Using JAAS Authentication in Java Clients---weblogic document
The following topics are covered in this section:
The sections refer to sample code which is included in the WebLogic Server distribution at:
SAMPLES_HOME\server\examples\src\examples\security\jaas
The jaas
directory contains an instructions.html
file, ant
build files, a sample_jaas.config
file, and the following Java files:
BaseClient.java
BaseClientConstants.java
SampleAction.java
SampleCallbackHandler.java
SampleClient.java
TradeResult.java
TraderBean.java
You will need to look at the examples when reading the information in the following sections.
JAAS and WebLogic Server
The Java Authentication and Authorization Service (JAAS) is a standard extension to the security in the Java EE Development Kit 5.0. JAAS provides the ability to enforce access controls based on user identity. JAAS is provided in WebLogic Server as an alternative to the JNDI authentication mechanism.
WebLogic Server clients use the authentication portion of the standard JAAS only. The JAAS LoginContext provides support for the ordered execution of all configured authentication provider LoginModule instances and is responsible for the management of the completion status of each configured provider.
Note the following considerations when using JAAS authentication for Java clients:
WebLogic Server clients can either use the JNDI login or JAAS login for authentication, however JAAS login is the preferred method.
While JAAS is the preferred method of authentication, the WebLogic-supplied LoginModule (
weblogic.security.auth.login.UsernamePasswordLoginModule
) only supports username and password authentication. Thus, for client certificate authentication (also referred to as two-way SSL authentication), you should use JNDI. To use JAAS for client certificate authentication, you must write a custom LoginModule that does certificate authentication.Note:
If you write your own LoginModule for use with WebLogic Server clients, have it call weblogic.security.auth.Authenticate.authenticate() to perform the login.
To perform a JAAS login from a remote Java client (that is, the Java client is not a WebLogic Server client), you may use the WebLogic-supplied LoginModule to perform the login. However, if you elect not to use the WebLogic-supplied LoginModule but decide to write your own instead, you must have it call the
weblogic.security.auth.Authenticate.authenticate()
method to perform the login.If you are using a remote, or perimeter, login system such as Security Assertion Markup Language (SAML), you do not need to call
weblogic.security.auth.Authenticate.authenticate()
. You only need to call theauthenticate()
method if you are using WebLogic Server to perform the logon.Note:
WebLogic Server provides full container support for JAAS authentication and supports full use of JAAS authentication and authorization in application code.
Within WebLogic Server, JAAS is called to perform the login. Each Authentication provider includes a LoginModule. This is true for servlet logins as well as Java client logins via JNDI or JAAS. The method WebLogic Server calls internally to perform the JAAS logon is
weblogic.security.auth.Authentication.authenticate()
. When using the Authenticate class,weblogic.security.SimpleCallbackHandler
may be a useful helper class.While WebLogic Server does not protect any resources using JAAS authorization (it uses WebLogic security), you can use JAAS authorization in application code to protect the application's own resources.
For more information about JAAS, see the JAAS documentation at http://java.sun.com/products/jaas/reference/docs/index.html
.
JAAS Authentication Development Environment
Whether the client is an application, applet, Enterprise JavaBean (EJB), or servlet that requires authentication, WebLogic Server uses the JAAS classes to reliably and securely authenticate to the server. JAAS implements a Java version of the Pluggable Authentication Module (PAM) framework, which permits applications to remain independent from underlying authentication technologies. Therefore, the PAM framework allows the use of new or updated authentication technologies without requiring modifications to a Java application.
WebLogic Server uses JAAS for remote Java client authentication, and internally for authentication. Therefore, only developers of custom Authentication providers and developers of remote Java client applications need to be involved with JAAS directly. Users of Web browser clients or developers of within-container Java client applications (for example, those calling an EJB from a servlet) do not require direct use or knowledge of JAAS.
Note:
In order to implement security in a WebLogic client you must install the WebLogic Server software distribution kit on the Java client.
The following topics are covered in this section:
JAAS Authentication APIs
To implement Java clients that use JAAS authentication on WebLogic Server, you use a combination of Java EE application programming interfaces (APIs) and WebLogic APIs.
