Tomcat 4 SingleSignOn subclass for JBoss JAAS?

[Clayton Wheeler <cs...@thirdshoe.net>]

Hello,

I am working on integrating Catalina's SingleSignOn support with JBoss'
JAAS-based authentication. With this JAAS system, it is necessary to set
up the necessary context on the JBoss side for each request, which
requires the principal and credential. For a Catalina Realm
implementation, this means specifically that in order for hasRole() to
work, authenticate() must have been called already in the course of the
current request.

I have this configuration working for single web apps; by turning off
caching in the Authenticators, I am able to cause them to call
authenticate() each time.

However, this is slightly more challenging with SingleSignOn; allowing
SingleSignOn to simply set up the principal causes the Authenticators to
skip calling authenticate().

The natural solution would seem to be to subclass SingleSignOn and
override the lookup() method to call authenticate() on the JBoss Realm for
the benefit of the JAAS layer; unfortunately, this is impossible, since
SingleSignOnEntry has package access. This makes it basically impossible
to subclass SingleSignOn in any useful way. Would it be reasonable to make
it public?

Alternatively, perhaps a protected void reauthenticate(String username,
String password) method could be added to SingleSignOn as a hook for this
type of security environment?

-- 
Clayton Wheeler
csw@thirdshoe.net






--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>