You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomee.apache.org by Luis Fernando Planella Gonzalez <lf...@gmail.com> on 2008/08/20 00:42:39 UTC
JAAS in embedded OpenEJB
Hi all!
I'm using openejb for tomcat integration, and I'm stuck trying to setup the
JAAS user validation.
Here are my questions:
1. I've seen on the docs that I might change the conf/login.config, but
that is a file that only exists on the standalone server, right? How can I
setup a login module that validates the credentials?
2. I'm working on a web application which may have several instances
deployed in the same tomcat, so I don't want to use the standard tomcat
JAASUserRealm because it would require setting up each context in a
login.config file (and I don't need user validation in the web layer). Is it
correct to pass the identity / credentials in the InitialContext properties?
I'm almost pullin my hair out of my head with this! :-)
Thanks!
Re: JAAS in embedded OpenEJB
Posted by Luis Fernando Planella Gonzalez <lf...@gmail.com>.
I would appreciate your help very much.
Here is the point I'm stuck:
* I've created a JAASRealm for my context under tomcat, which uses a
custom login module
* I've successfully authenticated in tomcat, and have my roles, e.g, "user"
* When accessing an EJB, the @RolesAllowed("user") denies access. I've
tried to put the realm name, security principal and credentials in the
InitialContext properties, but it don't work. After some debugging, I've
realized that TomcatSecurityService always use the host's default Realm.
It even ignores the value of realm name that is passed to it, as the
method login(String realmName, String username, String password) does
not uses the realmName parameter.
* The big question: How to propagate the authentication from tomcat
context to EJB calls? In my POV, this should work out of the box...
Again, thanks very much.
Luis Fernando Planella Gonzalez
lfpg.dev@gmail.com
Karan Malhi escreveu:
> Luis,
>
> I do not know much about this part of OpenEJB, but can definitely try and
> look into it after work today.
>
> On Wed, Aug 20, 2008 at 2:54 PM, Luis Fernando Planella Gonzalez <
> lfpg.dev@gmail.com> wrote:
>
>
>> Well, after some debugging, I've realized that a TomcatSecurityService
>> is used, which uses the tomcat's engine default realm (the one that uses
>> tomcat-users.xml).
>> The point is: how to configure it to use my context-specific realm?
>> I have a JAASRealm configured to use my LoginModule, just didn't
>> realized how to do it...
>> Thanks in advance.
>>
>> Luis Fernando Planella Gonzalez
>> lfpg.dev@gmail.com
>>
>>
>>
>> Luis Fernando Planella Gonzalez escreveu:
>> > Hi all!
>>
>>> I'm using openejb for tomcat integration, and I'm stuck trying to
>>> setup the JAAS user validation.
>>> Here are my questions:
>>>
>>> 1. I've seen on the docs that I might change the conf/login.config,
>>> but that is a file that only exists on the standalone server,
>>> right? How can I setup a login module that validates the
>>> credentials?
>>> 2. I'm working on a web application which may have several
>>> instances deployed in the same tomcat, so I don't want to use
>>> the standard tomcat JAASUserRealm because it would require
>>> setting up each context in a login.config file (and I don't need
>>> user validation in the web layer). Is it correct to pass the
>>> identity / credentials in the InitialContext properties?
>>>
>>> I'm almost pullin my hair out of my head with this! :-)
>>> Thanks!
>>>
>>>
>
>
>
>
Re: JAAS in embedded OpenEJB
Posted by Karan Malhi <ka...@gmail.com>.
Luis,
I do not know much about this part of OpenEJB, but can definitely try and
look into it after work today.
On Wed, Aug 20, 2008 at 2:54 PM, Luis Fernando Planella Gonzalez <
lfpg.dev@gmail.com> wrote:
> Well, after some debugging, I've realized that a TomcatSecurityService
> is used, which uses the tomcat's engine default realm (the one that uses
> tomcat-users.xml).
> The point is: how to configure it to use my context-specific realm?
> I have a JAASRealm configured to use my LoginModule, just didn't
> realized how to do it...
> Thanks in advance.
>
> Luis Fernando Planella Gonzalez
> lfpg.dev@gmail.com
>
>
>
> Luis Fernando Planella Gonzalez escreveu:
> > Hi all!
> > I'm using openejb for tomcat integration, and I'm stuck trying to
> > setup the JAAS user validation.
> > Here are my questions:
> >
> > 1. I've seen on the docs that I might change the conf/login.config,
> > but that is a file that only exists on the standalone server,
> > right? How can I setup a login module that validates the
> > credentials?
> > 2. I'm working on a web application which may have several
> > instances deployed in the same tomcat, so I don't want to use
> > the standard tomcat JAASUserRealm because it would require
> > setting up each context in a login.config file (and I don't need
> > user validation in the web layer). Is it correct to pass the
> > identity / credentials in the InitialContext properties?
> >
> > I'm almost pullin my hair out of my head with this! :-)
> > Thanks!
> >
>
--
Karan Singh Malhi
Re: JAAS in embedded OpenEJB
Posted by Luis Fernando Planella Gonzalez <lf...@gmail.com>.
Well, after some debugging, I've realized that a TomcatSecurityService
is used, which uses the tomcat's engine default realm (the one that uses
tomcat-users.xml).
The point is: how to configure it to use my context-specific realm?
I have a JAASRealm configured to use my LoginModule, just didn't
realized how to do it...
Thanks in advance.
Luis Fernando Planella Gonzalez
lfpg.dev@gmail.com
Luis Fernando Planella Gonzalez escreveu:
> Hi all!
> I'm using openejb for tomcat integration, and I'm stuck trying to
> setup the JAAS user validation.
> Here are my questions:
>
> 1. I've seen on the docs that I might change the conf/login.config,
> but that is a file that only exists on the standalone server,
> right? How can I setup a login module that validates the
> credentials?
> 2. I'm working on a web application which may have several
> instances deployed in the same tomcat, so I don't want to use
> the standard tomcat JAASUserRealm because it would require
> setting up each context in a login.config file (and I don't need
> user validation in the web layer). Is it correct to pass the
> identity / credentials in the InitialContext properties?
>
> I'm almost pullin my hair out of my head with this! :-)
> Thanks!
>