|By Guosheng Huang||
|September 1, 2003 12:00 AM EDT||
With the upcoming release of J2SE 1.5, which includes a lot of enhancements to cryptography, XML security, Public Key Infrastructure (PKI), Kerberos, and the federating identity, the JAAS will play a more important role in J2EE security implementations.
Overview of JAAS
Authentication is the process of verifying that a user has the right to use identities established by the enterprise user registry. The authentication mechanism of JAAS is built on a set of pluggable modules (see Figure 1). JAAS allows different authentication models to be plugged in at runtime. The client applications always interact with JAAS through the LoginContext object.
The authentication process typically involves the following steps:
- Create a LoginContext object. The LoginContext looks up the configuration file to determine which LoginModule to use. Also, optionally, you can pass a CallbackHandler to the LoginContext.
- Perform authentication by calling the login method of LoginContext, which loads the predefined LoginModule to check if the user can be authenticated.
- Associate principals and credentials with the Subject if the user is authenticated.
- Or throw a LoginException in case login failed.
- Use the logout method of LoginContext to log out.
A Subject in JAAS represents an authenticated entity, such as a person or device. It contains a set of principals and security-related attributes such as a password and cryptographic keys. In the JAAS architecture, the Subject, along with the Permission, plays an important role in the authorization process.
Of all the authentication modules, the LoginModule is the interface to a particular authentication mechanism. Although the LoginModule never gets called directly by the client application, it provides a particular type of authentication via a pluggable module, which implements the authentication algorithm and determines how the actual authentication is performed. Sun provides a few default LoginModule implementations, such as JndiLoginModule, Krb2LoginModule, UnixLoginModule, and NTLoginModule under the package of sun.com.security.auth .module. Since the JAAS login architecture is extensible, you can pretty much "plug in" any LoginModule just by specifying which LoginModule to use in the configuration file. An example of a configuration file looks like this:
com.sample.module.MyLoginModule required debug=true;
Here MySample is the name of the login context, which is passed into the LoginContext constructor when you create a new LoginContext to start the authentication process, followed by the configuration block. The block informs JAAS about the loginModule that should be used to perform authentication during the login. In addition to the LoginModule, any options to that LoginModule can also be specified here.
During the login step, the CallbackHandler is used by LoginModule to communicate with the user to obtain authentication information. The CallbackHandler handles three types of Callbacks: NameCallback, which prompts the user for a user name; PasswordCallback, which prompts for a password; and TextOutputCallback, which reports any error, warning, or other messages sent to the user.
Authorization is the process of determining whether an authenticated user is permitted to perform some actions, such as accessing a resource. The process is policy-based since JAAS is built on the existing Java security model. The policy configuration file essentially contains a list of entries, such as "keystore" and/or "grant". The grant entry includes all the permissions granted for the authenticated codes or principals to do the security-sensitive operations, for instance, accessing a particular Web page or local file. JAAS supports principal-based policy entry. Permissions can be granted in the policy to specific principals.
The basic format of a grant entry looks like this:
grant Codebase "codebase_URL" Signedby "signer_name,"The "action" may be required or can be omitted depending on the permission type.
Principal principal_class_name "principal_name",
Principal principal_class_name "principal_name",
permission permission_class_name "target_name", "action",
permission permission_class_name "target_name", "action",
In the JAAS architecture, the Policy object represents the system security policy for a Java application environment and there's only one Policy object in effect at any time according to the Java 2 SDK document. The default implementation of Policy is sun.security.provider.PolicyFile, in which the policies are specified within one or more policy configuration files.
Once the user is authenticated, the authorization takes place via the Subject.doAs method, or the static doAsPrivileged method from Subject class. The doAs method dynamically associates the subject with the current AccessControlContext and then invokes the run method to execute the action, which causes the security checks. The permission check process goes through the following steps illustrated in Figure 2:
- Invoke Subject.doAs (or doAsPrivileged).
- Call SecurityManager.checkPermission or other check methods to check the permission.
- The SecurityManager delegates the check to the AccessController.
- The AccessController ensures the relevant AccessControlContext contains sufficient permissions for the action to be taken.
- The SecurityManager updates the current AccessControlContext with the permissions granted to the subject via the Policy from the policy file.
Like the LoginModule, the Policy is also a pluggable module. You can hook up other Policy implementations by changing "policy.provider=sun.security.provider.PolicyFile" in the java.security properties file to a value of the Policy class you want to use.
JAAS is built on top of the existing Java security model, which is CodeSource-based, and the plaintext format policy file implementation. This may not be enough for the enterprise application. You may want to use custom security repositories with JAAS, such as LDAP (lightweight directory access protocol), database, or another file system. It can be done by writing your own customized modules, thanks to the JAAS pluggable feature. However, this would require a good understanding of the modules and processes involved in JAAS, and you need to do a lot of coding to override the proper classes and take care of both the configure and policy files.
Ideally, we'd like to able to extend JAAS in an easier way so whenever a custom security repository or different access control mechanism changed or needed to add, you could just develop and plug in the different small modules (namely, the adapters) to accommodate these new changes or requirements, and best of all, without having to understand or know the details of the JAAS process. Also, we would like to be able to make this change simply by changing a configuration file. Another goal is that our JAAS extension component could be used in different J2EE applications - stand-alone or Web. Figure 3 outlines the design of our JAAS extension component.
Our JAAS extension component takes advantage of the JAAS pluggable architecture by implementing our customized LoginModule and Policy modules. In these modules, we delegate the data requests to the adapters. Each of these adapters is isolated to simple tasks such as data retrieval, so you can rapidly develop different adapters for different security repositories or algorithms instead of trying to implement different LoginModule or Policy modules, which are far more complex and require more effort.
You can download the complete source code from www.sys-con.com/java/sourcec.cfm".
The AuthLoginModule class is our customized LoginModule implementation. The LoginModule is a pluggable component in the JAAS authentication process and serves two purposes:
- Authenticate the user.
- Update the Subject with relevant principals and credentials if authentication succeeded.
- Obtains the user name and password. Typically, the LoginModule invokes the handle method of the CallbackHandler to get the user name and password.
- Verifies the password against the one in the data source.
Once it has the user name and password at hand, the AuthLoginModule, our customized implementation of LoginModule, instantiates the LoginSourceAdapter via the LoginSourceAdapterFactory and delegates the actual authentication to the source adapter. The adapter is nothing more than a simple class, which pulls down the user information from a particular data source, such as database or LDAP, or some other system.
String userName = request.getParameter ("user");
String password = request.getParameter("password");
LoginContext context = new LoginContext ("MySample",
new AuthCallbackHandler (userName, password));
In the "commit" phase, the AuthloginModule retrieves the relevant information from the LoginSourceAdapter and associates them with the Subject.
The LoginSourceAdapter is an interface of source adapter for the authentication. It has four methods for required implementations:
- void initialize (Hashtable parameters): The initialize method is called to initialize the adapter with the relevant parameters. The method is called immediately after object creation and prior to any calls to other methods.
- boolean authenticate (String userName, char password): The authenticate method is called to authenticate the user.
- String getGroupNames (String userName): The getGroupNames method is called to get the relevant principal information after authentication succeeded.
- void terminate (): This method is called when the logout method of LoginModule is invoked. It gives the adapter a chance to do some clean-up work.
The argument for the initialize method is the collection of a key-value pair. It could be the parameters for database connectivity, such as driver, URL, user ID, and password, or other information required for your adapter. You can specify these parameters in the configuration file, which I'll discuss later.
Under the JAAS architecture, the security policy is handled by the java.security.Policy class, which establishes the various Permissions granted to a particular CodeSource or Principal. As discussed in the previous section, the default implementation is sun.security.provider.PolicyFile. The PolicyFile uses the plaintext file to establish the mapping between permissions and CodeSource, which may not be good enough for the enterprise application. A centralized system such as a relational database for supporting role-base security would be better.
Obviously, to extend JAAS authorization to handle the different security schemes from different sources, we need to write our own Policy implementation.
The steps to create a customized Policy implementation are:
* Extend java.security.Policy.
* Implement getPermissions ().
* Implement refresh ().
If you look at the implementation of our customized Policy class, you may notice that our AuthPolicy class is derived from the sun.security.provider.PolicyFile instead of java.security .Policy. Why? First, I want to implement the AuthPolicy class as the generic Policy class, which can deal with the default policy file without any adapter plugged in. By deriving from the PolicyFile, we don't need to implement the policy file parsing and other related codes. Also, when the application is running with a Security- Manager enabled, a few permissions, such as doAsPrivileged AuthPermission and read FilePermission (for loading a configuration file), need to be granted in order to execute the JAAS. Sure, these permissions could be stored in the data source, but it might be convenient to put them in the standard Java security policy file. However, for serious development you should implement an adapter to deal with these issues.
Following the same design pattern in the extending authentication, our Policy class delegates the permission requests to the PermissionAdapter.
In the Permissions class, the different Permission is held in its own Permission- Collection instance. If you create a custom Permission class, you need to create your own PermissionCollection, otherwise there's no guarantee that your Permission object will be consulted.
The PermissionAdapter is the interface of the pluggable module for authorization in our JAAS extension component. It evaluates the policy from a particular data source and delivers a PermissionCollection that contains a set of permissions granted. The PermissionAdapter interface has the following methods:
- void initialize (Hashtable initParams): The initialize method is called to initialize the adapter with the relevant parameter. The method is called immediately and prior to any calls to other methods. Also, it's called when Policy's refresh is invoked.
- PermissionCollection getPermissions (ProtectionDomain domain): This method is called whenever the Permissions with particular Principals is requested.
First, in the initialize method, we'll retrieve all the permission information for all roles from the database table and populate them in the collection, e.g., Hashtable.
Next, in the getPermissions method, we'll collect the permissions that relate to the involved Principals (this is the only concern for the role-based access control) and return them. Note that we can get relevant Principals by calling the getPrincipals method of ProtectedDomain. It's so simple, isn't it?
JaasUtil is the main contact to our JAAS extension component, and it has a constructor that takes the user name and password. There are two key methods:
- boolean authenticate()
- boolean checkPermission(Subject subject, final Permission perm)
Listing 1 shows how to use JaasUtil. This code first gets the user name and password from the HttpServletRequest and tries to authenticate the user. Then it checks if this user has permission to access the "editReg.jsp".
Now we have our customized implementations of the LoginModule, Policy, and other related modules. These modules can delegate the relevant data requests to the appropriate adapters; so far so good. However, in the JAAS architecture, the LoginModule and Policy are never directly invoked by the application, so how do we know which adapter should be instantiated and how to pass the necessary parameters or information, such as connectivity, to the adapters?
The answer is that the adapters can be dynamically configured by updating an XML configuration file. This XML configuration file consists of two major sections:
You can specify which LoginSourceAdapter and
PermissionAdapter to use. It's also possible to pass additional
information to the adapter in the configuration file.
There are two ways to let JaasUtil know where to look for the
1. Specify the configuration file via the -Dcom.auth.config
When you deploy the JAAS extension component, the customized
security Policy class file must be added to Java's jre/lib directory,
which will cause the policy class file to be loaded by the bootstrap
class loader. Otherwise, it won't be picked up and the default policy
class provided by Sun will be used instead, even though you placed
the policy class file on the Java class path.
2. Call JaasUtil.setConfigFile (configFile).
Extending JAAS is not difficult. The JAAS architecture provides you with the flexibility to customize the authentication and authorization processes. Understanding how these processes work is the first step in knowing how to "roll your own" implementation. In this article, we recalled the basics of the JAAS, and examined the details of how to extend JAAS to be a more dynamic, flexible, and scalable framework. With this extended framework, you can easily create your own login and access control mechanisms to support either your own enterprise-specific security requirements or emerging security standards, or leverage your existing or customized security models as the adapters, and then "plug" them into JAAS. This should provide a standard-based and highly customized authentication and authorization for your enterprise applications.
You can specify which LoginSourceAdapter and PermissionAdapter to use. It's also possible to pass additional information to the adapter in the configuration file.
There are two ways to let JaasUtil know where to look for the configuration file:
1. Specify the configuration file via the -Dcom.auth.config
When you deploy the JAAS extension component, the customized security Policy class file must be added to Java's jre/lib directory, which will cause the policy class file to be loaded by the bootstrap class loader. Otherwise, it won't be picked up and the default policy class provided by Sun will be used instead, even though you placed the policy class file on the Java class path.
|Laurent DUTHEIL 06/07/05 10:57:55 AM EDT|
I'm very interested about your article.
|Jon Lee 02/10/05 09:30:07 PM EST|
Thank you writing this informative article.
Contrarily to Maciek Kolesnik and Greg Bishop's opinion, this article is very helpful and useful in understanding JAAS.
The usefulness of understanding JAAS further is now proven when Sun included JAAS in J2SE and J2EE.
Why does this article's helpfulness have anything to do with MS Exchange? So, does it mean only associating with MS Exchange will be helpful? I don't think so.
I think Dr. Huang has already shown that JAAS is easy to extend. So, JAAS can be intergrated with other systems by creating your customized LoginModule.
|Nitin Bhavsar 12/08/04 04:54:51 AM EST|
1. The article is interesting and nice with simple language. There are plenty of articles on JAAS but still I had many use-case related basic questions. The article helped me understand it (though not fully)...
|Thomas Nietsch 07/02/04 05:51:16 AM EDT|
Where are the figures?
|Greg Bishop 05/10/04 10:27:38 AM EDT|
This is not helpful because it does not discuss implementation in an existing security architecture and integration with existing security mechanisms like MS Exchange, etc.
If I wanted to roll my own anything, I sure wouldn''t start with somehting as common as a security architecture.
|maciek kolesnik 10/23/03 09:09:05 AM EDT|
I think it would really be worthwhile to mention challenges and opportunities that JAAS presents when implementing it in a real J2EE environment (with filters, servlets, EJBs, resource adapters, etc.). There is a talk of adapting JAAS authentication/access control mechanisms in the upcoming J2EE revisions. I'd be interesting in hearing author's opinion on this, otherwise this article probably fits more in the J2SE column :-)
|Bruce Steely 10/07/03 05:02:10 PM EDT|
Where is Listing 1?
The BPM world is going through some evolution or changes where traditional business process management solutions really have nowhere to go in terms of development of the road map. In this demo at 15th Cloud Expo, Kyle Hansen, Director of Professional Services at AgilePoint, shows AgilePoint’s unique approach to dealing with this market circumstance by developing a rapid application composition or development framework.
Dec. 20, 2014 01:00 PM EST Reads: 1,622
ARMONK, N.Y., Nov. 20, 2014 /PRNewswire/ -- IBM (NYSE: IBM) today announced that it is bringing a greater level of control, security and flexibility to cloud-based application development and delivery with a single-tenant version of Bluemix, IBM's platform-as-a-service. The new platform enables developers to build ap...
