org.apache.catalina.realm.JAASRealm java code examples

/**
 * Construct a callback handler configured with the specified values.
 * Note that if the <code>JAASRealm</code> instance specifies digested passwords,
 * the <code>password</code> parameter will be pre-digested here.
 *
 * @param realm Our associated JAASRealm instance
 * @param username Username to be authenticated with
 * @param password Password to be authenticated with
 */
public JAASCallbackHandler(JAASRealm realm, String username,
              String password) {
  super();
  this.realm = realm;
  this.username = username;
  if (realm.hasMessageDigest()) {
    this.password = realm.digest(password);
  }
  else {
    this.password = password;
  }
}

/**
 * @return the <code>Principal</code> associated with the given user name.
 */
@Override
protected Principal getPrincipal(String username) {
  return authenticate(username,
      new JAASCallbackHandler(this, username, null, null, null, null,
          null, null, null, HttpServletRequest.CLIENT_CERT_AUTH));
}

/**
* Prepare for the beginning of active use of the public methods of this
* component and implement the requirements of
* {@link org.apache.catalina.util.LifecycleBase#startInternal()}.
*
* @exception LifecycleException if this component detects a fatal error
*  that prevents this component from being used
*/
@Override
protected void startInternal() throws LifecycleException {
 // These need to be called after loading configuration, in case
 // useContextClassLoader appears after them in xml config
 parseClassNames(userClassNames, userClasses);
 parseClassNames(roleClassNames, roleClasses);
 super.startInternal();
}

JAASRealm realm = new JAASRealm();
realm.setUserClassNames(userClassNames);
realm.setRoleClassNames(roleClassNames);
if("true".equals(useContextClassLoader) ||
    "TRUE".equals(useContextClassLoader)){
  realm.setUseContextClassLoader(true);
} else {
  realm.setUseContextClassLoader(false);
ObjectName oname = realm.getObjectName();

this.username = username;
if (realm.hasMessageDigest()) {
  this.password = realm.getCredentialHandler().mutate(password);

if (isUseContextClassLoader()) {
 ocl=Thread.currentThread().getContextClassLoader();
 Thread.currentThread().setContextClassLoader(this.getClass().getClassLoader());
  return (null);
} finally {
  if( isUseContextClassLoader()) {
   Thread.currentThread().setContextClassLoader(ocl);
Principal principal = createPrincipal(username, subject);
if (principal == null) {
  log.debug(sm.getString("jaasRealm.authenticateFailure", username));

if (!isUseContextClassLoader()) {
 ocl = Thread.currentThread().getContextClassLoader();
 Thread.currentThread().setContextClassLoader(
  Configuration config = getConfig();
  loginContext = new LoginContext(
      appName, null, callbackHandler, config);
  return null;
} finally {
  if(!isUseContextClassLoader()) {
   Thread.currentThread().setContextClassLoader(ocl);
Principal principal = createPrincipal(username, subject, loginContext);
if (principal == null) {
  log.debug(sm.getString("jaasRealm.authenticateFailure", username));

public void setContainer(Container container) {
  super.setContainer(container);
  if( appName==null  ) {
    String name=container.getName();
    name = makeLegalForJAAS(name);
    appName=name;
    log.info("Set JAAS app name " + appName);
  }
}

  if (realm.getContainer().getLogger().isTraceEnabled())
    realm.getContainer().getLogger().trace(sm.getString("jaasCallback.username", username));
  ((NameCallback) callbacks[i]).setName(username);
} else if (callbacks[i] instanceof PasswordCallback) {

if (isUseContextClassLoader())
  loader = Thread.currentThread().getContextClassLoader();

Principal principal = createPrincipal(username, subject);
if (principal == null) {
  if (log.isLoggable(Level.FINE)) {

/** Provide a default in case no explicit configuration is set
 *
 * @return configured realm, or a JAAS realm by default
 */
public Realm getRealm() {
  Realm configured=super.getRealm();
  // If no set realm has been called - default to JAAS
  // This can be overriden at engine, context and host level  
  if( configured==null ) {
    configured=new JAASRealm();
    this.setRealm( configured );
  }
  return configured;
}

if (!isUseContextClassLoader()) {
 ocl = Thread.currentThread().getContextClassLoader();
 Thread.currentThread().setContextClassLoader(
  return (null);
} finally {
  if(!isUseContextClassLoader()) {
   Thread.currentThread().setContextClassLoader(ocl);
Principal principal = createPrincipal(username, subject, loginContext);
if (principal == null) {
  log.debug(sm.getString("jaasRealm.authenticateFailure", username));

if (!isUseContextClassLoader()) {
 ocl = Thread.currentThread().getContextClassLoader();
 Thread.currentThread().setContextClassLoader(
  Configuration config = getConfig();
  loginContext = new LoginContext(
      appName, null, callbackHandler, config);
  return (null);
} finally {
  if(!isUseContextClassLoader()) {
   Thread.currentThread().setContextClassLoader(ocl);
Principal principal = createPrincipal(username, subject, loginContext);
if (principal == null) {
  log.debug(sm.getString("jaasRealm.authenticateFailure", username));

@Override
public void setContainer(Container container) {
  super.setContainer(container);
  if( appName==null  ) {
    String name = container.getName();
    if (!name.startsWith("/")) {
      name = "/" + name;
    }
    name = makeLegalForJAAS(name);
    appName=name;
    log.info("Set JAAS app name " + appName);
  }
}

  if (realm.getContainer().getLogger().isTraceEnabled())
    realm.getContainer().getLogger().trace(sm.getString("jaasCallback.username", username));
  ((NameCallback) callbacks[i]).setName(username);
} else if (callbacks[i] instanceof PasswordCallback) {

if (isUseContextClassLoader())
  loader = Thread.currentThread().getContextClassLoader();

this.username = username;
if (realm.hasMessageDigest()) {
  this.password = realm.getCredentialHandler().mutate(password);

