Mailing-List: contact tomcat-dev-help@jakarta.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Developers List" <tomcat-dev@jakarta.apache.org>
Message-ID: <202CEC1EA707FF4A8FA9D64ABE8651BF04622E@gandalf.aix.micropole.com>
From: BURRIEL Emmanuel <EBURRIEL@micropole-univers.com>
To: "'tomcat-dev@jakarta.apache.org'" <tomcat-dev@jakarta.apache.org>
Subject: catalina (tomcat 5.0.16) JAASRealm and GenericPrincipal and Me
Date: Thu, 15 Jan 2004 17:49:15 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----_=_NextPart_001_01C3DB87.82DC00F0"

------_=_NextPart_001_01C3DB87.82DC00F0
Content-Type: text/plain;
	charset="iso-8859-1"

I am trying to implement my own JAAS LoginModule.

I configure server.xml
<Realm className="org.apache.catalina.realm.JAASRealm"
                 debug="99" 
                 appName="NadejJAAS" 
                 userClassName="com.micropole.jaas.memory.UserPrincipal"
                 roleClassName="com.micropole.jaas.memory.RolePrincipal"
                 />
                 
My LoginModule works fine until i need to populate Principal in the commit()
method.

Kind of result:

		[MemoryLoginModule] user entered user name: testUser
		[MemoryLoginModule] user entered password: testPassword
		[MemoryLoginModule] authentication succeeded

And finnaly i get a 403 : forbidden access to ressource ....

I find an explication in the following method of RealmBase.hasRole(Principal
principal, String role) 

In fact, i populate with my own Principal (RolePrincipal) but
Tomcat rejects my user because it is waiting for a GenericPrincipal.
 
JAASRealm seems to use public boolean hasRole(Principal principal, String
role) 
inherited from RealmBase with the following code :

public boolean hasRole(Principal principal, String role) {

        // Should be overriten in JAASRealm - to avoid pretty inefficient
conversions
        if ((principal == null) || (role == null) ||
            !(principal instanceof GenericPrincipal))
            return (false);

        GenericPrincipal gp = (GenericPrincipal) principal;
        if (!(gp.getRealm() == this)) {
            log.debug("Different realm " + this + " " + gp.getRealm());//
return (false);
        }
        boolean result = gp.hasRole(role);
        if (log.isDebugEnabled()) {
            String name = principal.getName();
            if (result)
                log.debug(sm.getString("realmBase.hasRoleSuccess", name,
role));
            else
                log.debug(sm.getString("realmBase.hasRoleFailure", name,
role));
        }
        return (result);

    }
    
 Two things :
 1 - the comment says that it should be re-implemented in JAASRealm but it
is not done.
 2 - This implementation depends on a GenericPrincipal class specific to
Catalina packages.
 
 Maybe somebody is working about this JAASRealm and can help me to be able
to write a LoginModule that is not compiling depend of Catalina but usable
with Catalina.   
 
 A bonus question : why using two principals in server.xml realm tag if we
are using in one code?
 
 It seems there is an error in the manual (Realm Element Attributes Table
seems to talk about MemoryRealm instead of JAASRealm).
 
 Thanks in advance for any help. 

Emmanuel BURRIEL


------_=_NextPart_001_01C3DB87.82DC00F0--