JAAS Authentication. Confusion about use case.

[Nitin Bhavsar]

Hi, I am a newbie to JAAS and struggling with some basic things for a week now

I created and configured JDBCRealm with Sun One Application Server 8 and made it default realm. It is working fine. The app server users are getting authenticated against the database.

Then I tried to use form based authentication. I deployed a war (from the samples folder) and tried to test it. It is also working fine.

Now I planned to use the authentication mechanism in my application. I tried to create a Session EJB and authenticate the user using it.
I mean the EJB client will pass the username and password to the EJB, the EJB will use the LoginModule which is a part of JDBCRealm to authenticate the user.

It is not working. I am getting an exception message:

A PasswordCredential was required but not provided.

The exception is:

javax.security.auth.login.LoginException: No credentials.
        at com.sun.enterprise.security.auth.login.PasswordLoginModule.login(PasswordLoginModule.java:124)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:324)
        at javax.security.auth.login.LoginContext.invoke(LoginContext.java:675)
        at javax.security.auth.login.LoginContext.access$000(LoginContext.java:129)
        at javax.security.auth.login.LoginContext$4.run(LoginContext.java:610)
        at java.security.AccessController.doPrivileged(Native Method)
        at javax.security.auth.login.LoginContext.invokeModule(LoginContext.java:607)
        at javax.security.auth.login.LoginContext.login(LoginContext.java:534)
        at com.ser.auth.ejb.AuthenticateUserBean.authenticate(Unknown Source)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:324)
        at com.sun.enterprise.security.SecurityUtil$2.run(SecurityUtil.java:146)
        at java.security.AccessController.doPrivileged(Native Method)
        at com.sun.enterprise.security.application.EJBSecurityManager.doAsPrivileged(EJBSecurityManager.java:930)
        at com.sun.enterprise.security.SecurityUtil.invoke(SecurityUtil.java:151)
        at com.sun.ejb.containers.EJBObjectInvocationHandler.invoke(EJBObjectInvocationHandler.java:128)
        at $Proxy37.authenticate(Unknown Source)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:324)
        at com.sun.corba.ee.impl.presentation.rmi.ReflectiveTie._invoke(ReflectiveTie.java:117)
        at com.sun.corba.ee.impl.protocol.CorbaServerRequestDispatcherImpl.dispatchToServant(CorbaServerRequestDispatcherImpl.java:651)
        at com.sun.corba.ee.impl.protocol.CorbaServerRequestDispatcherImpl.dispatch(CorbaServerRequestDispatcherImpl.java:190)
        at com.sun.corba.ee.impl.protocol.CorbaMessageMediatorImpl.handleRequestRequest(CorbaMessageMediatorImpl.java:1653)
        at com.sun.corba.ee.impl.protocol.CorbaMessageMediatorImpl.handleRequest(CorbaMessageMediatorImpl.java:1513)
        at com.sun.corba.ee.impl.protocol.CorbaMessageMediatorImpl.handleInput(CorbaMessageMediatorImpl.java:895)
        at com.sun.corba.ee.impl.protocol.giopmsgheaders.RequestMessage_1_2.callback(RequestMessage_1_2.java:172)
        at com.sun.corba.ee.impl.protocol.CorbaMessageMediatorImpl.handleRequest(CorbaMessageMediatorImpl.java:668)
        at com.sun.corba.ee.impl.transport.SocketOrChannelConnectionImpl.dispatch(SocketOrChannelConnectionImpl.java:375)
        at com.sun.corba.ee.impl.transport.SocketOrChannelConnectionImpl.read(SocketOrChannelConnectionImpl.java:284)
        at com.sun.corba.ee.impl.transport.ReaderThreadImpl.doWork(ReaderThreadImpl.java:73)
        at com.sun.corba.ee.impl.orbutil.threadpool.ThreadPoolImpl$WorkerThread.run(ThreadPoolImpl.java:382)

I am not sure if it is the right way to authenticate the user. If it is wrong please show me some light.

If it is correct, then please help me get thru this error.

Please tell me, what should be the part of Client code. I mean, should the implementation of LoginModule, CallbackHandlers etc. should be present on client side or not? Where should the config file with JAAS module declaration exist? Should it be on client side or server.
When I configured the JDBCRealm, I placed the jar with Realms classes (LoginModule impl, Realm impl) under lib folder for the specific domain.
I added the classpath for JDBCRealm, added the properties to Realm using the application server admin console.

take me out of these confusions.

thanx

Nitin :-)