/** Provide a default in case no explicit configuration is set
 *
 * @return configured realm, or a JAAS realm by default
 */
public Realm getRealm() {
  Realm configured=super.getRealm();
  // If no set realm has been called - default to JAAS
  // This can be overridden at engine, context and host level  
  if( configured==null ) {
    configured=new JAASRealm();
    this.setRealm( configured );
  }
  return configured;
}

if (!isUseContextClassLoader()) {
 ocl = Thread.currentThread().getContextClassLoader();
 Thread.currentThread().setContextClassLoader(
  return (null);
} finally {
  if(!isUseContextClassLoader()) {
   Thread.currentThread().setContextClassLoader(ocl);
Principal principal = createPrincipal(username, subject, loginContext);
if (principal == null) {
  log.debug(sm.getString("jaasRealm.authenticateFailure", username));

Javadoc

Implementation of Realm that authenticates users via the Java Authentication and Authorization Service (JAAS). JAAS support requires either JDK 1.4 (which includes it as part of the standard platform) or JDK 1.3 (with the plug-in jaas.jar file).

The value configured for the appName property is passed to the javax.security.auth.login.LoginContext constructor, to specify the application name used to select the set of relevant LoginModules required.

The JAAS Specification describes the result of a successful login as a javax.security.auth.Subject instance, which can contain zero or more java.security.Principal objects in the return value of the Subject.getPrincipals() method. However, it provides no guidance on how to distinguish Principals that describe the individual user (and are thus appropriate to return as the value of request.getUserPrincipal() in a web application) from the Principal(s) that describe the authorized roles for this user. To maintain as much independence as possible from the underlying LoginMethod implementation executed by JAAS, the following policy is implemented by this Realm:

The JAAS LoginModule is assumed to return a Subject with at least one Principal instance representing the user himself or herself, and zero or more separate Principals representing the security roles authorized for this user.
On the Principal representing the user, the Principal name is an appropriate value to return via the Servlet API method HttpServletRequest.getRemoteUser().
On the Principals representing the security roles, the name is the name of the authorized security role.
This Realm will be configured with two lists of fully qualified Java class names of classes that implement java.security.Principal - one that identifies class(es) representing a user, and one that identifies class(es) representing a security role.
As this Realm iterates over the Principals returned by Subject.getPrincipals(), it will identify the first Principal that matches the "user classes" list as the Principal for this user.
As this Realm iterates over the Principals returned by Subject.getPrincipals(), it will accumulate the set of all Principals matching the "role classes" list as identifying the security roles for this user.
It is a configuration error for the JAAS login method to return a validated Subject without a Principal that matches the "user classes" list.
By default, the enclosing Container's name serves as the application name used to obtain the JAAS LoginContext ("Catalina" in a default installation). Tomcat must be able to find an application with this name in the JAAS configuration file. Here is a hypothetical JAAS configuration file entry for a database-oriented login module that uses a Tomcat-managed JNDI database resource:
```
Catalina { 
org.foobar.auth.DatabaseLoginModule REQUIRED 
JNDI_RESOURCE=jdbc/AuthDB 
USER_TABLE=users 
USER_ID_COLUMN=id 
USER_NAME_COLUMN=name 
USER_CREDENTIAL_COLUMN=password 
ROLE_TABLE=roles 
ROLE_NAME_COLUMN=name 
PRINCIPAL_FACTORY=org.foobar.auth.impl.SimplePrincipalFactory; 
};
```
To set the JAAS configuration file location, set the CATALINA_OPTS environment variable similar to the following:
CATALINA_OPTS="-Djava.security.auth.login.config=$CATALINA_HOME/conf/jaas.config"
As part of the login process, JAASRealm registers its own CallbackHandler, called (unsurprisingly) JAASCallbackHandler. This handler supplies the HTTP requests's username and credentials to the user-supplied LoginModule
As with other Realm implementations, digested passwords are supported if the <Realm> element in server.xml contains a digest attribute; JAASCallbackHandler will digest the password prior to passing it back to the LoginModule

Most used methods

createPrincipal
Identify and return a java.security.Principal instance representing the authenticated user for the s
getContainer
hasMessageDigest
isUseContextClassLoader
Returns whether to use the context or default ClassLoader. True means to use the context ClassLoader
makeLegalForJAAS
Ensure the given name is legal for JAAS configuration. Added for Bugzilla 30869, made protected for
authenticate
Return the Principal associated with the specified username and credentials, if there is one; otherw
parseClassNames
Parses a comma-delimited list of class names, and store the class names in the provided List. Each c
digest
<init>
getConfig
Load custom JAAS Configuration.
getAppName
getter for the appName member variable
getCredentialHandler

Popular in Java

Reactive rest calls using spring rest template
putExtra (Intent)
runOnUiThread (Activity)
compareTo (BigDecimal)
OutputStream (java.io)
A writable sink for bytes.Most clients will use output streams that write data to the file system (
ResultSet (java.sql)
An interface for an object which represents a database table entry, returned as the result of the qu
NumberFormat (java.text)
The abstract base class for all number formats. This class provides the interface for formatting and
Properties (java.util)
A Properties object is a Hashtable where the keys and values must be Strings. Each property can have
JLabel (javax.swing)
JPanel (javax.swing)
Top plugins for Android Studio

How to useJAASRealm in org.apache.catalina.realm

Best Java code snippets using org.apache.catalina.realm.JAASRealm (Showing top 20 results out of 315)

How to use
JAASRealm
in
org.apache.catalina.realm