custom authentication in JSPWiki 2.8

[Florian Holeczek <fl...@holeczek.de>]

Hi developers,

I've got some questions regarding custom authentication.
In JSPWiki 2.6, one could configure several authentication modules
which were tested one by one until one authenticates the user or all
have been tested:

> // Failure of the CookieAssertionLoginModule triggers the the
> // AnonymousLoginModule, which always succeeds; the user's name will
> // be the IP address, and will possess the built-in role principal 'Anonymous'.
>
> JSPWiki-container {
>   com.ecyrd.jspwiki.auth.login.WebContainerLoginModule    SUFFICIENT;
> //  com.ecyrd.jspwiki.auth.login.CookieAuthenticationLoginModule SUFFICIENT;
>   com.ecyrd.jspwiki.auth.login.CookieAssertionLoginModule SUFFICIENT;
>   com.ecyrd.jspwiki.auth.login.AnonymousLoginModule       SUFFICIENT;
> };

However, in JSPWiki 2.8, one can only define one module:

> #  If you do not wish to use container-managed authentication, you can use JSPWiki's
> #  own custom authentication system. This uses a JAAS LoginModule (supplied below)
> #  to log in the user. You can use any JAAS LoginModule you want.
> #  The default class is
> com.ecyrd.jspwiki.auth.login.UserDatabaseLoginModule,
> #  which compares the supplied username and hashed password with the values stored
> #  in the configured UserDatabase (see USER DATABASE below).
> #
> #  Supply the JAAS LoginModule class used for custom authentication here.
> #  The implementation MUST have a zero-argument constructor (as noted in the
> #  javax.security.auth.spi.LoginModule Javadocs).
> jspwiki.loginModule.class =
> com.ecyrd.jspwiki.auth.login.UserDatabaseLoginModule

Is it possible or planned to have the old possibilities again?

Next thing is, I used to authenticate via the
CookieAuthenticationLoginModule. So I've configured it in the section
above, but I'm not able to authenticate with it. While logging in, the
check box for remembering the login isn't displayed. How to
authenticate via this module in JSPWiki 2.8?

Regards,
 Florian

Re: custom authentication in JSPWiki 2.8

[Janne Jalkanen <Ja...@ecyrd.com>]

> However, in JSPWiki 2.8, one can only define one module:

> Is it possible or planned to have the old possibilities again?

I certainly hope so... I'm relying on CookieAuthenticationLoginModule  
myself quite a lot, too.  It's very, very good for intranets and  
stuff.  On a public wiki it is obviously a bit of a security problem  
- but frankly, practically every single website is doing it anyway.   
It is a great convenience to users.

Andrew?  What did you have planned?

/Janne