Call secured EJB from "unsecured" web with custom credentials instead of "BASIC AUTH"ed credentials

[David Campbell]

I'm trying to call a secured EJB (using the remote interface) from a servlet.
I dont want to secure the web site using BASIC_AUTH, FORM, CLIENT_CERT etc, because the web site has it's own "unique" user authentication process.
Instead, I want to present the "unique" login screen, and connect to the EJB using the details entered on the screen - instead of those that you'd normally get from BASIC_AUTH etc.
So, basically, there is no CERT, nor BASIC_AUTH etc etc.

I have written all kinds of login modules, and they have all been accessed correctly when i try to invoke an ejb method,
but none of them are able to return the username provided in the web site.

The web site (servlet) code:

        

        Hashtable props = new Hashtable();
	props.put("java.naming.factory.initial", "org.jnp.interfaces.NamingContextFactory");
	props.put("java.naming.factory.url.pkgs", "org.jboss.naming:org.jnp.interfaces");
	props.put("java.naming.provider.url", System.getProperty("jboss.bind.address")+":1099");
	props.put(Context.SECURITY_PROTOCOL, "mydomain");
	props.put(Context.SECURITY_PRINCIPAL, username);			
	props.put(Context.SECURITY_CREDENTIALS, password);
	props.put(Context.SECURITY_AUTHENTICATION, "simple");
	context = new InitialContext(props);

	result = context.lookup("the name of the ejb/remote");

No matter what type of LoginModule i use, there is never any principal, username, etc etc, passed in at initialize, and
nothing (except the domain) available in the options or sharedState.

I wrote my own Callback handler and successfully "logged in" to the EJB from the web page:

    

	MySecurityCallbackHandler handler = new MySecurityCallbackHandler(username, password);
	LoginContext lc = new LoginContext("mydomain",handler);
	lc.login(); //success

...but accessing the EJB remote interface thereafter prompts the LoginModule again, and no username or password are available.
(obviously my manual login is not associated with the remote interface returned by InitialContext )

It seems to me that the Context object (or the remote interface returned by it) is using security credentials from the
web server and ignoring my custom parameters.

How can i call a secured ejb from an "unsecured" web site?

[Reza Rahman]

David,

What you are trying to do is possible but highly vendor-specific in terms of hooking is a custom JAAS module. I would check with folks more familiar with your particular application server.

Hope it helps,
Reza