Table 4-1 lists and describes the Java API packages used to implement JAAS authentication. The information in Table 4-1 is taken from the Java API documentation and annotated to add WebLogic Server specific information. For more information on the Java APIs, see the Javadocs at http://java.sun.com/javase/6/docs/api/index.html
andhttp://java.sun.com/javaee/5/docs/api
.
Table 4-1 lists and describes the WebLogic APIs used to implement JAAS authentication. For more information, see Javadocs for WebLogic Classes.
Table 4-1 Java JAAS APIs
Java JAAS API | Description |
---|---|
javax.security.auth.Subject ( |
The |
javax.security.auth.login.LoginContext ( |
The After the caller instantiates a If the To log the For a sample implementation of this class, see Example 4-3. |
javax.security.auth.login.Configuration ( |
This is an abstract class for representing the configuration of LoginModules under an application. The In WebLogic Server, use a login configuration file instead of this class. For a sample configuration file, see Example 4-2. By default, WebLogic Server uses the Sun Microsystems, Inc. configuration class, which reads from a configuration file. |
javax.security.auth.spi.LoginModule ( |
While application developers write to the Note: WebLogic Server provides an implementation of the LoginModule (
|
javax.security.auth. callback.Callback ( |
Implementations of this interface are passed to a
|
javax.security.auth. callback.CallbackHandler ( |
An application implements a
Underlying security services make requests for different types of information by passing individual |
Table 4-2 WebLogic JAAS APIs
WebLogic JAAS API | Description |
---|---|
An authentication class used to authenticate user credentials. The WebLogic implementation of the LoginModule, (
|
|
Underlying security services use this class to instantiate and pass a This callback passes the ContextHandler to LoginModule.login() methods. |
|
Underlying security services use this class to instantiate and pass a |
|
Underlying security services use this class to instantiate and pass a The WebLogic implementation of the
Note: Application developers should not use this class to retrieve URL information. Instead, they should use the weblogic.security.URLCallbackHandler. |
|
This class implements the WebLogic Server client For a sample implementation, see Example 4-5. |
|
The class used by application developers for returning a |
JAAS Client Application Components
At a minimum, a JAAS authentication client application includes the following components:
Java client
The Java client instantiates a
LoginContext
object and invokes the login by calling the object'slogin()
method. Thelogin()
method calls methods in each LoginModule to perform the login and authentication.The LoginContext also instantiates a new empty
javax.security.auth.Subject
object (which represents the user or service being authenticated), constructs the configured LoginModule, and initializes it with this newSubject
andCallbackHandler
.The LoginContext subsequently retrieves the authenticated Subject by calling the LoginContext's
getSubject
method. The LoginContext uses theweblogic.security.Security.runAs()
method to associate theSubject
identity with thePrivilegedAction
orPrivilegedExceptionAction
to be executed on behalf of the user identity.LoginModule
The LoginModule uses the
CallbackHandler
to obtain the user name and password and determines whether that name and password are the ones required.If authentication is successful, the LoginModule populates the Subject with a Principal representing the user. The Principal the LoginModule places in the Subject is an instance of
Principal
, which is a class implementing thejava.security.Principal
interface.You can write LoginModule files that perform different types of authentication, including username/password authentication and certificate authentication. A client application can include one LoginModule (the minimum requirement) or several LoginModules.
Note:
Use of the JAAS javax.security.auth.Subject.doAs methods in WebLogic Server applications do not associate the Subject with the client actions. You can use the doAs methods to implement Java EE security in WebLogic Server applications, but such usage is independent of the need to use the Security.runAs() method.
Callbackhandler
The
CallbackHandler
implements thejavax.security.auth.callback.CallbackHandler
interface. The LoginModule uses theCallbackHandler
to communicate with the user and obtain the requested information, such as the username and password.Configuration file
This file configures the LoginModule(s) used in the application. It specifies the location of the LoginModule(s) and, if there are multiple LoginModules, the order in which they are executed. This file enables Java applications to remain independent from the authentication technologies, which are defined and implemented using the LoginModule.
