File APIs for Java Developers
Manipulate DOC, XLS, PPT, PDF and many others from your application.
http://aspose.com/file-tools
The moose likes Security and the fly likes JAAS Login Module: HOw to extract user id and password from web service request. Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login
JavaRanch » Java Forums » Engineering » Security
Bookmark "JAAS Login Module: HOw to extract user id and password from web service request." Watch "JAAS Login Module: HOw to extract user id and password from web service request." New topic
Author

JAAS Login Module: HOw to extract user id and password from web service request.

priya verma
Greenhorn

Joined: May 09, 2007
Posts: 13
We have few webservices and we are protecting it using basic authentication using LDAP. All LDAP settign has been done in websphere server using admin console.

When an invalid user tries to access this web service the websphere enabled authentication process checks the userid in LDAP. How erver on gettting error from LDAP it wraps the LDAP error in axis falut ( 401 unauthorised) and sends it to the web service client.

I need to catch the excat LDAP error. So I want to create a JAAS application login module. However to intialize loginContext I am not getting how to extract the user id and password from the web service request. ( I set the username and password in org.apache.axis.client.Call object while invoking the web service. )

Note : Instead of XXXXXXXXX I need to put userid and password extracted from web service request.

javax.security.auth.login.LoginContext lc = null;

lc = new javax.security.auth.login.LoginContext("WSLogin",XXXXXXXXX);

try
{
lc.login();
}
catch (LoginException le)
{}


Also please let me know if someone knows how to call a webservice from the login module.

Ulf Dittmer
Marshal

Joined: Mar 22, 2005
Posts: 41525
    
  53
I'm not clear if you want to do this on the client or on the server? Also, how does using JAAS help with all this? For securing web services I'd use the WS-Security standard, which is supported by all major SOAP stacks.


Ping & DNS - my free Android networking tools app
priya verma
Greenhorn

Joined: May 09, 2007
Posts: 13
I want to do this on server. Actaully I new to security. I researched on internet and found that for catching the LDAP login exception we can create a login module which gets invoked during websphere enabled LDAP authentication process.
http://publib.boulder.ibm.com/infocenter/wasinfo/v7r0/index.jsp?topic=/com.ibm.websphere.express.doc/info/exp/ae/tsec_jaascustlogmod.html


Am I going on wrong way? Or can we solve this problem using WS-Security ?

Ulf Dittmer
Marshal

Joined: Mar 22, 2005
Posts: 41525
    
  53
I'm not sure if it's possible to intercept WebSphere's handling of the login process, and somehow inject JAAS into it.

If this was my problem, I'd use WS-Security, and then write code that accesses the LDAP repository in the login handler. The outlines of such a handler (minus the LDAP stuff) can be found here.
 
I agree. Here's the link: http://aspose.com/file-tools
 
subject: JAAS Login Module: HOw to extract user id and password from web service request.