Welcome!

Java IoT Authors: Liz McMillan, Xenia von Wedel, Elizabeth White, Yeshim Deniz, Tim Hinds

Related Topics: Java IoT

Java IoT: Article

Extending JAAS

Extending JAAS

User authentication and access control are important security measures for most Java applications, especially J2EE applications. The Java Authentication and Authorization Service (JAAS), the core API of J2SE 1.4 and 1.5, represents the new security standard. It provides a pluggable and flexible framework that allows developers to incorporate different security mechanisms and various security sources.

With the upcoming release of J2SE 1.5, which includes a lot of enhancements to cryptography, XML security, Public Key Infrastructure (PKI), Kerberos, and the federating identity, the JAAS will play a more important role in J2EE security implementations.

Overview of JAAS
Authentication

Authentication is the process of verifying that a user has the right to use identities established by the enterprise user registry. The authentication mechanism of JAAS is built on a set of pluggable modules (see Figure 1). JAAS allows different authentication models to be plugged in at runtime. The client applications always interact with JAAS through the LoginContext object.

The authentication process typically involves the following steps:

  1. Create a LoginContext object. The LoginContext looks up the configuration file to determine which LoginModule to use. Also, optionally, you can pass a CallbackHandler to the LoginContext.
  2. Perform authentication by calling the login method of LoginContext, which loads the predefined LoginModule to check if the user can be authenticated.
  3. Associate principals and credentials with the Subject if the user is authenticated.
  4. Or throw a LoginException in case login failed.
  5. Use the logout method of LoginContext to log out.
The login in JAAS is a two-phase process. The first phase is the "login" phase (as described in step 2). The only task in this phase is authentication. Once the process successfully passes this phase, the authentication process enters the "commit" phase (step 3) in which the commit method of LoginModule is called to associate the relevant principals and credentials with the Subject.

A Subject in JAAS represents an authenticated entity, such as a person or device. It contains a set of principals and security-related attributes such as a password and cryptographic keys. In the JAAS architecture, the Subject, along with the Permission, plays an important role in the authorization process.

Of all the authentication modules, the LoginModule is the interface to a particular authentication mechanism. Although the LoginModule never gets called directly by the client application, it provides a particular type of authentication via a pluggable module, which implements the authentication algorithm and determines how the actual authentication is performed. Sun provides a few default LoginModule implementations, such as JndiLoginModule, Krb2LoginModule, UnixLoginModule, and NTLoginModule under the package of sun.com.security.auth .module. Since the JAAS login architecture is extensible, you can pretty much "plug in" any LoginModule just by specifying which LoginModule to use in the configuration file. An example of a configuration file looks like this:


MySample {
com.sample.module.MyLoginModule required debug=true;
};

Here MySample is the name of the login context, which is passed into the LoginContext constructor when you create a new LoginContext to start the authentication process, followed by the configuration block. The block informs JAAS about the loginModule that should be used to perform authentication during the login. In addition to the LoginModule, any options to that LoginModule can also be specified here.

During the login step, the CallbackHandler is used by LoginModule to communicate with the user to obtain authentication information. The CallbackHandler handles three types of Callbacks: NameCallback, which prompts the user for a user name; PasswordCallback, which prompts for a password; and TextOutputCallback, which reports any error, warning, or other messages sent to the user.

Authorization

Authorization is the process of determining whether an authenticated user is permitted to perform some actions, such as accessing a resource. The process is policy-based since JAAS is built on the existing Java security model. The policy configuration file essentially contains a list of entries, such as "keystore" and/or "grant". The grant entry includes all the permissions granted for the authenticated codes or principals to do the security-sensitive operations, for instance, accessing a particular Web page or local file. JAAS supports principal-based policy entry. Permissions can be granted in the policy to specific principals.

The basic format of a grant entry looks like this:

grant Codebase "codebase_URL" Signedby "signer_name,"
Principal principal_class_name "principal_name",
Principal principal_class_name "principal_name",
S {
permission permission_class_name "target_name", "action",
permission permission_class_name "target_name", "action",
S
}
The "action" may be required or can be omitted depending on the permission type.

In the JAAS architecture, the Policy object represents the system security policy for a Java application environment and there's only one Policy object in effect at any time according to the Java 2 SDK document. The default implementation of Policy is sun.security.provider.PolicyFile, in which the policies are specified within one or more policy configuration files.

Once the user is authenticated, the authorization takes place via the Subject.doAs method, or the static doAsPrivileged method from Subject class. The doAs method dynamically associates the subject with the current AccessControlContext and then invokes the run method to execute the action, which causes the security checks. The permission check process goes through the following steps illustrated in Figure 2:

  1. Invoke Subject.doAs (or doAsPrivileged).
  2. Call SecurityManager.checkPermission or other check methods to check the permission.
  3. The SecurityManager delegates the check to the AccessController.
  4. The AccessController ensures the relevant AccessControlContext contains sufficient permissions for the action to be taken.
  5. The SecurityManager updates the current AccessControlContext with the permissions granted to the subject via the Policy from the policy file.
If the required permission to a specific principal is granted, the operation will be allowed. Otherwise, an Access- ControlException will be thrown.

Like the LoginModule, the Policy is also a pluggable module. You can hook up other Policy implementations by changing "policy.provider=sun.security.provider.PolicyFile" in the java.security properties file to a value of the Policy class you want to use.

Extend JAAS
JAAS is built on top of the existing Java security model, which is CodeSource-based, and the plaintext format policy file implementation. This may not be enough for the enterprise application. You may want to use custom security repositories with JAAS, such as LDAP (lightweight directory access protocol), database, or another file system. It can be done by writing your own customized modules, thanks to the JAAS pluggable feature. However, this would require a good understanding of the modules and processes involved in JAAS, and you need to do a lot of coding to override the proper classes and take care of both the configure and policy files.

Ideally, we'd like to able to extend JAAS in an easier way so whenever a custom security repository or different access control mechanism changed or needed to add, you could just develop and plug in the different small modules (namely, the adapters) to accommodate these new changes or requirements, and best of all, without having to understand or know the details of the JAAS process. Also, we would like to be able to make this change simply by changing a configuration file. Another goal is that our JAAS extension component could be used in different J2EE applications - stand-alone or Web. Figure 3 outlines the design of our JAAS extension component.

Our JAAS extension component takes advantage of the JAAS pluggable architecture by implementing our customized LoginModule and Policy modules. In these modules, we delegate the data requests to the adapters. Each of these adapters is isolated to simple tasks such as data retrieval, so you can rapidly develop different adapters for different security repositories or algorithms instead of trying to implement different LoginModule or Policy modules, which are far more complex and require more effort.

You can download the complete source code from www.sys-con.com/java/sourcec.cfm".

AuthLoginModule
The AuthLoginModule class is our customized LoginModule implementation. The LoginModule is a pluggable component in the JAAS authentication process and serves two purposes:

  1. Authenticate the user.
  2. Update the Subject with relevant principals and credentials if authentication succeeded.
The LoginModule has five methods to implement. Let's look at the login () method. This method is called to authenticate the Subject and basically does two things:
  1. Obtains the user name and password. Typically, the LoginModule invokes the handle method of the CallbackHandler to get the user name and password.
  2. Verifies the password against the one in the data source.
The LoginModule retrieves the username and password from the Callbacks, which, by default, expect some sort of user interaction. This is fine for a simple demo program or on the command line, but it may not be practical for a J2EE application. For instance, for most Web applications, the user name and password will typically be read from a form. In this case, using JAAS authentication will be difficult. Considering we don't use LoginModule directly, the solution is to implement a customized CallbackHandler, which accepts a username and password and then delivers them to the LoginModule so it doesn't need to prompt the user for the information. Here's how the user information got passed from the JSP or servlet:

String userName = request.getParameter ("user");
String password = request.getParameter("password");
LoginContext context = new LoginContext ("MySample",
new AuthCallbackHandler (userName, password));

Once it has the user name and password at hand, the AuthLoginModule, our customized implementation of LoginModule, instantiates the LoginSourceAdapter via the LoginSourceAdapterFactory and delegates the actual authentication to the source adapter. The adapter is nothing more than a simple class, which pulls down the user information from a particular data source, such as database or LDAP, or some other system.

