Welcome!

Java Authors: ITinvolve Blog, Plutora Blog, Carmen Gonzalez, Elizabeth White, AppDynamics Blog

Related Topics: Java

Java: Article

Extending JAAS

Extending JAAS

User authentication and access control are important security measures for most Java applications, especially J2EE applications. The Java Authentication and Authorization Service (JAAS), the core API of J2SE 1.4 and 1.5, represents the new security standard. It provides a pluggable and flexible framework that allows developers to incorporate different security mechanisms and various security sources.

With the upcoming release of J2SE 1.5, which includes a lot of enhancements to cryptography, XML security, Public Key Infrastructure (PKI), Kerberos, and the federating identity, the JAAS will play a more important role in J2EE security implementations.

Overview of JAAS
Authentication

Authentication is the process of verifying that a user has the right to use identities established by the enterprise user registry. The authentication mechanism of JAAS is built on a set of pluggable modules (see Figure 1). JAAS allows different authentication models to be plugged in at runtime. The client applications always interact with JAAS through the LoginContext object.

The authentication process typically involves the following steps:

  1. Create a LoginContext object. The LoginContext looks up the configuration file to determine which LoginModule to use. Also, optionally, you can pass a CallbackHandler to the LoginContext.
  2. Perform authentication by calling the login method of LoginContext, which loads the predefined LoginModule to check if the user can be authenticated.
  3. Associate principals and credentials with the Subject if the user is authenticated.
  4. Or throw a LoginException in case login failed.
  5. Use the logout method of LoginContext to log out.
The login in JAAS is a two-phase process. The first phase is the "login" phase (as described in step 2). The only task in this phase is authentication. Once the process successfully passes this phase, the authentication process enters the "commit" phase (step 3) in which the commit method of LoginModule is called to associate the relevant principals and credentials with the Subject.

A Subject in JAAS represents an authenticated entity, such as a person or device. It contains a set of principals and security-related attributes such as a password and cryptographic keys. In the JAAS architecture, the Subject, along with the Permission, plays an important role in the authorization process.

Of all the authentication modules, the LoginModule is the interface to a particular authentication mechanism. Although the LoginModule never gets called directly by the client application, it provides a particular type of authentication via a pluggable module, which implements the authentication algorithm and determines how the actual authentication is performed. Sun provides a few default LoginModule implementations, such as JndiLoginModule, Krb2LoginModule, UnixLoginModule, and NTLoginModule under the package of sun.com.security.auth .module. Since the JAAS login architecture is extensible, you can pretty much "plug in" any LoginModule just by specifying which LoginModule to use in the configuration file. An example of a configuration file looks like this:


MySample {
com.sample.module.MyLoginModule required debug=true;
};

Here MySample is the name of the login context, which is passed into the LoginContext constructor when you create a new LoginContext to start the authentication process, followed by the configuration block. The block informs JAAS about the loginModule that should be used to perform authentication during the login. In addition to the LoginModule, any options to that LoginModule can also be specified here.

During the login step, the CallbackHandler is used by LoginModule to communicate with the user to obtain authentication information. The CallbackHandler handles three types of Callbacks: NameCallback, which prompts the user for a user name; PasswordCallback, which prompts for a password; and TextOutputCallback, which reports any error, warning, or other messages sent to the user.

Authorization

Authorization is the process of determining whether an authenticated user is permitted to perform some actions, such as accessing a resource. The process is policy-based since JAAS is built on the existing Java security model. The policy configuration file essentially contains a list of entries, such as "keystore" and/or "grant". The grant entry includes all the permissions granted for the authenticated codes or principals to do the security-sensitive operations, for instance, accessing a particular Web page or local file. JAAS supports principal-based policy entry. Permissions can be granted in the policy to specific principals.

The basic format of a grant entry looks like this:

grant Codebase "codebase_URL" Signedby "signer_name,"
Principal principal_class_name "principal_name",
Principal principal_class_name "principal_name",
S {
permission permission_class_name "target_name", "action",
permission permission_class_name "target_name", "action",
S
}
The "action" may be required or can be omitted depending on the permission type.