Dec. 20, 2014 12:30 PM EST Reads: 3,136
"BSQUARE is in the business of selling software solutions for smart connected devices. It's obvious that IoT has moved from being a technology to being a fundamental part of business, and in the last 18 months people have said let's figure out how to do it and let's put some focus on it, " explained Dave Wagstaff, VP & Chief Architect, at BSQUARE Corporation, in this SYS-CON.tv interview at @ThingsExpo, held Nov 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
Dec. 20, 2014 12:00 PM EST Reads: 2,480
The major cloud platforms defy a simple, side-by-side analysis. Each of the major IaaS public-cloud platforms offers their own unique strengths and functionality. Options for on-site private cloud are diverse as well, and must be designed and deployed while taking existing legacy architecture and infrastructure into account. Then the reality is that most enterprises are embarking on a hybrid cloud strategy and programs. In this Power Panel at 15th Cloud Expo (http://www.CloudComputingExpo.com), moderated by Ashar Baig, Research Director, Cloud, at Gigaom Research, Nate Gordon, Director of T...
Dec. 20, 2014 11:30 AM EST Reads: 3,016
The Internet of Things is not new. Historically, smart businesses have used its basic concept of leveraging data to drive better decision making and have capitalized on those insights to realize additional revenue opportunities. So, what has changed to make the Internet of Things one of the hottest topics in tech? In his session at @ThingsExpo, Chris Gray, Director, Embedded and Internet of Things, discussed the underlying factors that are driving the economics of intelligent systems. Discover how hardware commoditization, the ubiquitous nature of connectivity, and the emergence of Big Data a...
Dec. 20, 2014 11:00 AM EST Reads: 2,856
SYS-CON Events announced today that Windstream, a leading provider of advanced network and cloud communications, has been named “Silver Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9–11, 2015, at the Javits Center in New York, NY. Windstream (Nasdaq: WIN), a FORTUNE 500 and S&P 500 company, is a leading provider of advanced network communications, including cloud computing and managed services, to businesses nationwide. The company also offers broadband, phone and digital TV services to consumers primarily in rural areas.
Dec. 20, 2014 10:45 AM EST Reads: 2,824
“In the past year we've seen a lot of stabilization of WebRTC. You can now use it in production with a far greater degree of certainty. A lot of the real developments in the past year have been in things like the data channel, which will enable a whole new type of application," explained Peter Dunkley, Technical Director at Acision, in this SYS-CON.tv interview at @ThingsExpo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
Dec. 20, 2014 08:00 AM EST Reads: 2,064
SYS-CON Events announced today that IDenticard will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. IDenticard™ is the security division of Brady Corp (NYSE: BRC), a $1.5 billion manufacturer of identification products. We have small-company values with the strength and stability of a major corporation. IDenticard offers local sales, support and service to our customers across the United States and Canada. Our partner network encompasses some 300 of the world's leading systems integrators and security s...
Dec. 20, 2014 07:00 AM EST Reads: 2,605
DevOps Summit 2015 New York, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that it is now accepting Keynote Proposals. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long development cycles that produce software that is obsolete at launch. DevOps may be disruptive, but it is essential.
Dec. 18, 2014 09:45 PM EST Reads: 1,784
"People are a lot more knowledgeable about APIs now. There are two types of people who work with APIs - IT people who want to use APIs for something internal and the product managers who want to do something outside APIs for people to connect to them," explained Roberto Medrano, Executive Vice President at SOA Software, in this SYS-CON.tv interview at Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
Dec. 18, 2014 09:00 AM EST Reads: 2,242
Nigeria has the largest economy in Africa, at more than US$500 billion, and ranks 23rd in the world. A recent re-evaluation of Nigeria's true economic size doubled the previous estimate, and brought it well ahead of South Africa, which is a member (unlike Nigeria) of the G20 club for political as well as economic reasons. Nigeria's economy can be said to be quite diverse from one point of view, but heavily dependent on oil and gas at the same time. Oil and natural gas account for about 15% of Nigera's overall economy, but traditionally represent more than 90% of the country's exports and as...
Dec. 18, 2014 06:00 AM EST Reads: 1,307
The Internet of Things is a misnomer. That implies that everything is on the Internet, and that simply should not be - especially for things that are blurring the line between medical devices that stimulate like a pacemaker and quantified self-sensors like a pedometer or pulse tracker. The mesh of things that we manage must be segmented into zones of trust for sensing data, transmitting data, receiving command and control administrative changes, and peer-to-peer mesh messaging. In his session at @ThingsExpo, Ryan Bagnulo, Solution Architect / Software Engineer at SOA Software, focused on desi...
