Welcome!

Java IoT Authors: Pat Romanski, Elizabeth White, Liz McMillan, Carmen Gonzalez, Yeshim Deniz

Related Topics: Java IoT

Java IoT: Article

Extending JAAS

Extending JAAS

User authentication and access control are important security measures for most Java applications, especially J2EE applications. The Java Authentication and Authorization Service (JAAS), the core API of J2SE 1.4 and 1.5, represents the new security standard. It provides a pluggable and flexible framework that allows developers to incorporate different security mechanisms and various security sources.

With the upcoming release of J2SE 1.5, which includes a lot of enhancements to cryptography, XML security, Public Key Infrastructure (PKI), Kerberos, and the federating identity, the JAAS will play a more important role in J2EE security implementations.

Overview of JAAS
Authentication

Authentication is the process of verifying that a user has the right to use identities established by the enterprise user registry. The authentication mechanism of JAAS is built on a set of pluggable modules (see Figure 1). JAAS allows different authentication models to be plugged in at runtime. The client applications always interact with JAAS through the LoginContext object.

The authentication process typically involves the following steps:

  1. Create a LoginContext object. The LoginContext looks up the configuration file to determine which LoginModule to use. Also, optionally, you can pass a CallbackHandler to the LoginContext.
  2. Perform authentication by calling the login method of LoginContext, which loads the predefined LoginModule to check if the user can be authenticated.
  3. Associate principals and credentials with the Subject if the user is authenticated.
  4. Or throw a LoginException in case login failed.
  5. Use the logout method of LoginContext to log out.
The login in JAAS is a two-phase process. The first phase is the "login" phase (as described in step 2). The only task in this phase is authentication. Once the process successfully passes this phase, the authentication process enters the "commit" phase (step 3) in which the commit method of LoginModule is called to associate the relevant principals and credentials with the Subject.

A Subject in JAAS represents an authenticated entity, such as a person or device. It contains a set of principals and security-related attributes such as a password and cryptographic keys. In the JAAS architecture, the Subject, along with the Permission, plays an important role in the authorization process.

Of all the authentication modules, the LoginModule is the interface to a particular authentication mechanism. Although the LoginModule never gets called directly by the client application, it provides a particular type of authentication via a pluggable module, which implements the authentication algorithm and determines how the actual authentication is performed. Sun provides a few default LoginModule implementations, such as JndiLoginModule, Krb2LoginModule, UnixLoginModule, and NTLoginModule under the package of sun.com.security.auth .module. Since the JAAS login architecture is extensible, you can pretty much "plug in" any LoginModule just by specifying which LoginModule to use in the configuration file. An example of a configuration file looks like this:


MySample {
com.sample.module.MyLoginModule required debug=true;
};

Here MySample is the name of the login context, which is passed into the LoginContext constructor when you create a new LoginContext to start the authentication process, followed by the configuration block. The block informs JAAS about the loginModule that should be used to perform authentication during the login. In addition to the LoginModule, any options to that LoginModule can also be specified here.

During the login step, the CallbackHandler is used by LoginModule to communicate with the user to obtain authentication information. The CallbackHandler handles three types of Callbacks: NameCallback, which prompts the user for a user name; PasswordCallback, which prompts for a password; and TextOutputCallback, which reports any error, warning, or other messages sent to the user.

Authorization

Authorization is the process of determining whether an authenticated user is permitted to perform some actions, such as accessing a resource. The process is policy-based since JAAS is built on the existing Java security model. The policy configuration file essentially contains a list of entries, such as "keystore" and/or "grant". The grant entry includes all the permissions granted for the authenticated codes or principals to do the security-sensitive operations, for instance, accessing a particular Web page or local file. JAAS supports principal-based policy entry. Permissions can be granted in the policy to specific principals.

The basic format of a grant entry looks like this:

grant Codebase "codebase_URL" Signedby "signer_name,"
Principal principal_class_name "principal_name",
Principal principal_class_name "principal_name",
S {
permission permission_class_name "target_name", "action",
permission permission_class_name "target_name", "action",
S
}
The "action" may be required or can be omitted depending on the permission type.

In the JAAS architecture, the Policy object represents the system security policy for a Java application environment and there's only one Policy object in effect at any time according to the Java 2 SDK document. The default implementation of Policy is sun.security.provider.PolicyFile, in which the policies are specified within one or more policy configuration files.

Once the user is authenticated, the authorization takes place via the Subject.doAs method, or the static doAsPrivileged method from Subject class. The doAs method dynamically associates the subject with the current AccessControlContext and then invokes the run method to execute the action, which causes the security checks. The permission check process goes through the following steps illustrated in Figure 2:

  1. Invoke Subject.doAs (or doAsPrivileged).
  2. Call SecurityManager.checkPermission or other check methods to check the permission.
  3. The SecurityManager delegates the check to the AccessController.
  4. The AccessController ensures the relevant AccessControlContext contains sufficient permissions for the action to be taken.
  5. The SecurityManager updates the current AccessControlContext with the permissions granted to the subject via the Policy from the policy file.
If the required permission to a specific principal is granted, the operation will be allowed. Otherwise, an Access- ControlException will be thrown.

Like the LoginModule, the Policy is also a pluggable module. You can hook up other Policy implementations by changing "policy.provider=sun.security.provider.PolicyFile" in the java.security properties file to a value of the Policy class you want to use.

Extend JAAS
JAAS is built on top of the existing Java security model, which is CodeSource-based, and the plaintext format policy file implementation. This may not be enough for the enterprise application. You may want to use custom security repositories with JAAS, such as LDAP (lightweight directory access protocol), database, or another file system. It can be done by writing your own customized modules, thanks to the JAAS pluggable feature. However, this would require a good understanding of the modules and processes involved in JAAS, and you need to do a lot of coding to override the proper classes and take care of both the configure and policy files.

Ideally, we'd like to able to extend JAAS in an easier way so whenever a custom security repository or different access control mechanism changed or needed to add, you could just develop and plug in the different small modules (namely, the adapters) to accommodate these new changes or requirements, and best of all, without having to understand or know the details of the JAAS process. Also, we would like to be able to make this change simply by changing a configuration file. Another goal is that our JAAS extension component could be used in different J2EE applications - stand-alone or Web. Figure 3 outlines the design of our JAAS extension component.

Our JAAS extension component takes advantage of the JAAS pluggable architecture by implementing our customized LoginModule and Policy modules. In these modules, we delegate the data requests to the adapters. Each of these adapters is isolated to simple tasks such as data retrieval, so you can rapidly develop different adapters for different security repositories or algorithms instead of trying to implement different LoginModule or Policy modules, which are far more complex and require more effort.

You can download the complete source code from www.sys-con.com/java/sourcec.cfm".

AuthLoginModule
The AuthLoginModule class is our customized LoginModule implementation. The LoginModule is a pluggable component in the JAAS authentication process and serves two purposes:

  1. Authenticate the user.
  2. Update the Subject with relevant principals and credentials if authentication succeeded.
The LoginModule has five methods to implement. Let's look at the login () method. This method is called to authenticate the Subject and basically does two things:
  1. Obtains the user name and password. Typically, the LoginModule invokes the handle method of the CallbackHandler to get the user name and password.
  2. Verifies the password against the one in the data source.
The LoginModule retrieves the username and password from the Callbacks, which, by default, expect some sort of user interaction. This is fine for a simple demo program or on the command line, but it may not be practical for a J2EE application. For instance, for most Web applications, the user name and password will typically be read from a form. In this case, using JAAS authentication will be difficult. Considering we don't use LoginModule directly, the solution is to implement a customized CallbackHandler, which accepts a username and password and then delivers them to the LoginModule so it doesn't need to prompt the user for the information. Here's how the user information got passed from the JSP or servlet:

String userName = request.getParameter ("user");
String password = request.getParameter("password");
LoginContext context = new LoginContext ("MySample",
new AuthCallbackHandler (userName, password));

Once it has the user name and password at hand, the AuthLoginModule, our customized implementation of LoginModule, instantiates the LoginSourceAdapter via the LoginSourceAdapterFactory and delegates the actual authentication to the source adapter. The adapter is nothing more than a simple class, which pulls down the user information from a particular data source, such as database or LDAP, or some other system.

In the "commit" phase, the AuthloginModule retrieves the relevant information from the LoginSourceAdapter and associates them with the Subject.

LoginSourceAdapter
The LoginSourceAdapter is an interface of source adapter for the authentication. It has four methods for required implementations:

  1. void initialize (Hashtable parameters): The initialize method is called to initialize the adapter with the relevant parameters. The method is called immediately after object creation and prior to any calls to other methods.
  2. boolean authenticate (String userName, char[] password): The authenticate method is called to authenticate the user.
  3. String[] getGroupNames (String userName): The getGroupNames method is called to get the relevant principal information after authentication succeeded.
  4. void terminate (): This method is called when the logout method of LoginModule is invoked. It gives the adapter a chance to do some clean-up work.

The argument for the initialize method is the collection of a key-value pair. It could be the parameters for database connectivity, such as driver, URL, user ID, and password, or other information required for your adapter. You can specify these parameters in the configuration file, which I'll discuss later.

AuthPolicy
Under the JAAS architecture, the security policy is handled by the java.security.Policy class, which establishes the various Permissions granted to a particular CodeSource or Principal. As discussed in the previous section, the default implementation is sun.security.provider.PolicyFile. The PolicyFile uses the plaintext file to establish the mapping between permissions and CodeSource, which may not be good enough for the enterprise application. A centralized system such as a relational database for supporting role-base security would be better.

Obviously, to extend JAAS authorization to handle the different security schemes from different sources, we need to write our own Policy implementation.

The steps to create a customized Policy implementation are:

* Extend java.security.Policy.
* Implement getPermissions ().
* Implement refresh ().

If you look at the implementation of our customized Policy class, you may notice that our AuthPolicy class is derived from the sun.security.provider.PolicyFile instead of java.security .Policy. Why? First, I want to implement the AuthPolicy class as the generic Policy class, which can deal with the default policy file without any adapter plugged in. By deriving from the PolicyFile, we don't need to implement the policy file parsing and other related codes. Also, when the application is running with a Security- Manager enabled, a few permissions, such as doAsPrivileged AuthPermission and read FilePermission (for loading a configuration file), need to be granted in order to execute the JAAS. Sure, these permissions could be stored in the data source, but it might be convenient to put them in the standard Java security policy file. However, for serious development you should implement an adapter to deal with these issues.

Following the same design pattern in the extending authentication, our Policy class delegates the permission requests to the PermissionAdapter.

In the Permissions class, the different Permission is held in its own Permission- Collection instance. If you create a custom Permission class, you need to create your own PermissionCollection, otherwise there's no guarantee that your Permission object will be consulted.

PermissionAdapter
The PermissionAdapter is the interface of the pluggable module for authorization in our JAAS extension component. It evaluates the policy from a particular data source and delivers a PermissionCollection that contains a set of permissions granted. The PermissionAdapter interface has the following methods:

  • void initialize (Hashtable initParams): The initialize method is called to initialize the adapter with the relevant parameter. The method is called immediately and prior to any calls to other methods. Also, it's called when Policy's refresh is invoked.
  • PermissionCollection getPermissions (ProtectionDomain domain): This method is called whenever the Permissions with particular Principals is requested.
As an example, let's look at how to implement a role-based PermissionAdapter. Assume that there are three roles: admin, user, and guest all with different privileges, and all the permission information is stored in the database.

First, in the initialize method, we'll retrieve all the permission information for all roles from the database table and populate them in the collection, e.g., Hashtable.

Next, in the getPermissions method, we'll collect the permissions that relate to the involved Principals (this is the only concern for the role-based access control) and return them. Note that we can get relevant Principals by calling the getPrincipals method of ProtectedDomain. It's so simple, isn't it?

JaasUtil
JaasUtil is the main contact to our JAAS extension component, and it has a constructor that takes the user name and password. There are two key methods:

  1. boolean authenticate()
  2. boolean checkPermission(Subject subject, final Permission perm)
The JaasUtil actually defers the login request to LoginContext and the permission check to SecurityManager.

Listing 1 shows how to use JaasUtil. This code first gets the user name and password from the HttpServletRequest and tries to authenticate the user. Then it checks if this user has permission to access the "editReg.jsp".

Configuration
Now we have our customized implementations of the LoginModule, Policy, and other related modules. These modules can delegate the relevant data requests to the appropriate adapters; so far so good. However, in the JAAS architecture, the LoginModule and Policy are never directly invoked by the application, so how do we know which adapter should be instantiated and how to pass the necessary parameters or information, such as connectivity, to the adapters?

The answer is that the adapters can be dynamically configured by updating an XML configuration file. This XML configuration file consists of two major sections:

1. : This section defines the login source adapter and possible input parameters for authentication.
2. : This section defines the permission adapter and possible input parameters for authorization.

You can specify which LoginSourceAdapter and PermissionAdapter to use. It's also possible to pass additional information to the adapter in the configuration file.

There are two ways to let JaasUtil know where to look for the configuration file:

1. Specify the configuration file via the -Dcom.auth.config command-line switch.
2. Call JaasUtil.setConfigFile (configFile).

When you deploy the JAAS extension component, the customized security Policy class file must be added to Java's jre/lib directory, which will cause the policy class file to be loaded by the bootstrap class loader. Otherwise, it won't be picked up and the default policy class provided by Sun will be used instead, even though you placed the policy class file on the Java class path.

Summary
Extending JAAS is not difficult. The JAAS architecture provides you with the flexibility to customize the authentication and authorization processes. Understanding how these processes work is the first step in knowing how to "roll your own" implementation. In this article, we recalled the basics of the JAAS, and examined the details of how to extend JAAS to be a more dynamic, flexible, and scalable framework. With this extended framework, you can easily create your own login and access control mechanisms to support either your own enterprise-specific security requirements or emerging security standards, or leverage your existing or customized security models as the adapters, and then "plug" them into JAAS. This should provide a standard-based and highly customized authentication and authorization for your enterprise applications.

More Stories By Guosheng Huang

Guosheng Huang, PhD, is a senior software developer with Wysdom Inc.
He has over 15 years of experience in software engineering and
technical architecture.

Comments (7) View Comments

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


Most Recent Comments
Laurent DUTHEIL 06/07/05 10:57:55 AM EDT

Hello,

I'm very interested about your article.
But the source are not available anymore.
Where can we donload them ?

Thank you.
Laurent.

Jon Lee 02/10/05 09:30:07 PM EST

Dr. Huang,

Thank you writing this informative article.

Contrarily to Maciek Kolesnik and Greg Bishop's opinion, this article is very helpful and useful in understanding JAAS.

The usefulness of understanding JAAS further is now proven when Sun included JAAS in J2SE and J2EE.

Why does this article's helpfulness have anything to do with MS Exchange? So, does it mean only associating with MS Exchange will be helpful? I don't think so.

I think Dr. Huang has already shown that JAAS is easy to extend. So, JAAS can be intergrated with other systems by creating your customized LoginModule.

Peace,
Jon

Nitin Bhavsar 12/08/04 04:54:51 AM EST

1. The article is interesting and nice with simple language. There are plenty of articles on JAAS but still I had many use-case related basic questions. The article helped me understand it (though not fully)...
2. Where are the figures?
3. Where is the listing?
4. The download source took me to the archives page with 100s of links. :(

Thomas Nietsch 07/02/04 05:51:16 AM EDT

Where are the figures?

Greg Bishop 05/10/04 10:27:38 AM EDT

This is not helpful because it does not discuss implementation in an existing security architecture and integration with existing security mechanisms like MS Exchange, etc.

If I wanted to roll my own anything, I sure wouldn''t start with somehting as common as a security architecture.

maciek kolesnik 10/23/03 09:09:05 AM EDT

I think it would really be worthwhile to mention challenges and opportunities that JAAS presents when implementing it in a real J2EE environment (with filters, servlets, EJBs, resource adapters, etc.). There is a talk of adapting JAAS authentication/access control mechanisms in the upcoming J2EE revisions. I'd be interesting in hearing author's opinion on this, otherwise this article probably fits more in the J2SE column :-)

Maciek

Bruce Steely 10/07/03 05:02:10 PM EDT

Where is Listing 1?

