
protected String digest(String credentials)(Code)(Java Doc)
public LifecycleListener[] findLifecycleListeners()(Code)(Java Doc)
public SecurityConstraint[] findSecurityConstraints(HttpRequest request, Context context)(Code)(Java Doc)
public Container getContainer()(Code)(Java Doc)
public ObjectName getController()(Code)(Java Doc)
public int getDebug()(Code)(Java Doc)
public String getDigest()(Code)(Java Doc)
protected String getDigest(String username, String realmName)(Code)(Java Doc)
public String getDomain()(Code)(Java Doc)
public String getInfo()(Code)(Java Doc)
abstract protected String getName()(Code)(Java Doc)
public ObjectName getObjectName()(Code)(Java Doc)
abstract protected String getPassword(String username)(Code)(Java Doc)
abstract protected Principal getPrincipal(String username)(Code)(Java Doc)
public String getType()(Code)(Java Doc)
public boolean getValidate()(Code)(Java Doc)
protected boolean hasMessageDigest()(Code)(Java Doc)
public boolean hasResourcePermission(HttpRequest request, HttpResponse response, SecurityConstraint[] constraints, Context context) throws IOException(Code)(Java Doc)
public boolean hasRole(Principal principal, String role)(Code)(Java Doc)
public boolean hasUserDataPermission(HttpRequest request, HttpResponse response, SecurityConstraint[] constraints) throws IOException(Code)(Java Doc)
public void init()(Code)(Java Doc)
protected void log(String message)(Code)(Java Doc)
protected void log(String message, Throwable throwable)(Code)(Java Doc)
public static void main(String args)(Code)(Java Doc)
public void postDeregister()(Code)(Java Doc)
public void postRegister(Boolean registrationDone)(Code)(Java Doc)
public void preDeregister() throws Exception(Code)(Java Doc)
public ObjectName preRegister(MBeanServer server, ObjectName name) throws Exception(Code)(Java Doc)
public void removeLifecycleListener(LifecycleListener listener)(Code)(Java Doc)
public void removePropertyChangeListener(PropertyChangeListener listener)(Code)(Java Doc)
public void setContainer(Container container)(Code)(Java Doc)
public void setController(ObjectName controller)(Code)(Java Doc)
public void setDebug(int debug)(Code)(Java Doc)
public void setDigest(String digest)(Code)(Java Doc)
public void setValidate(boolean validate)(Code)(Java Doc)
public void start() throws LifecycleException(Code)(Java Doc)
public void stop() throws LifecycleException(Code)(Java Doc)
|
|
|