JAAS for human beings

Other users have provide some very useful links above so I am not going to bother with links. I have done a similar research in JAAS for web application and has ran into a "mind roadblock" until I finally realize JAAS is a framework tackling security at a different "layer" then web applications in the Java World. It is build to tackle security issues in Java SE not Java EE.

JAAS is a security framework built for securing things at a much lower level then web-application. Some example of these things are code and resources available at the JVM level, hence all these ability to set policy files in the JVM level.

However, since Java EE is built on top of Java SE, a few modules from JAAS were reused in Java EE security such as the LoginModules and Callbacks.

Note that in addition to Java EE security, there is also Spring security (formerly known as Acegi), which similar to native Java EE security tackles a much higher "layer" in the securing web-application problem. It is a separate security implementation and is not built on top of standard Java EE security, although it behaves similarly in many regards.

To summarize, unless you are looking to secure resources in the Java SE level (classes, System resources), I don't see any real use of JAAS other than the using the common class and interfaces. Just focus on using Spring Security or plain old Java EE security which both solve a lot of common web application security problems.

Here are some of the links I used to help understand JAAS:

http://www.owasp.org/index.php/JAAS_Tomcat_Login_Module

http://www.javaworld.com/jw-09-2002/jw-0913-jaas.html

http://jaasbook.wordpress.com/

http://roneiv.wordpress.com/2008/02/18/jaas-authentication-mechanism-is-it-possible-to-force-j_security_check-to-go-to-a-specific-page/

Also have a look at the Apache tomcat realms configuration how-to:

http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html

javax.security is imho overcomplicated API. As a result there are implementors of not only LoginModules, but the entire authentication and authorization api, that creates abstraction layer above, like Authentication & Authorization managers.

For starters, it is good to print this into your memory.

Secondly, imho the most simple, setup & go library for JAAS is Jboss PicketBox. It says how to do authentication and authorization via JBossAuthenticationManager and JBossAuthorizationManager ... Easily configurable via XML or Annotations. You can use it for managing both webapps and standalone applications.

If you need the authorization part for managing repository access, in terms of ACL for resources, this is what you are looking for sure.

Problem with the security is, that usually you need to customize it to your needs, so you may end up implementing :

LoginModule - verifies userName + Password

CallbackHandler is used like this new LoginContext("Sample", new MyCallbackHandler());

CallbackHandler is passed to the underlying LoginModules so they may communicate and interact with users - prompting for a username and password via a graphical user interface, for example. So inside of the Handler you get the username and password from user and it is passed to the LoginModule.

LoginContext - then you just call lc.login(); and authenticate the credentials. LoginContext is populated with the authenticated Subject.

However Jboss picketbox gives you a really easy way to go, unless you need something specific.