John Smith

There are examples of doing almost everything in your installation examples directory. Last time I checked, there were about 90 example pages illustrating all the techniques.

Run examples/grid/edit-grid.html

And read the API docs, and join http://extjs.com/forum/index.php

This gets the URL:

URL myURL = Thread.currentThread().getContextClassLoader().getResource("persistence.jar");

I have several modules in my EAR file.

I'm wondering how I can get access to the modules specified in my application.xml descriptor.

I have for example,

[code]
<module>
<ejb id="persistence.jar">persistence.jar</ejb>
</module>
[code]

How can I access that jar as a resource in a standard way? Is it on the classpath of any ClassLoader that I can access?

OK, I've found it:

in my JAAS LoginModule:

import java.util.Set; import java.net.URL; import java.security.Policy; import java.security.Principal; import java.security.AccessController; import java.security.CodeSource; import java.security.ProtectionDomain; import javax.security.auth.Subject; import javax.security.auth.callback.*; import javax.security.auth.login.LoginException; import javax.security.jacc.PolicyContext; import javax.security.jacc.WebResourcePermission; import java.security.cert.Certificate; ... private Group callerPrincipal = new FCLUserGroup("CallerPrincipal"); private Group roles = new FCLUserGroup("Roles"); private Principal[] principals = { callerPrincipal, roles }; private Policy policy = null; private CodeSource webappCodeSource = null; private ProtectionDomain webappProtDomain = null; /** The JACC PolicyContext key for the current HttpServletRequest */ private static final String WEB_REQUEST_KEY = "javax.servlet.http.HttpServletRequest"; ... policy = Policy.getPolicy(); //Create code source to protect by tracking back from the source of this class //to just above "/WEB-INF" String loadPath = this.getClass().getProtectionDomain().getCodeSource().getLocation().toString(); webappCodeSource = new CodeSource(new URL(loadPath.substring(0, loadPath.indexOf("/WEB-INF") + 1)), (Certificate[])null); //Store this LoginModule in the session HttpServletRequest request = (HttpServletRequest)PolicyContext.getContext(WEB_REQUEST_KEY); session = request.getSession(); session.setAttribute("LoginModule", this); ... //Create the ProtectionDomain webappProtDomain = new ProtectionDomain(webappCodeSource, null, null, principals); ... public boolean isURLAuthorized(String URLString) { return policy.implies(webappProtDomain, new WebResourcePermission(URLString, "")); }

So, I can pull the LogniModule out of the session anywhere, and see if any URL is going to be allowed.

Well, after much searching, I randomly stumbled across the correct incantation to be able to log out using session.invalidate():

in jboss-web.xml

<jboss-web> <!-- Specify the security domain for authentication/authorization and require that the domain's cache be flushed when the session invalidates. --> <security-domain flushOnSessionInvalidation="true"> java:/jaas/jbossweb-form-auth </security-domain> </jboss-web>

So now, I can log out when they click the logout link.

Great.

Next up, how to programatically determine whether a URL is available to the current user.

I'm of course using container-managed authorization, but it's no good outputting a link only to have the user click on it, and be tipped into the error page by JBoss. I want to have a custom tag for links which does not output any HTML if the URL is not accessible to the current user.

Any ideas?

[size=9]No doubt, I'll find the incantation at some random site given enough searching...[/size

Someone else suggested this to me, so I tried it.

Calling session.invalidate() does not cause the container to invoke the logout() method of my LoginModule. Even though the container called the login() and commit() methods.

This is a really strange omission. Surely, there is a way to explicitly request the container to log the current session out. The container surely maintains the LogniContext object somewhere!?

(Thanks for your help on this by the way...)
[ December 21, 2005: Message edited by: John Smith ]

That really saved our bacon, and we're back on track.

One problem though.

The web app does not have access to the javax.security.auth.login.LoginContext that JBoss created to perform the login.

So it cannot explicitly log out!

How does any JAAS-secured web app under JBoss ever log out?

Well spotted. I've been looking through the wiki, but unless you know what you are looking for, then finding it is pretty difficult.

Well, it works like a charm!

HOw on earth did you find that incantation? I've been harassing the posters on the jboss.org forums for a week now, and nobody, not even the JBoss developers came up with anything!

Nobody has any ideas???

This is a common situation - a lot of places use more than just username/passsword.

I need access to the HttpSession in my LoginModule.

I have a LoginHandler which is being called by JBoss to authenticate the login form.

The problem is, that it needs more information from the form than just the j_username and j_password.

It also needs a "company name" parameter too.

Also, it realy needs some parameters from the originally requested URL which specify some back end server details to enable the connection and login to take place. The connection to the server is cached in the HttpSession.

I can't see how to do this. An unlogged in request is intercepted before any declared Filters, and JBoss's CallbackHandler only accepts UsenameCallback, and PasswordCallback.

Before, when I used a Filter to control access, I set up my own CallbackHandler to pass into the LoginContext which accepted new subclasses of Callback so it provided access to the HttpSession (and therefore all attributes in it), so the LoginModule could do anything.

With container-managed authentication, all you get is the username and password. How can this be adequate in 100% of cases?! It's just not good enough!

Thanks for that topic. The magic incantation seemed to be

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE jboss-web PUBLIC "-//JBoss//DTD Web Application 2.3//EN" "http://www.jboss.org/j2ee/dtd/jboss-web_3_0.dtd"> <jboss-web> <security-domain>java:/jaas/mylogin-module</security-domain> <context-root>/myapp</context-root> <!-- Resource Environment References --> <!-- Resource references --> <!-- EJB References --> </jboss-web>

in jboss-web.xml which actually made it use

<application-policy name="mylogin-module"> <authentication> <login-module code="com.fcl.security.FCLLoginModule" flag="required"> <module-option name="unauthenticatedIdentity">anonymous</module-option> </login-module> </authentication> </application-policy>

in login-config.xml. This is not explained anywhere. Did this technique evolve? Did someone randomly hit on this?

Anyway. OK so far, but my login module needs more information from the login form than just the j_username and j_password which are available from JBoss's CallbackHandler.

I need JBoss to use my custom CallbackHandler to get info out of the HTTP request. This accepts another Callback subclass, a CompanyNameCallback. This is needed to perform our login method.

Anyone know, how I can obtain more information from the login form?

[ December 12, 2005: Message edited by: John Smith ]
[ December 12, 2005: Message edited by: John Smith ]