@ThingsExpo Stories
Five years ago development was seen as a dead-end career, now it’s anything but – with an explosion in mobile and IoT initiatives increasing the demand for skilled engineers. But apart from having a ready supply of great coders, what constitutes true ‘DevOps Royalty’? It’ll be the ability to craft resilient architectures, supportability, security everywhere across the software lifecycle. In his keynote at @DevOpsSummit at 20th Cloud Expo, Jeffrey Scheaffer, GM and SVP, Continuous Delivery Busine...
SYS-CON Events announced today that Progress, a global leader in application development, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Enterprises today are rapidly adopting the cloud, while continuing to retain business-critical/sensitive data inside the firewall. This is creating two separate data silos – one inside the firewall and the other outside the firewall. Cloud ISVs ofte...
SYS-CON Events announced today that Outscale will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Outscale's technology makes an automated and adaptable Cloud available to businesses, supporting them in the most complex IT projects while controlling their operational aspects. You boost your IT infrastructure's reactivity, with request responses that only take a few seconds.
SYS-CON Events announced today that Interoute has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Interoute is the owner operator of Europe's largest network and a global cloud services platform, which encompasses over 70,000 km of lit fiber, 15 data centers, 17 virtual data centers and 33 colocation centers, with connections to 195 additional partner data centers. Our full-service Unifie...
SYS-CON Events announced today that CollabNet, a global leader in enterprise software development, release automation and DevOps solutions, will be a Bronze Sponsor of SYS-CON's 20th International Cloud Expo®, taking place from June 6-8, 2017, at the Javits Center in New York City, NY. CollabNet offers a broad range of solutions with the mission of helping modern organizations deliver quality software at speed. The company’s latest innovation, the DevOps Lifecycle Manager (DLM), supports Value S...
SYS-CON Events announced today that Enzu will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY, and the 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Enzu’s mission is to be the leading provider of enterprise cloud solutions worldwide. Enzu enables online businesses to use its IT infrastructure to their competitive ad...
SYS-CON Events announced today that Peak 10, Inc., a national IT infrastructure and cloud services provider, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Peak 10 provides reliable, tailored data center and network services, cloud and managed services. Its solutions are designed to scale and adapt to customers’ changing business needs, enabling them to lower costs, improve performance and focus intern...
Everywhere we turn in our industry we can find strong opinions about the direction, type and nature of cloud’s impact on computing and business. Another word that is used in every context in our industry is “hybrid.” In his session at 20th Cloud Expo, Alvaro Gonzalez, Director of Technical, Partner and Field Marketing at Peak 10, will use a combination of a few conceptual props and some research recently commissioned by Peak 10 to offer a real-world consideration of how the various categories of...
Detecting internal user threats in the Big Data eco-system is challenging and cumbersome. Many organizations monitor internal usage of the Big Data eco-system using a set of alerts. This is not a scalable process given the increase in the number of alerts with the accelerating growth in data volume and user base. Organizations are increasingly leveraging machine learning to monitor only those data elements that are sensitive and critical, autonomously establish monitoring policies, and to detect...
SYS-CON Events announced today that SoftLayer, an IBM Company, has been named “Gold Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2016, at the Javits Center in New York, New York. SoftLayer, an IBM Company, provides cloud infrastructure as a service from a growing number of data centers and network points of presence around the world. SoftLayer’s customers range from Web startups to global enterprises.
The 21st International Cloud Expo has announced that its Call for Papers is open. Cloud Expo, to be held October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, brings together Cloud Computing, Big Data, Internet of Things, DevOps, Digital Transformation, Machine Learning and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding busin...
Multiple data types are pouring into IoT deployments. Data is coming in small packages as well as enormous files and data streams of many sizes. Widespread use of mobile devices adds to the total. In this power panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists will look at the tools and environments that are being put to use in IoT deployments, as well as the team skills a modern enterprise IT shop needs to keep things running, get a handle on all this data, and deli...
SYS-CON Events announced today that Systena America will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Systena Group has been in business for various software development and verification in Japan, US, ASEAN, and China by utilizing the knowledge we gained from all types of device development for various industries including smartphones (Android/iOS), wireless communication, security technology and IoT serv...
SYS-CON Events announced today that Loom Systems will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Founded in 2015, Loom Systems delivers an advanced AI solution to predict and prevent problems in the digital business. Loom stands alone in the industry as an AI analysis platform requiring no prior math knowledge from operators, leveraging the existing staff to succeed in the digital era. With offices in S...
With major technology companies and startups seriously embracing Cloud strategies, now is the perfect time to attend @CloudExpo | @ThingsExpo, June 6-8, 2017, at the Javits Center in New York City, NY and October 31 - November 2, 2017, Santa Clara Convention Center, CA. Learn what is going on, contribute to the discussions, and ensure that your enterprise is on the right path to Digital Transformation.
SYS-CON Events announced today that EARP Integration will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. EARP Integration is a passionate software house. Since its inception in 2009 the company successfully delivers smart solutions for cities and factories that start their digital transformation. EARP provides bespoke solutions like, for example, advanced enterprise portals, business intelligence systems an...
We build IoT infrastructure products - when you have to integrate different devices, different systems and cloud you have to build an application to do that but we eliminate the need to build an application. Our products can integrate any device, any system, any cloud regardless of protocol," explained Peter Jung, Chief Product Officer at Pulzze Systems, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA
Existing Big Data solutions are mainly focused on the discovery and analysis of data. The solutions are scalable and highly available but tedious when swapping in and swapping out occurs in disarray and thrashing takes place. The resolution for thrashing through machine learning algorithms and support nomenclature is through simple techniques. Organizations that have been collecting large customer data are increasingly seeing the need to use the data for swapping in and out and thrashing occurs ...
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm.
SYS-CON Events announced today that delaPlex will exhibit at SYS-CON's @CloudExpo, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. delaPlex pioneered Software Development as a Service (SDaaS), which provides scalable resources to build, test, and deploy software. It’s a fast and more reliable way to develop a new product or expand your in-house team.