tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Mohan Radhakrishnan <radhakrishnan.mo...@gmail.com>
Subject JAAS in Tomcat
Date Fri, 17 Feb 2006 12:23:47 GMT
Hi,

I have anabled authentication usng JAASRealm in Tomcat 5.x

The steps are

1. Security constraints in web.xml - Working
2. JAAS LoginModule implementation - Working because I am able to login.
3. Policy file like this



grant CodeBase "file:./struts-blank.war" Principal
com.paper.security.filter.Principal "mohan" {
  permission com.xor.auth.perm.URLPermission "/index.jsp";
  permission com.xor.auth.perm.URLPermission "/struts-blank/index.jsp";
  permission com.xor.auth.perm.URLPermission "/struts-blank/Welcome.do";};




4. Struts filter like this



       	    HttpServletRequest httpReq = (HttpServletRequest) req;
            LoginContext lc = *new* LoginContext("WhitePaper",
        	    		*new* WhitePaperCallbackHandler( httpReq.getRemoteUser(),
          	    		 			                   "javatech" ));
			logger.info( "Authenticating [" + httpReq.getRequestURI() );
        	lc.login();
			logger.info( "Authenticated" );
        	Subject s = lc.getSubject();
        	javax.security.auth.Policy policy =
javax.security.auth.Policy.getPolicy();
        	CodeSource cs = *new* CodeSource(*new* URL("file:./struts-blank.war"),
        			                       (CodeSigner[])*null*);
        	PermissionCollection perms = policy.getPermissions( s, cs );
    	
        	*if*( perms!= *null* ) {
        		Enumeration e = perms.elements();
        		*while*( e.hasMoreElements()) {
    				logger.info( "[" + e.nextElement() + "]");
        		}
       	    }

        	Subject.doAsPrivileged(s, *new* PrivilegedExceptionAction() {
        		*public* Object run() {
        		  proceed( req,res,chain );
        		  *return* *null*;
        		}
       		}, *null*);




The problem is that I am not able to print any permissions. So I am assuming
there is a configuration problem. I am able to login and JAAS itself works
fine.

Now I am able to type a URL that is not mentioned in the policy file and
access it. So my policy file is not taking effect ??

Appreciate any help.

Thanks,
Mohan

Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message