In the "commit" phase, the AuthloginModule retrieves the relevant information from the LoginSourceAdapter and associates them with the Subject.

LoginSourceAdapter
The LoginSourceAdapter is an interface of source adapter for the authentication. It has four methods for required implementations:

  1. void initialize (Hashtable parameters): The initialize method is called to initialize the adapter with the relevant parameters. The method is called immediately after object creation and prior to any calls to other methods.
  2. boolean authenticate (String userName, char[] password): The authenticate method is called to authenticate the user.
  3. String[] getGroupNames (String userName): The getGroupNames method is called to get the relevant principal information after authentication succeeded.
  4. void terminate (): This method is called when the logout method of LoginModule is invoked. It gives the adapter a chance to do some clean-up work.

The argument for the initialize method is the collection of a key-value pair. It could be the parameters for database connectivity, such as driver, URL, user ID, and password, or other information required for your adapter. You can specify these parameters in the configuration file, which I'll discuss later.

AuthPolicy
Under the JAAS architecture, the security policy is handled by the java.security.Policy class, which establishes the various Permissions granted to a particular CodeSource or Principal. As discussed in the previous section, the default implementation is sun.security.provider.PolicyFile. The PolicyFile uses the plaintext file to establish the mapping between permissions and CodeSource, which may not be good enough for the enterprise application. A centralized system such as a relational database for supporting role-base security would be better.

Obviously, to extend JAAS authorization to handle the different security schemes from different sources, we need to write our own Policy implementation.

The steps to create a customized Policy implementation are:

* Extend java.security.Policy.
* Implement getPermissions ().
* Implement refresh ().

If you look at the implementation of our customized Policy class, you may notice that our AuthPolicy class is derived from the sun.security.provider.PolicyFile instead of java.security .Policy. Why? First, I want to implement the AuthPolicy class as the generic Policy class, which can deal with the default policy file without any adapter plugged in. By deriving from the PolicyFile, we don't need to implement the policy file parsing and other related codes. Also, when the application is running with a Security- Manager enabled, a few permissions, such as doAsPrivileged AuthPermission and read FilePermission (for loading a configuration file), need to be granted in order to execute the JAAS. Sure, these permissions could be stored in the data source, but it might be convenient to put them in the standard Java security policy file. However, for serious development you should implement an adapter to deal with these issues.

Following the same design pattern in the extending authentication, our Policy class delegates the permission requests to the PermissionAdapter.

In the Permissions class, the different Permission is held in its own Permission- Collection instance. If you create a custom Permission class, you need to create your own PermissionCollection, otherwise there's no guarantee that your Permission object will be consulted.

PermissionAdapter
The PermissionAdapter is the interface of the pluggable module for authorization in our JAAS extension component. It evaluates the policy from a particular data source and delivers a PermissionCollection that contains a set of permissions granted. The PermissionAdapter interface has the following methods:

  • void initialize (Hashtable initParams): The initialize method is called to initialize the adapter with the relevant parameter. The method is called immediately and prior to any calls to other methods. Also, it's called when Policy's refresh is invoked.
  • PermissionCollection getPermissions (ProtectionDomain domain): This method is called whenever the Permissions with particular Principals is requested.
As an example, let's look at how to implement a role-based PermissionAdapter. Assume that there are three roles: admin, user, and guest all with different privileges, and all the permission information is stored in the database.

First, in the initialize method, we'll retrieve all the permission information for all roles from the database table and populate them in the collection, e.g., Hashtable.

Next, in the getPermissions method, we'll collect the permissions that relate to the involved Principals (this is the only concern for the role-based access control) and return them. Note that we can get relevant Principals by calling the getPrincipals method of ProtectedDomain. It's so simple, isn't it?

JaasUtil
JaasUtil is the main contact to our JAAS extension component, and it has a constructor that takes the user name and password. There are two key methods:

  1. boolean authenticate()
  2. boolean checkPermission(Subject subject, final Permission perm)
The JaasUtil actually defers the login request to LoginContext and the permission check to SecurityManager.

Listing 1 shows how to use JaasUtil. This code first gets the user name and password from the HttpServletRequest and tries to authenticate the user. Then it checks if this user has permission to access the "editReg.jsp".

Configuration
Now we have our customized implementations of the LoginModule, Policy, and other related modules. These modules can delegate the relevant data requests to the appropriate adapters; so far so good. However, in the JAAS architecture, the LoginModule and Policy are never directly invoked by the application, so how do we know which adapter should be instantiated and how to pass the necessary parameters or information, such as connectivity, to the adapters?

The answer is that the adapters can be dynamically configured by updating an XML configuration file. This XML configuration file consists of two major sections:

1. : This section defines the login source adapter and possible input parameters for authentication.
2. : This section defines the permission adapter and possible input parameters for authorization.

You can specify which LoginSourceAdapter and PermissionAdapter to use. It's also possible to pass additional information to the adapter in the configuration file.

There are two ways to let JaasUtil know where to look for the configuration file:

1. Specify the configuration file via the -Dcom.auth.config command-line switch.
2. Call JaasUtil.setConfigFile (configFile).

When you deploy the JAAS extension component, the customized security Policy class file must be added to Java's jre/lib directory, which will cause the policy class file to be loaded by the bootstrap class loader. Otherwise, it won't be picked up and the default policy class provided by Sun will be used instead, even though you placed the policy class file on the Java class path.

Summary
Extending JAAS is not difficult. The JAAS architecture provides you with the flexibility to customize the authentication and authorization processes. Understanding how these processes work is the first step in knowing how to "roll your own" implementation. In this article, we recalled the basics of the JAAS, and examined the details of how to extend JAAS to be a more dynamic, flexible, and scalable framework. With this extended framework, you can easily create your own login and access control mechanisms to support either your own enterprise-specific security requirements or emerging security standards, or leverage your existing or customized security models as the adapters, and then "plug" them into JAAS. This should provide a standard-based and highly customized authentication and authorization for your enterprise applications.

More Stories By Guosheng Huang

Guosheng Huang, PhD, is a senior software developer with Wysdom Inc.
He has over 15 years of experience in software engineering and
technical architecture.

Comments (7) View Comments

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


Most Recent Comments
Laurent DUTHEIL 06/07/05 10:57:55 AM EDT

Hello,

I'm very interested about your article.
But the source are not available anymore.
Where can we donload them ?

Thank you.
Laurent.

Jon Lee 02/10/05 09:30:07 PM EST

Dr. Huang,

Thank you writing this informative article.

Contrarily to Maciek Kolesnik and Greg Bishop's opinion, this article is very helpful and useful in understanding JAAS.

The usefulness of understanding JAAS further is now proven when Sun included JAAS in J2SE and J2EE.

Why does this article's helpfulness have anything to do with MS Exchange? So, does it mean only associating with MS Exchange will be helpful? I don't think so.

I think Dr. Huang has already shown that JAAS is easy to extend. So, JAAS can be intergrated with other systems by creating your customized LoginModule.