In the JAAS architecture, the Policy object represents the system security policy for a Java application environment and there's only one Policy object in effect at any time according to the Java 2 SDK document. The default implementation of Policy is sun.security.provider.PolicyFile, in which the policies are specified within one or more policy configuration files.

Once the user is authenticated, the authorization takes place via the Subject.doAs method, or the static doAsPrivileged method from Subject class. The doAs method dynamically associates the subject with the current AccessControlContext and then invokes the run method to execute the action, which causes the security checks. The permission check process goes through the following steps illustrated in Figure 2:

  1. Invoke Subject.doAs (or doAsPrivileged).
  2. Call SecurityManager.checkPermission or other check methods to check the permission.
  3. The SecurityManager delegates the check to the AccessController.
  4. The AccessController ensures the relevant AccessControlContext contains sufficient permissions for the action to be taken.
  5. The SecurityManager updates the current AccessControlContext with the permissions granted to the subject via the Policy from the policy file.
If the required permission to a specific principal is granted, the operation will be allowed. Otherwise, an Access- ControlException will be thrown.

Like the LoginModule, the Policy is also a pluggable module. You can hook up other Policy implementations by changing "policy.provider=sun.security.provider.PolicyFile" in the java.security properties file to a value of the Policy class you want to use.

Extend JAAS
JAAS is built on top of the existing Java security model, which is CodeSource-based, and the plaintext format policy file implementation. This may not be enough for the enterprise application. You may want to use custom security repositories with JAAS, such as LDAP (lightweight directory access protocol), database, or another file system. It can be done by writing your own customized modules, thanks to the JAAS pluggable feature. However, this would require a good understanding of the modules and processes involved in JAAS, and you need to do a lot of coding to override the proper classes and take care of both the configure and policy files.

Ideally, we'd like to able to extend JAAS in an easier way so whenever a custom security repository or different access control mechanism changed or needed to add, you could just develop and plug in the different small modules (namely, the adapters) to accommodate these new changes or requirements, and best of all, without having to understand or know the details of the JAAS process. Also, we would like to be able to make this change simply by changing a configuration file. Another goal is that our JAAS extension component could be used in different J2EE applications - stand-alone or Web. Figure 3 outlines the design of our JAAS extension component.

Our JAAS extension component takes advantage of the JAAS pluggable architecture by implementing our customized LoginModule and Policy modules. In these modules, we delegate the data requests to the adapters. Each of these adapters is isolated to simple tasks such as data retrieval, so you can rapidly develop different adapters for different security repositories or algorithms instead of trying to implement different LoginModule or Policy modules, which are far more complex and require more effort.

You can download the complete source code from www.sys-con.com/java/sourcec.cfm".

AuthLoginModule
The AuthLoginModule class is our customized LoginModule implementation. The LoginModule is a pluggable component in the JAAS authentication process and serves two purposes:

  1. Authenticate the user.
  2. Update the Subject with relevant principals and credentials if authentication succeeded.
The LoginModule has five methods to implement. Let's look at the login () method. This method is called to authenticate the Subject and basically does two things:
  1. Obtains the user name and password. Typically, the LoginModule invokes the handle method of the CallbackHandler to get the user name and password.
  2. Verifies the password against the one in the data source.
The LoginModule retrieves the username and password from the Callbacks, which, by default, expect some sort of user interaction. This is fine for a simple demo program or on the command line, but it may not be practical for a J2EE application. For instance, for most Web applications, the user name and password will typically be read from a form. In this case, using JAAS authentication will be difficult. Considering we don't use LoginModule directly, the solution is to implement a customized CallbackHandler, which accepts a username and password and then delivers them to the LoginModule so it doesn't need to prompt the user for the information. Here's how the user information got passed from the JSP or servlet:

String userName = request.getParameter ("user");
String password = request.getParameter("password");
LoginContext context = new LoginContext ("MySample",
new AuthCallbackHandler (userName, password));

Once it has the user name and password at hand, the AuthLoginModule, our customized implementation of LoginModule, instantiates the LoginSourceAdapter via the LoginSourceAdapterFactory and delegates the actual authentication to the source adapter. The adapter is nothing more than a simple class, which pulls down the user information from a particular data source, such as database or LDAP, or some other system.

In the "commit" phase, the AuthloginModule retrieves the relevant information from the LoginSourceAdapter and associates them with the Subject.

LoginSourceAdapter
The LoginSourceAdapter is an interface of source adapter for the authentication. It has four methods for required implementations:

  1. void initialize (Hashtable parameters): The initialize method is called to initialize the adapter with the relevant parameters. The method is called immediately after object creation and prior to any calls to other methods.
  2. boolean authenticate (String userName, char[] password): The authenticate method is called to authenticate the user.
  3. String[] getGroupNames (String userName): The getGroupNames method is called to get the relevant principal information after authentication succeeded.
  4. void terminate (): This method is called when the logout method of LoginModule is invoked. It gives the adapter a chance to do some clean-up work.

The argument for the initialize method is the collection of a key-value pair. It could be the parameters for database connectivity, such as driver, URL, user ID, and password, or other information required for your adapter. You can specify these parameters in the configuration file, which I'll discuss later.

AuthPolicy
Under the JAAS architecture, the security policy is handled by the java.security.Policy class, which establishes the various Permissions granted to a particular CodeSource or Principal. As discussed in the previous section, the default implementation is sun.security.provider.PolicyFile. The PolicyFile uses the plaintext file to establish the mapping between permissions and CodeSource, which may not be good enough for the enterprise application. A centralized system such as a relational database for supporting role-base security would be better.

Obviously, to extend JAAS authorization to handle the different security schemes from different sources, we need to write our own Policy implementation.

The steps to create a customized Policy implementation are:

* Extend java.security.Policy.
* Implement getPermissions ().
* Implement refresh ().

If you look at the implementation of our customized Policy class, you may notice that our AuthPolicy class is derived from the sun.security.provider.PolicyFile instead of java.security .Policy. Why? First, I want to implement the AuthPolicy class as the generic Policy class, which can deal with the default policy file without any adapter plugged in. By deriving from the PolicyFile, we don't need to implement the policy file parsing and other related codes. Also, when the application is running with a Security- Manager enabled, a few permissions, such as doAsPrivileged AuthPermission and read FilePermission (for loading a configuration file), need to be granted in order to execute the JAAS. Sure, these permissions could be stored in the data source, but it might be convenient to put them in the standard Java security policy file. However, for serious development you should implement an adapter to deal with these issues.

Following the same design pattern in the extending authentication, our Policy class delegates the permission requests to the PermissionAdapter.

In the Permissions class, the different Permission is held in its own Permission- Collection instance. If you create a custom Permission class, you need to create your own PermissionCollection, otherwise there's no guarantee that your Permission object will be consulted.

PermissionAdapter
The PermissionAdapter is the interface of the pluggable module for authorization in our JAAS extension component. It evaluates the policy from a particular data source and delivers a PermissionCollection that contains a set of permissions granted. The PermissionAdapter interface has the following methods:

  • void initialize (Hashtable initParams): The initialize method is called to initialize the adapter with the relevant parameter. The method is called immediately and prior to any calls to other methods. Also, it's called when Policy's refresh is invoked.
  • PermissionCollection getPermissions (ProtectionDomain domain): This method is called whenever the Permissions with particular Principals is requested.
As an example, let's look at how to implement a role-based PermissionAdapter. Assume that there are three roles: admin, user, and guest all with different privileges, and all the permission information is stored in the database.

First, in the initialize method, we'll retrieve all the permission information for all roles from the database table and populate them in the collection, e.g., Hashtable.

Next, in the getPermissions method, we'll collect the permissions that relate to the involved Principals (this is the only concern for the role-based access control) and return them. Note that we can get relevant Principals by calling the getPrincipals method of ProtectedDomain. It's so simple, isn't it?