Action file
This file defines the operations that the client application will perform.
ant
build script (build.xml
)This script compiles all the files required for the application and deploys them to the WebLogic Server applications directories.
For a complete working JAAS authentication client that implements the components described here, see the JAAS sample application in the SAMPLES_HOME\server\examples\src\examples\security\jaas
directory provided with WebLogic Server.
For more information on the basics of JAAS authentication, see Sun's JAAS Authentication Tutorial available athttp://java.sun.com/javase/6/docs/technotes/guides/security/jaas/tutorials/GeneralAcnOnly.html
.
WebLogic LoginModule Implementation
The WebLogic implementation of the LoginModule
class (UsernamePasswordLoginModule.class
) is provided in the WebLogic Server distribution in the weblogic.jar
file, located in the WL_HOME\server\lib
directory.
Note:
WebLogic Server supports all callback types defined by JAAS as well as all callback types that extend the JAAS specification.
The WebLogic Server UsernamePasswordLoginModule
checks for existing system user authentication definitions prior to execution, and does nothing if they are already defined.
For more information about implementing JAAS LoginModules, see the LoginModule Developer's Guide athttp://java.sun.com/javase/6/docs/technotes/guides/security/jaas/JAASLMDevGuide.html
JVM-Wide Default User and the runAs() Method
The first time you use the WebLogic Server implementation of the LoginModule (weblogic.security.auth.login.UsernamePasswordLoginModule
) to log on, the specified user becomes the machine-wide default user for the JVM (Java virtual machine). When you execute the weblogic.security.Security.runAs()
method, it associates the specifiedSubject
with the current thread's access permissions and then executes the action. If a specified Subject
represents a non-privileged user (users who are not assigned to any groups are considered non-privileged), the JVM-wide default user is used. Therefore, it is important make sure that the runAs()
method specifies the desired Subject
. You can do this using one of the following options:
Option 1: If the client has control of
main()
, implement the wrapper code shown in Example 4-1 in the client code.Option 2: If the client does not have control of
main()
, implement the wrapper code shown in Example 4-1 on each thread'srun()
method.
Example 4-1 runAs() Method Wrapper Code
import java.security.PrivilegedAction;
import javax.security.auth.Subject;
import weblogic.security.Security; public class client
{
public static void main(String[] args)
{
Security.runAs(new Subject(),
new PrivilegedAction() {
public Object run() {
//
//If implementing in client code, main() goes here.
//
return null;
}
});
}
}
Writing a Client Application Using JAAS Authentication
To use JAAS in a WebLogic Server Java client to authenticate a subject, perform the following procedure:
Implement
LoginModule
classes for the authentication mechanisms you want to use with WebLogic Server. You will need a LoginModule class for each type of authentication mechanism. You can have multiple LoginModule classes for a single WebLogic Server deployment.Note:
Oracle recommends that you use the implementation of the LoginModule provided by WebLogic Server (weblogic.security.auth.login.UsernamePasswordLoginModule) for username/password authentication. You can write your own LoginModule for username/password authentication, however, do not attempt to modify the WebLogic Server LoginModule and reuse it. If you write your own LoginModule, you must have it call the weblogic.security.auth.Authenticate.authenticate() method to perform the login. If you use a remote login mechanism such as SAML, you do not need to call the authenticate() method. You only need to call authenticate() if you are using WebLogic Server to perform the logon.
The
weblogic.security.auth.Authenticate
class uses a JNDI Environment object for initial context as described in Table 4-1.Implement the
CallbackHandler
class that the LoginModule will use to communicate with the user and obtain the requested information, such as the username, password, and URL. The URL can be the URL of a WebLogic cluster, providing the client with the benefits of server failover. The WebLogic Server distribution provides aSampleCallbackHandler
which is used in the JAAS client sample. TheSampleCallbackHandler.java
code is available as part of the distribution in the directorySAMPLES_HOME
\server\examples\src\examples\security\jaas
.Note:
Instead of implementing your own CallbackHandler class, you can use either of two WebLogic-supplied CallbackHandler classes, weblogic.security.SimpleCallbackHandler or weblogic.security.URLCallbackHandler. For more information on these classes, seeJavadocs for WebLogic Classes.