Peace,
Jon

Nitin Bhavsar 12/08/04 04:54:51 AM EST

1. The article is interesting and nice with simple language. There are plenty of articles on JAAS but still I had many use-case related basic questions. The article helped me understand it (though not fully)...
2. Where are the figures?
3. Where is the listing?
4. The download source took me to the archives page with 100s of links. :(

Thomas Nietsch 07/02/04 05:51:16 AM EDT

Where are the figures?

Greg Bishop 05/10/04 10:27:38 AM EDT

This is not helpful because it does not discuss implementation in an existing security architecture and integration with existing security mechanisms like MS Exchange, etc.

If I wanted to roll my own anything, I sure wouldn''t start with somehting as common as a security architecture.

maciek kolesnik 10/23/03 09:09:05 AM EDT

I think it would really be worthwhile to mention challenges and opportunities that JAAS presents when implementing it in a real J2EE environment (with filters, servlets, EJBs, resource adapters, etc.). There is a talk of adapting JAAS authentication/access control mechanisms in the upcoming J2EE revisions. I'd be interesting in hearing author's opinion on this, otherwise this article probably fits more in the J2SE column :-)

Maciek

Bruce Steely 10/07/03 05:02:10 PM EDT

Where is Listing 1?

@ThingsExpo Stories
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, whic...
BnkToTheFuture.com is the largest online investment platform for investing in FinTech, Bitcoin and Blockchain companies. We believe the future of finance looks very different from the past and we aim to invest and provide trading opportunities for qualifying investors that want to build a portfolio in the sector in compliance with international financial regulations.
Imagine if you will, a retail floor so densely packed with sensors that they can pick up the movements of insects scurrying across a store aisle. Or a component of a piece of factory equipment so well-instrumented that its digital twin provides resolution down to the micrometer.
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, provided an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life settle...
Product connectivity goes hand and hand these days with increased use of personal data. New IoT devices are becoming more personalized than ever before. In his session at 22nd Cloud Expo | DXWorld Expo, Nicolas Fierro, CEO of MIMIR Blockchain Solutions, will discuss how in order to protect your data and privacy, IoT applications need to embrace Blockchain technology for a new level of product security never before seen - or needed.
Leading companies, from the Global Fortune 500 to the smallest companies, are adopting hybrid cloud as the path to business advantage. Hybrid cloud depends on cloud services and on-premises infrastructure working in unison. Successful implementations require new levels of data mobility, enabled by an automated and seamless flow across on-premises and cloud resources. In his general session at 21st Cloud Expo, Greg Tevis, an IBM Storage Software Technical Strategist and Customer Solution Architec...
Nordstrom is transforming the way that they do business and the cloud is the key to enabling speed and hyper personalized customer experiences. In his session at 21st Cloud Expo, Ken Schow, VP of Engineering at Nordstrom, discussed some of the key learnings and common pitfalls of large enterprises moving to the cloud. This includes strategies around choosing a cloud provider(s), architecture, and lessons learned. In addition, he covered some of the best practices for structured team migration an...
No hype cycles or predictions of a gazillion things here. IoT is here. You get it. You know your business and have great ideas for a business transformation strategy. What comes next? Time to make it happen. In his session at @ThingsExpo, Jay Mason, an Associate Partner of Analytics, IoT & Cybersecurity at M&S Consulting, presented a step-by-step plan to develop your technology implementation strategy. He also discussed the evaluation of communication standards and IoT messaging protocols, data...
Coca-Cola’s Google powered digital signage system lays the groundwork for a more valuable connection between Coke and its customers. Digital signs pair software with high-resolution displays so that a message can be changed instantly based on what the operator wants to communicate or sell. In their Day 3 Keynote at 21st Cloud Expo, Greg Chambers, Global Group Director, Digital Innovation, Coca-Cola, and Vidya Nagarajan, a Senior Product Manager at Google, discussed how from store operations and ...
In his session at 21st Cloud Expo, Raju Shreewastava, founder of Big Data Trunk, provided a fun and simple way to introduce Machine Leaning to anyone and everyone. He solved a machine learning problem and demonstrated an easy way to be able to do machine learning without even coding. Raju Shreewastava is the founder of Big Data Trunk (www.BigDataTrunk.com), a Big Data Training and consulting firm with offices in the United States. He previously led the data warehouse/business intelligence and B...