JaasUtil
JaasUtil is the main contact to our JAAS extension component, and it has a constructor that takes the user name and password. There are two key methods:

  1. boolean authenticate()
  2. boolean checkPermission(Subject subject, final Permission perm)
The JaasUtil actually defers the login request to LoginContext and the permission check to SecurityManager.

Listing 1 shows how to use JaasUtil. This code first gets the user name and password from the HttpServletRequest and tries to authenticate the user. Then it checks if this user has permission to access the "editReg.jsp".

Configuration
Now we have our customized implementations of the LoginModule, Policy, and other related modules. These modules can delegate the relevant data requests to the appropriate adapters; so far so good. However, in the JAAS architecture, the LoginModule and Policy are never directly invoked by the application, so how do we know which adapter should be instantiated and how to pass the necessary parameters or information, such as connectivity, to the adapters?

The answer is that the adapters can be dynamically configured by updating an XML configuration file. This XML configuration file consists of two major sections:

1. : This section defines the login source adapter and possible input parameters for authentication.
2. : This section defines the permission adapter and possible input parameters for authorization.

You can specify which LoginSourceAdapter and PermissionAdapter to use. It's also possible to pass additional information to the adapter in the configuration file.

There are two ways to let JaasUtil know where to look for the configuration file:

1. Specify the configuration file via the -Dcom.auth.config command-line switch.
2. Call JaasUtil.setConfigFile (configFile).

When you deploy the JAAS extension component, the customized security Policy class file must be added to Java's jre/lib directory, which will cause the policy class file to be loaded by the bootstrap class loader. Otherwise, it won't be picked up and the default policy class provided by Sun will be used instead, even though you placed the policy class file on the Java class path.

Summary
Extending JAAS is not difficult. The JAAS architecture provides you with the flexibility to customize the authentication and authorization processes. Understanding how these processes work is the first step in knowing how to "roll your own" implementation. In this article, we recalled the basics of the JAAS, and examined the details of how to extend JAAS to be a more dynamic, flexible, and scalable framework. With this extended framework, you can easily create your own login and access control mechanisms to support either your own enterprise-specific security requirements or emerging security standards, or leverage your existing or customized security models as the adapters, and then "plug" them into JAAS. This should provide a standard-based and highly customized authentication and authorization for your enterprise applications.

More Stories By Guosheng Huang

Guosheng Huang, PhD, is a senior software developer with Wysdom Inc.
He has over 15 years of experience in software engineering and
technical architecture.

Comments (7) View Comments

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


Most Recent Comments
Laurent DUTHEIL 06/07/05 10:57:55 AM EDT

Hello,

I'm very interested about your article.
But the source are not available anymore.
Where can we donload them ?

Thank you.
Laurent.

Jon Lee 02/10/05 09:30:07 PM EST

Dr. Huang,

Thank you writing this informative article.

Contrarily to Maciek Kolesnik and Greg Bishop's opinion, this article is very helpful and useful in understanding JAAS.

The usefulness of understanding JAAS further is now proven when Sun included JAAS in J2SE and J2EE.

Why does this article's helpfulness have anything to do with MS Exchange? So, does it mean only associating with MS Exchange will be helpful? I don't think so.

I think Dr. Huang has already shown that JAAS is easy to extend. So, JAAS can be intergrated with other systems by creating your customized LoginModule.

Peace,
Jon

Nitin Bhavsar 12/08/04 04:54:51 AM EST

1. The article is interesting and nice with simple language. There are plenty of articles on JAAS but still I had many use-case related basic questions. The article helped me understand it (though not fully)...
2. Where are the figures?
3. Where is the listing?
4. The download source took me to the archives page with 100s of links. :(

Thomas Nietsch 07/02/04 05:51:16 AM EDT

Where are the figures?

Greg Bishop 05/10/04 10:27:38 AM EDT

This is not helpful because it does not discuss implementation in an existing security architecture and integration with existing security mechanisms like MS Exchange, etc.

If I wanted to roll my own anything, I sure wouldn''t start with somehting as common as a security architecture.

maciek kolesnik 10/23/03 09:09:05 AM EDT

I think it would really be worthwhile to mention challenges and opportunities that JAAS presents when implementing it in a real J2EE environment (with filters, servlets, EJBs, resource adapters, etc.). There is a talk of adapting JAAS authentication/access control mechanisms in the upcoming J2EE revisions. I'd be interesting in hearing author's opinion on this, otherwise this article probably fits more in the J2SE column :-)

Maciek

Bruce Steely 10/07/03 05:02:10 PM EDT

Where is Listing 1?

@ThingsExpo Stories
Almost everyone sees the potential of Internet of Things but how can businesses truly unlock that potential. The key will be in the ability to discover business insight in the midst of an ocean of Big Data generated from billions of embedded devices via Systems of Discover. Businesses will also need to ensure that they can sustain that insight by leveraging the cloud for global reach, scale and elasticity.
The 3rd International Internet of @ThingsExpo, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that its Call for Papers is now open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than 20 years ago.
"People are a lot more knowledgeable about APIs now. There are two types of people who work with APIs - IT people who want to use APIs for something internal and the product managers who want to do something outside APIs for people to connect to them," explained Roberto Medrano, Executive Vice President at SOA Software, in this SYS-CON.tv interview at Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
Performance is the intersection of power, agility, control, and choice. If you value performance, and more specifically consistent performance, you need to look beyond simple virtualized compute. Many factors need to be considered to create a truly performant environment. In his General Session at 15th Cloud Expo, Harold Hannon, Sr. Software Architect at SoftLayer, discussed how to take advantage of a multitude of compute options and platform features to make cloud the cornerstone of your online presence.
SYS-CON Media announced that Splunk, a provider of the leading software platform for real-time Operational Intelligence, has launched an ad campaign on Big Data Journal. Splunk software and cloud services enable organizations to search, monitor, analyze and visualize machine-generated big data coming from websites, applications, servers, networks, sensors and mobile devices. The ads focus on delivering ROI - how improved uptime delivered $6M in annual ROI, improving customer operations by mining large volumes of unstructured data, and how data tracking delivers uptime when it matters most.
Cultural, regulatory, environmental, political and economic (CREPE) conditions over the past decade are creating cross-industry solution spaces that require processes and technologies from both the Internet of Things (IoT), and Data Management and Analytics (DMA). These solution spaces are evolving into Sensor Analytics Ecosystems (SAE) that represent significant new opportunities for organizations of all types. Public Utilities throughout the world, providing electricity, natural gas and water, are pursuing SmartGrid initiatives that represent one of the more mature examples of SAE. We have s...
Since 2008 and for the first time in history, more than half of humans live in urban areas, urging cities to become “smart.” Today, cities can leverage the wide availability of smartphones combined with new technologies such as Beacons or NFC to connect their urban furniture and environment to create citizen-first services that improve transportation, way-finding and information delivery. In her session at @ThingsExpo, Laetitia Gazel-Anthoine, CEO of Connecthings, will focus on successful use cases.
The Internet of Things will greatly expand the opportunities for data collection and new business models driven off of that data. In her session at @ThingsExpo, Esmeralda Swartz, CMO of MetraTech, discussed how for this to be effective you not only need to have infrastructure and operational models capable of utilizing this new phenomenon, but increasingly service providers will need to convince a skeptical public to participate. Get ready to show them the money!
DevOps Summit 2015 New York, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that it is now accepting Keynote Proposals. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long development cycles that produce software that is obsolete at launch. DevOps may be disruptive, but it is essential.
“With easy-to-use SDKs for Atmel’s platforms, IoT developers can now reap the benefits of realtime communication, and bypass the security pitfalls and configuration complexities that put IoT deployments at risk,” said Todd Greene, founder & CEO of PubNub. PubNub will team with Atmel at CES 2015 to launch full SDK support for Atmel’s MCU, MPU, and Wireless SoC platforms. Atmel developers now have access to PubNub’s secure Publish/Subscribe messaging with guaranteed ¼ second latencies across PubNub’s 14 global points-of-presence. PubNub delivers secure communication through firewalls, proxy ser...