Write a configuration file that specifies which LoginModule classes to use for your WebLogic Server and in which order the LoginModule classes should be invoked. See Example 4-2 for the sample configuration file used in the JAAS client sample provided in the WebLogic Server distribution.
Example 4-2 sample_jaas.config Code Example
/** Login Configuration for the JAAS Sample Application **/
Sample {
weblogic.security.auth.login.UsernamePasswordLoginModule
required debug=false;
};
In the Java client, write code to instantiate a
LoginContext
. TheLoginContext
consults the configuration file,sample_jaas.config
, to load the default LoginModule configured for WebLogic Server. See Example 4-3 for an exampleLoginContext
instantiation.Note:
If you use another means to authenticate the user, such as an Identity Assertion provider or a remote instance of WebLogic Server, the default LoginModule is determined by the remote source.
Example 4-3 LoginContext Code Fragment
...
import javax.security.auth.login.LoginContext;
...
LoginContext loginContext = null;
try
{
// Create LoginContext; specify username/password login module
loginContext = new LoginContext("Sample",
new SampleCallbackHandler(username, password, url));
}
Invoke the
login()
method of theLoginContext
instance. Thelogin()
method invokes all the loaded LoginModules. Each LoginModule attempts to authenticate the subject. If the configured login conditions are not met, theLoginContext
throws aLoginException
. See Example 4-4 for an example of thelogin()
method.
Example 4-4 Login() Method Code Fragment
...
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import javax.security.auth.login.FailedLoginException;
import javax.security.auth.login.AccountExpiredException;
import javax.security.auth.login.CredentialExpiredException;
...
/**
* Attempt authentication
*/
try
{
// If we return without an exception, authentication succeeded
loginContext.login();
}
catch(FailedLoginException fle)
{
System.out.println("Authentication Failed, " +
fle.getMessage());
System.exit(-1);
}
catch(AccountExpiredException aee)
{
System.out.println("Authentication Failed: Account Expired");
System.exit(-1);
}
catch(CredentialExpiredException cee)
{
System.out.println("Authentication Failed: Credentials
Expired");
System.exit(-1);
}
catch(Exception e)
{
System.out.println("Authentication Failed: Unexpected
Exception, " + e.getMessage());
e.printStackTrace();
System.exit(-1);
}
Write code in the Java client to retrieve the authenticated Subject from the
LoginContext
instance using thejavax.security.auth.Subject.getSubject()
method and call the action as the Subject. Upon successful authentication of a Subject, access controls can be placed upon that Subject by invoking theweblogic.security.Security
.runAs()
method. TherunAs()
method associates the specified Subject with the current thread's access permissions and then executes the action. See Example 4-5 for an example implementation of thegetSubject()
andrunAs()
methods.Note:
Use of the JAAS javax.security.auth.Subject.doAs methods in WebLogic Server applications do not associate the Subject with the client actions. You can use the doAs methods to implement Java EE security in WebLogic Server applications, but such usage is independent of the need to use the Security.runAs() method.
Example 4-5 getSubject() and runAs() Methods Code Fragment
...
/**
* Retrieve authenticated subject, perform SampleAction as Subject
*/
Subject subject = loginContext.getSubject();
SampleAction sampleAction = new SampleAction(url);
Security.runAs(subject, sampleAction);
System.exit(0);
...
Write code to execute an action if the Subject has the required privileges. Oracle provides a a sample implementation,
SampleAction
, of thejavax.security.PrivilegedAction
class that executes an EJB to trade stocks. TheSampleAction.java
code is available as part of the distribution in the directorySAMPLES_HOME\server\examples\src\examples\security\jaas
.Invoke the
logout()
method of theLoginContext
instance. Thelogout()
method closes the user's session and clear theSubject
. See Example 4-6 for an example of thelogin()
method.
Example 4-6 logout() Method Code Example
...
import javax.security.auth.login.LoginContext;
...
try
{
System.out.println("logging out...");
loginContext.logout();
}
Note:
The LoginModule.logout() method is never called for a WebLogic Authentication provider or a custom Authentication provider, because once the Principals are created and placed into a Subject, the WebLogic Security Framework no longer controls the lifecycle of the Subject. Therefore, code that creates the JAAS LoginContext to log in and obtain the Subject should also call the LoginContext to log out. Calling LoginContext.logout() results in the clearing of the Principals from the Subject.
Using JNDI Authentication
Java clients use the Java Naming and Directory Interface (JNDI) to pass credentials to WebLogic Server. A Java client establishes a connection with WebLogic Server by getting a JNDI InitialContext
. The Java client then uses the InitialContext
to look up the resources it needs in the WebLogic Server JNDI tree.
Note:
JAAS is the preferred method of authentication, however, the WebLogic Authentication provider's LoginModule supports only user name and password authentication. Thus, for client certificate authentication (also referred to as two-way SSL authentication), you should use JNDI. To use JAAS for client certificate authentication, you must write a custom Authentication provider whose LoginModule does certificate authentication. For information on how to write LoginModules, seehttp://java.sun.com/javase/6/docs/technotes/guides/security/jaas/JAASLMDevGuide.html
.
To specify a user and the user's credentials, set the JNDI properties listed in Table 4-1.
Table 4-3 JNDI Properties for Authentication
Property | Meaning |
---|---|
INITIAL_CONTEXT_FACTORY |
Provides an entry point into the WebLogic Server environment. The classweblogic.jndi.WLInitialContextFactory is the JNDI SPI for WebLogic Server. |
PROVIDER_URL |
Specifies the host and port of the WebLogic Server that provides the name service. For example: |
SECURITY_PRINCIPAL |
Specifies the identity of the user when that user authenticates to the default (active) security realm. |
SECURITY_CREDENTIALS |
Specifies the credentials of the user when that user authenticates to the default (active) security realm. |
These properties are stored in a hash table that is passed to the InitialContext
constructor. Example 4-7illustrates how to use JNDI authentication in a Java client running on WebLogic Server.
Example 4-7 Example of Authentication
...
Hashtable env = new Hashtable();
env.put(Context.INITIAL_CONTEXT_FACTORY,
"weblogic.jndi.WLInitialContextFactory");
env.put(Context.PROVIDER_URL, "t3://weblogic:7001");
env.put(Context.SECURITY_PRINCIPAL, "javaclient");
env.put(Context.SECURITY_CREDENTIALS, "javaclientpassword");
ctx = new InitialContext(env);
Notes:
For information on JNDI contexts and threads and how to avoid potential JNDI context problems, see "JNDI Contexts and Threads" and"How to Avoid Potential JNDI Context Problems" in Oracle Fusion Middleware Programming JNDI for Oracle WebLogic Server.
In versions of WebLogic Server prior to 9.0, when using protocols other than IIOP with JNDI, the first user is "sticky" in the sense that it becomes the default user when no other user is present. This is not a good practice, as any subsequent logins that do not have a username and credential are granted the identify of the default user.
In version 9.0, this is no longer true and there is no default user.
To return to the previous behavior, the weblogic.jndi.WLContext.ENABLE_DEFAULT_USER field must be set, either via the command line or through the InitialContext interface.
Java Client JAAS Authentication Code Examples
A complete working JAAS authentication sample is provided with the WebLogic Server product. The sample is located in theSAMPLES_HOME\server\examples\src\examples\security\jaas
directory. For a description of the sample and instructions on how to build, configure, and run this sample, see thepackage.html
file in the sample directory. You can modify this code example and reuse it.
reference :http://sqltech.cl/doc/oas11gR1/web.1111/e13711/fat_client.htm#autoId0
Using JAAS Authentication in Java Clients---weblogic document的更多相关文章
- JAAS configuration for Kafka clients
Clients may configure JAAS using the client configuration property sasl.jaas.config or using the sta ...
- JAAS authentication in Tomcat example--reference
In this tutorial you will learn how to configure JAAS authentication in Tomcat using the HTTP Basic ...
