Details

    • Type: Bug
    • Status: Open (View Workflow)
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: 6.0.0.Final
    • Fix Version/s: None
    • Component/s: Security
    • Labels:
      None
    • Environment:

      Windows XP
      JBoss AS 6.0.0.Final
      JavaSE 1.6.0_17

      Description

      I wrote a custom login module and configured it at login-config.xml as follows:

        <application-policy name="MyRealm">
          <authentication>
            <login-module code="com.example.MyLoginModule" flag="required">
      	<module-option name="principalClass">com.example.UserPrincipal</module-option>
              <module-option name="debug">true</module-option>
            </login-module>
          </authentication>
        </application-policy>
      

      In a second step I wrote a simple JSF application that performs the login using HttpServletRequest.login() that works very well.
      Finally I used HttpServletRequest.getUserPrincipal() to retrieve the custom principal created during the login process.
      On JBoss I'll just get a JBoss internal org.jboss.security.SimplePrincipal and I have to use PolicyContext.getContext("javax.security.auth.Subject.container") to get the desired principal.

      The custom login module implements javax.security.auth.spi.LoginModule and is not derived from org.jboss.security.auth.spi.UsernamePasswordLoginModule since it should work on any JavaEE Container.
      As far as I understood the specification the element <module-option name="principalClass"> should be used to achieve this behavior.

        Gliffy Diagrams

          Attachments

            Activity

              People

              • Assignee:
                anil.saldhana Anil Saldanha
                Reporter:
                feichtegger Michael Feichtegger
              • Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                • Created:
                  Updated: