Using JAAS to authenticate tomcat users

[Norris Shelton]

I am aware that JAAS can be used to authenticate users on Tomcat. This normally involves a user id and a password.

We identify our users via user id, site id and password. Can JAAS be used to do this?

[Paul Sturrock]

I'd read the JAAS Reference Guide if I were you, its very useful since there are more new concepts to grasp with JAAS than with some other API.

For your requirements you can write a LoginModule whose login method can use the three properties you need to authenticate someone.

We use JAAS with JBoss currently (which uses Tomcat as its web container) to do our custom authentication.

[Charles GAY]

you should have a look towards jGuard (http://sourceforge.net/projects/jguard) which integrate JAAS into J2EE webapps in a RBAC way.

sincerly yours,

charles(jGuard team).