Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (asf.osuosl.org: domain of radhakrishnan.mohan@gmail.com
 designates 64.233.184.206 as permitted sender)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
        s=beta; d=gmail.com;
        h=received:message-id:date:from:to:subject:mime-version:content-type;
        b=bqAskLYufVCVG+odda9YNXG+iXhwBPQ2BiuCAru5cACWbhuFiS71M3ZwOOG8Cn0uYa81mDdqrxBGEDPblh1KrODEP1UJ+nLDEsdFHBJ7VCoa+RTwsT/EP5h9J8FL5XG/qdEZgIGYkZF4RJpZLFnHsYaTAlalTzWXPgZU5PaTUyY=
Message-ID: <ed614fc80602170423x388b0283u7919f6f3975f9db4@mail.gmail.com>
Date: Fri, 17 Feb 2006 17:53:47 +0530
From: Mohan Radhakrishnan <radhakrishnan.mohan@gmail.com>
To: users@tomcat.apache.org
Subject: JAAS in Tomcat
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_Part_4855_28857709.1140179027871"

------=_Part_4855_28857709.1140179027871
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Hi,

I have anabled authentication usng JAASRealm in Tomcat 5.x

The steps are

1. Security constraints in web.xml - Working
2. JAAS LoginModule implementation - Working because I am able to login.
3. Policy file like this


grant CodeBase "file:./struts-blank.war" Principal
com.paper.security.filter.Principal "mohan" {
  permission com.xor.auth.perm.URLPermission "/index.jsp";
  permission com.xor.auth.perm.URLPermission "/struts-blank/index.jsp";
  permission com.xor.auth.perm.URLPermission "/struts-blank/Welcome.do";};


4. Struts filter like this


       =09    HttpServletRequest httpReq =3D (HttpServletRequest) req;
            LoginContext lc =3D *new* LoginContext("WhitePaper",
        =09    =09=09*new* WhitePaperCallbackHandler( httpReq.getRemoteUser=
(),
          =09    =09=09 =09=09=09                   "javatech" ));
=09=09=09logger.info( "Authenticating [" + httpReq.getRequestURI() );
        =09lc.login();
=09=09=09logger.info( "Authenticated" );
        =09Subject s =3D lc.getSubject();
        =09javax.security.auth.Policy policy =3D
javax.security.auth.Policy.getPolicy();
        =09CodeSource cs =3D *new* CodeSource(*new* URL("file:./struts-blan=
k.war"),
        =09=09=09                       (CodeSigner[])*null*);
        =09PermissionCollection perms =3D policy.getPermissions( s, cs );
    =09
        =09*if*( perms!=3D *null* ) {
        =09=09Enumeration e =3D perms.elements();
        =09=09*while*( e.hasMoreElements()) {
    =09=09=09=09logger.info( "[" + e.nextElement() + "]");
        =09=09}
       =09    }

        =09Subject.doAsPrivileged(s, *new* PrivilegedExceptionAction() {
        =09=09*public* Object run() {
        =09=09  proceed( req,res,chain );
        =09=09  *return* *null*;
        =09=09}
       =09=09}, *null*);


The problem is that I am not able to print any permissions. So I am assumin=
g
there is a configuration problem. I am able to login and JAAS itself works
fine.

Now I am able to type a URL that is not mentioned in the policy file and
access it. So my policy file is not taking effect ??

Appreciate any help.

Thanks,
Mohan

------=_Part_4855_28857709.1140179027871--