Dec. 17, 2014 11:15 PM EST Reads: 2,209
"At our booth we are showing how to provide trust in the Internet of Things. Trust is where everything starts to become secure and trustworthy. Now with the scaling of the Internet of Things it becomes an interesting question – I've heard numbers from 200 billion devices next year up to a trillion in the next 10 to 15 years," explained Johannes Lintzen, Vice President of Sales at Utimaco, in this SYS-CON.tv interview at @ThingsExpo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
Dec. 17, 2014 11:00 PM EST Reads: 2,223
"For over 25 years we have been working with a lot of enterprise customers and we have seen how companies create applications. And now that we have moved to cloud computing, mobile, social and the Internet of Things, we see that the market needs a new way of creating applications," stated Jesse Shiah, CEO, President and Co-Founder of AgilePoint Inc., in this SYS-CON.tv interview at 15th Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
Dec. 17, 2014 08:00 PM EST Reads: 2,224
SYS-CON Events announced today that Gridstore™, the leader in hyper-converged infrastructure purpose-built to optimize Microsoft workloads, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Gridstore™ is the leader in hyper-converged infrastructure purpose-built for Microsoft workloads and designed to accelerate applications in virtualized environments. Gridstore’s hyper-converged infrastructure is the industry’s first all flash version of HyperConverged Appliances that include both compute and storag...
Dec. 17, 2014 06:30 PM EST Reads: 2,140
Today’s enterprise is being driven by disruptive competitive and human capital requirements to provide enterprise application access through not only desktops, but also mobile devices. To retrofit existing programs across all these devices using traditional programming methods is very costly and time consuming – often prohibitively so. In his session at @ThingsExpo, Jesse Shiah, CEO, President, and Co-Founder of AgilePoint Inc., discussed how you can create applications that run on all mobile devices as well as laptops and desktops using a visual drag-and-drop application – and eForms-buildi...
Dec. 17, 2014 11:45 AM EST Reads: 2,319
We certainly live in interesting technological times. And no more interesting than the current competing IoT standards for connectivity. Various standards bodies, approaches, and ecosystems are vying for mindshare and positioning for a competitive edge. It is clear that when the dust settles, we will have new protocols, evolved protocols, that will change the way we interact with devices and infrastructure. We will also have evolved web protocols, like HTTP/2, that will be changing the very core of our infrastructures. At the same time, we have old approaches made new again like micro-services...
Dec. 16, 2014 11:45 PM EST Reads: 2,188
Code Halos - aka "digital fingerprints" - are the key organizing principle to understand a) how dumb things become smart and b) how to monetize this dynamic. In his session at @ThingsExpo, Robert Brown, AVP, Center for the Future of Work at Cognizant Technology Solutions, outlined research, analysis and recommendations from his recently published book on this phenomena on the way leading edge organizations like GE and Disney are unlocking the Internet of Things opportunity and what steps your organization should be taking to position itself for the next platform of digital competition.
Dec. 15, 2014 11:45 PM EST Reads: 2,595
The 3rd International Internet of @ThingsExpo, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that its Call for Papers is now open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than 20 years ago.
Dec. 15, 2014 10:30 AM EST Reads: 8,188
As the Internet of Things unfolds, mobile and wearable devices are blurring the line between physical and digital, integrating ever more closely with our interests, our routines, our daily lives. Contextual computing and smart, sensor-equipped spaces bring the potential to walk through a world that recognizes us and responds accordingly. We become continuous transmitters and receivers of data. In his session at @ThingsExpo, Andrew Bolwell, Director of Innovation for HP's Printing and Personal Systems Group, discussed how key attributes of mobile technology – touch input, sensors, social, and ...
Dec. 15, 2014 10:00 AM EST Reads: 3,316