The industrial software market has treated data with the mentality of “collect everything now, worry about how to use it later.” We now find ourselves buried in data, with the pervasive connectivity of the (Industrial) Internet of Things only piling on more numbers. There’s too much data and not enough information. In his session at @ThingsExpo, Bob Gates, Global Marketing Director, GE’s Intelligent Platforms business, to discuss how realizing the power of IoT, software developers are now focused on understanding how industrial data can create intelligence for industrial operations. Imagine ...
The true value of the Internet of Things (IoT) lies not just in the data, but through the services that protect the data, perform the analysis and present findings in a usable way. With many IoT elements rooted in traditional IT components, Big Data and IoT isn’t just a play for enterprise. In fact, the IoT presents SMBs with the prospect of launching entirely new activities and exploring innovative areas. CompTIA research identifies several areas where IoT is expected to have the greatest impact.
The 3rd International Internet of @ThingsExpo, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that its Call for Papers is now open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than 20 years ago.
The Internet of Things promises to transform businesses (and lives), but navigating the business and technical path to success can be difficult to understand. In his session at @ThingsExpo, Sean Lorenz, Technical Product Manager for Xively at LogMeIn, demonstrated how to approach creating broadly successful connected customer solutions using real world business transformation studies including New England BioLabs and more.
Connected devices and the Internet of Things are getting significant momentum in 2014. In his session at Internet of @ThingsExpo, Jim Hunter, Chief Scientist & Technology Evangelist at Greenwave Systems, examined three key elements that together will drive mass adoption of the IoT before the end of 2015. The first element is the recent advent of robust open source protocols (like AllJoyn and WebRTC) that facilitate M2M communication. The second is broad availability of flexible, cost-effective storage designed to handle the massive surge in back-end data in a world where timely analytics is e...
The Internet of Things will put IT to its ultimate test by creating infinite new opportunities to digitize products and services, generate and analyze new data to improve customer satisfaction, and discover new ways to gain a competitive advantage across nearly every industry. In order to help corporate business units to capitalize on the rapidly evolving IoT opportunities, IT must stand up to a new set of challenges. In his session at @ThingsExpo, Jeff Kaplan, Managing Director of THINKstrategies, will examine why IT must finally fulfill its role in support of its SBUs or face a new round of...
We’re no longer looking to the future for the IoT wave. It’s no longer a distant dream but a reality that has arrived. It’s now time to make sure the industry is in alignment to meet the IoT growing pains – cooperate and collaborate as well as innovate. In his session at @ThingsExpo, Jim Hunter, Chief Scientist & Technology Evangelist at Greenwave Systems, will examine the key ingredients to IoT success and identify solutions to challenges the industry is facing. The deep industry expertise behind this presentation will provide attendees with a leading edge view of rapidly emerging IoT oppor...
"There is a natural synchronization between the business models, the IoT is there to support ,” explained Brendan O'Brien, Co-founder and Chief Architect of Aria Systems, in this SYS-CON.tv interview at the 15th International Cloud Expo®, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
The BPM world is going through some evolution or changes where traditional business process management solutions really have nowhere to go in terms of development of the road map. In this demo at 15th Cloud Expo, Kyle Hansen, Director of Professional Services at AgilePoint, shows AgilePoint’s unique approach to dealing with this market circumstance by developing a rapid application composition or development framework.
There is no doubt that Big Data is here and getting bigger every day. Building a Big Data infrastructure today is no easy task. There are an enormous number of choices for database engines and technologies. To make things even more challenging, requirements are getting more sophisticated, and the standard paradigm of supporting historical analytics queries is often just one facet of what is needed. As Big Data growth continues, organizations are demanding real-time access to data, allowing immediate and actionable interpretation of events as they happen. Another aspect concerns how to deliver ...