DO NOT REPLY [Bug 16274] New: - JAASRealm breaks catalina classloader under JDK 1.4

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=16274>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=16274

JAASRealm breaks catalina classloader under JDK 1.4

           Summary: JAASRealm breaks catalina classloader under JDK 1.4
           Product: Tomcat 4
           Version: 4.1.18
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: Normal
          Priority: Other
         Component: Unknown
        AssignedTo: tomcat-dev@jakarta.apache.org
        ReportedBy: ilyanov@mac.com


I managed to configure the JAASRealm authenticator that I found was part of
Catalina. The jaas.conf, I initially set to use the JAASMemoryLoginModule (that
allows JAAS to use the tomcat-users.xml file to perform authentication). On
starting tomcat can with the -security flag and passing the jaas related VM
flags I found that the VM was not finding the LoginModule which is part of
catalina.jar . I placed catalina.jar in the vm classpath but this resulted in
catalina not starting at all. (LifeCycle Classdefnotfound). I tried placing
catalina.jar in all the places I could think off but to no avail. I then
extracted the JAAS related class (and org.apache.catalina.Realm) and placed it
in a seperated jar (loginmodule.jar) and placed it in bin and add the jar to the
classpath (after bootstrap.jar). This also failed to resolve the issue as
JAASMemoryLoginModule implements Realm. This interface is part of the
catalina.jar and essentially I ended up with the same results as having
catalina.jar in the classpath (LifeCycle classdefnotfound).  As an experiment I
decided to create a new LoginModule with no dependencies to catalina except for
JAASCallbackHandler (principals and roles were statically initialized in the
class to simulate authentication). Up on placing this jar in the classpath and
leaving the rest of tomcat the way it was seems to have done the trick. 
I presume that the LoginModule needs to be in the classpath as of jdk1.4 as JAAS
is shipped with the jdk. If this is true then I thik it would be necessary to
repackage the JAAS related functionality in a seperate jar and do with it the
same as bootstrap.jar.

Regards
suhail

--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>