- tomcat报错java.lang.IllegalArgumentException: Document base XXXXX does not exist or is not a readable directory
启动tomcat的时候报如下错误: java.lang.IllegalArgumentException: Document base F:\java\tools\tomcat\me-webapps\ ...
- Tomcat的错误 之 java.lang.IllegalArgumentException: Document base * does not exist
Tomcat的异常 之 java.lang.IllegalArgumentException: Document base 有些刚开始使用的Tomcat的朋友会出现的问题,明明已经将某个web应用从t ...
- java.lang.IllegalArgumentException: Document base D:\Project\workspace\space\.metadata\.plugins\org.eclipse.wst.server.core\tmp7\wtpwebapps\Blog
java.lang.IllegalArgumentException: Document base D:\Project\workspace\space\.metadata\.plugins\org. ...
- java.lang.IllegalArgumentException: Document base E:\Eclipse\workspace\.metadata\.plugins\org.eclips
1.错误描述 四月 13, 2015 5:56:55 下午 org.apache.catalina.core.AprLifecycleListener init 信息: The APR based A ...
- Linux下启动tomcat报错RROR org.apache.catalina.core.StandardContext- Error starting static Resources java.lang.IllegalArgumentException: Document base /home/duiba/apache-tomcat/webapps/../webapps/manager do
部署项目的时候,重启tomcat,死活起不来,很郁闷,网上巴拉了半天,结合自己的情况,找到了原因: 错误日志信息: 2018-12-13 13:52:26,992 [main] INFO org.ap ...
- State of the official Elasticsearch Java clients
Elasticsearch Java Clients | Elastic https://www.elastic.co/blog/state-of-the-official-elasticsearch ...
- java.lang.IllegalArgumentException:Document base ……does not exist or is not a readable directory错误的解决方案
关于Tomcat的 Document base ……does not exist or is not a readable directory错误 java.lang.IllegalArgumentE ...
随机推荐
- Linux 下编译、安装、配置 QT
转自Linux 下编译.安装.配置 QT 注意:编译安装耗时费力,且很容易出错,要不断调整编译参数,不推荐使用,否则这将会是一个纠结痛苦的过程. 打算做嵌入式图像处理,计划方案嵌入式Linux+Ope ...
- Delphi XML-RPC 中文乱码解决方法
http://download.csdn.net/user/csm2432/uploads/2
- View以自身中心旋转的代码解惑
matrix.preTranslate(-centerX, -centerY); matrix.postTranslate(centerX, centerY); 经常在中心旋转的应用中看到这段代码. ...
- CopyOnWriteArrayList与Collections.synchronizedList的性能对比
列表实现有ArrayList.Vector.CopyOnWriteArrayList.Collections.synchronizedList(list)四种方式. 1 ArrayList Array ...
- WCF Concurrency (Single, Multiple, and Reentrant) and Throttling
http://www.codeproject.com/Articles/89858/WCF-Concurrency-Single-Multiple-and-Reentrant-and Introduc ...
- Oracle体系结构图
1 oracle数据库主要有数据文件database和数据库实例instance组成.用户通过用户进程链接到server process.在数据库启动的时候,需要依赖于参数文件parameter fi ...
- ubuntu14.04 swap not avalible交换分区不能使用
系统最近特别卡,打开"System monitor"中的resource发现"swap not avalibe".原来系统每交换分区. 我的是笔记本电脑,存储空间有限.首先我下载磁盘分区工具Gpart ...
- opencv 重用代码块记录
Created on 2013-8-7URL : http://blog.sina.com.cn/s/blog_a502f1a30101mfj4.html@author: zhxfl 转载请说明出处 ...
- ubuntu-15.04 下编译 ijkplayer 安卓版
我的环境: 1.win7 主系统 2.VirtualBox 5.1.2 虚拟机 3.ubuntu-15.04-desktop-amd64.iso 镜像文件 4.android-ndk-r10e-lin ...
- 1 storm基本概念 + storm编程规范及demo编写
本博文的主要内容有 .Storm的单机模式安装 .Storm的分布式安装(3节点) .No space left on device .storm工程的eclipse的java编写 http:// ...