JAAS with JBoss

[Carlos Ic]

Hi all,

I'm using JAAS with JBoss in my Web application, I configure the login-config.xml file

<application-policy name="simpleWebAuthenticationPolicy">
<authentication>
<login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag="required">
   <module-option name="dsJndiName">java:/appDS</module-option>
   <module-option name="principalsQuery">select password from User where login=?</module-option>
   <module-option name="rolesQuery">select r.name, 'Roles' from User u, Role r where u.roleId=r.id and login=?</module-option>
   <module-option name="hashAlgorithm">MD5</module-option>
   <module-option name="hashEncoding">base64</module-option>
</login-module>
</authentication>
</application-policy>

and the web.xml file:

<login-config>
<auth-method>FORM</auth-method>
<realm-name>Form-Based Authentication Area</realm-name>
<form-login-config>
<form-login-page>/login.jsf</form-login-page>
<form-error-page>/loginError.jsf</form-error-page>
</form-login-config>
</login-config>

and the others elements like <security-constraint> , <security-role>...etc, in my login xhtml I use j_security_check, j_username and j_password, everything works fine, but now I need to authenticate and authorize users based on their company, since a user can be in one or more companies and each have different roles. I need something like j_company (ComboBox) in my login xhtml
and get the roles based on the company code.

Any ideas or suggestions for this case?. Thanks in advance