"IBM is really all in on blockchain. We take a look at sort of the history of blockchain ledger technologies. It started out with bitcoin, Ethereum, and IBM evaluated these particular blockchain technologies and found they were anonymous and permissionless and that many companies were looking for permissioned blockchain," stated René Bostic, Technical VP of the IBM Cloud Unit in North America, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Conventi...
When shopping for a new data processing platform for IoT solutions, many development teams want to be able to test-drive options before making a choice. Yet when evaluating an IoT solution, it’s simply not feasible to do so at scale with physical devices. Building a sensor simulator is the next best choice; however, generating a realistic simulation at very high TPS with ease of configurability is a formidable challenge. When dealing with multiple application or transport protocols, you would be...
Smart cities have the potential to change our lives at so many levels for citizens: less pollution, reduced parking obstacles, better health, education and more energy savings. Real-time data streaming and the Internet of Things (IoT) possess the power to turn this vision into a reality. However, most organizations today are building their data infrastructure to focus solely on addressing immediate business needs vs. a platform capable of quickly adapting emerging technologies to address future ...
We are given a desktop platform with Java 8 or Java 9 installed and seek to find a way to deploy high-performance Java applications that use Java 3D and/or Jogl without having to run an installer. We are subject to the constraint that the applications be signed and deployed so that they can be run in a trusted environment (i.e., outside of the sandbox). Further, we seek to do this in a way that does not depend on bundling a JRE with our applications, as this makes downloads and installations rat...
Widespread fragmentation is stalling the growth of the IIoT and making it difficult for partners to work together. The number of software platforms, apps, hardware and connectivity standards is creating paralysis among businesses that are afraid of being locked into a solution. EdgeX Foundry is unifying the community around a common IoT edge framework and an ecosystem of interoperable components.
DX World EXPO, LLC, a Lighthouse Point, Florida-based startup trade show producer and the creator of "DXWorldEXPO® - Digital Transformation Conference & Expo" has announced its executive management team. The team is headed by Levent Selamoglu, who has been named CEO. "Now is the time for a truly global DX event, to bring together the leading minds from the technology world in a conversation about Digital Transformation," he said in making the announcement.
In this strange new world where more and more power is drawn from business technology, companies are effectively straddling two paths on the road to innovation and transformation into digital enterprises. The first path is the heritage trail – with “legacy” technology forming the background. Here, extant technologies are transformed by core IT teams to provide more API-driven approaches. Legacy systems can restrict companies that are transitioning into digital enterprises. To truly become a lead...
Digital Transformation (DX) is not a "one-size-fits all" strategy. Each organization needs to develop its own unique, long-term DX plan. It must do so by realizing that we now live in a data-driven age, and that technologies such as Cloud Computing, Big Data, the IoT, Cognitive Computing, and Blockchain are only tools. In her general session at 21st Cloud Expo, Rebecca Wanta explained how the strategy must focus on DX and include a commitment from top management to create great IT jobs, monitor ...
"Cloud Academy is an enterprise training platform for the cloud, specifically public clouds. We offer guided learning experiences on AWS, Azure, Google Cloud and all the surrounding methodologies and technologies that you need to know and your teams need to know in order to leverage the full benefits of the cloud," explained Alex Brower, VP of Marketing at Cloud Academy, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clar...
The IoT Will Grow: In what might be the most obvious prediction of the decade, the IoT will continue to expand next year, with more and more devices coming online every single day. What isn’t so obvious about this prediction: where that growth will occur. The retail, healthcare, and industrial/supply chain industries will likely see the greatest growth. Forrester Research has predicted the IoT will become “the backbone” of customer value as it continues to grow. It is no surprise that retail is ...