org.springframework.security.authentication.jaas
Class JaasAuthenticationProvider

java.lang.Object
  org.springframework.security.authentication.jaas.JaasAuthenticationProvider

All Implemented Interfaces:

EventListener, InitializingBean, ApplicationEventPublisherAware, ApplicationListener<SessionDestroyedEvent>, AuthenticationProvider

public class JaasAuthenticationProvider
extends Object
implements AuthenticationProvider, ApplicationEventPublisherAware, InitializingBean, ApplicationListener<SessionDestroyedEvent>

An AuthenticationProvider implementation that retrieves user details from a JAAS login configuration.

This AuthenticationProvider is capable of validating UsernamePasswordAuthenticationToken requests contain the correct username and password.

This implementation is backed by a JAAS configuration. The loginConfig property must be set to a given JAAS configuration file. This setter accepts a Spring Resource instance. It should point to a JAAS configuration file containing an index matching the loginContextName property.

For example: If this JaasAuthenticationProvider were configured in a Spring WebApplicationContext the xml to set the loginConfiguration could be as follows...

 <property name="loginConfig">
   <value>/WEB-INF/login.conf</value>
 </property>
 

The loginContextName should coincide with a given index in the loginConfig specifed. The loginConfig file used in the JUnit tests appears as the following...

 JAASTest {
   org.springframework.security.authentication.jaas.TestLoginModule required;
 };
 

Using the example login configuration above, the loginContextName property would be set as JAASTest...

  <property name="loginContextName"> <value>JAASTest</value> </property>
 

When using JAAS login modules as the authentication source, sometimes the LoginContext will require CallbackHandlers. The JaasAuthenticationProvider uses an internal CallbackHandler to wrap the JaasAuthenticationCallbackHandlers configured in the ApplicationContext. When the LoginContext calls the internal CallbackHandler, control is passed to each JaasAuthenticationCallbackHandler for each Callback passed.

JaasAuthenticationCallbackHandlers are passed to the JaasAuthenticationProvider through the callbackHandlers property.

 <property name="callbackHandlers">
   <list>
     <bean class="org.springframework.security.authentication.jaas.TestCallbackHandler"/>
     <bean class="org.springframework.security.authentication.jaas.JaasNameCallbackHandler"/>
     <bean class="org.springframework.security.authentication.jaas.JaasPasswordCallbackHandler"/>
  </list>
 </property>
 

After calling LoginContext.login(), the JaasAuthenticationProvider will retrieve the returned Principals from the Subject (LoginContext.getSubject().getPrincipals). Each returned principal is then passed to the configured AuthorityGranters. An AuthorityGranter is a mapping between a returned Principal, and a role name. If an AuthorityGranter wishes to grant an Authorization a role, it returns that role name from it's AuthorityGranter.grant(java.security.Principal) method. The returned role will be applied to the Authorization object as a GrantedAuthority.

AuthorityGranters are configured in spring xml as follows...

 <property name="authorityGranters">
   <list>
     <bean class="org.springframework.security.authentication.jaas.TestAuthorityGranter"/>
   </list>
  </property>
 

A configuration note: The JaasAuthenticationProvider uses the security properites "e;login.config.url.X"e; to configure jaas. If you would like to customize the way Jaas gets configured, create a subclass of this and override the configureJaas(Resource) method.

Field Summary

protected static org.apache.commons.logging.Log

log

Constructor Summary

JaasAuthenticationProvider()

Method Summary

void	afterPropertiesSet()
Authentication	authenticate(Authentication auth) Attempts to login the user given the Authentication objects principal and credential
protected void	configureJaas(Resource loginConfig) Hook method for configuring Jaas.
protected ApplicationEventPublisher	getApplicationEventPublisher()
Resource	getLoginConfig()
protected void	handleLogout(SessionDestroyedEvent event) Handles the logout by getting the SecurityContext for the session that was destroyed.
void	onApplicationEvent(SessionDestroyedEvent event)
protected void	publishFailureEvent(UsernamePasswordAuthenticationToken token, AuthenticationException ase) Publishes the JaasAuthenticationFailedEvent.
protected void	publishSuccessEvent(UsernamePasswordAuthenticationToken token) Publishes the JaasAuthenticationSuccessEvent.
void	setApplicationEventPublisher(ApplicationEventPublisher applicationEventPublisher)
void	setAuthorityGranters(AuthorityGranter[] authorityGranters) Set the AuthorityGranters that should be consulted for role names to be granted to the Authentication.
void	setCallbackHandlers(JaasAuthenticationCallbackHandler[] callbackHandlers) Set the JAASAuthentcationCallbackHandler array to handle callback objects generated by the LoginContext.login method.
void	setLoginConfig(Resource loginConfig) Set the JAAS login configuration file.
void	setLoginContextName(String loginContextName) Set the loginContextName, this name is used as the index to the configuration specified in the loginConfig property.
void	setLoginExceptionResolver(LoginExceptionResolver loginExceptionResolver)
void	setRefreshConfigurationOnStartup(boolean refresh) If set, a call to Configuration#refresh() will be made by #configureJaas(Resource) method.
boolean	supports(Class<? extends Object> aClass) Returns true if this AuthenticationProvider supports the indicated Authentication object.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

log

protected static final org.apache.commons.logging.Log log

Constructor Detail

JaasAuthenticationProvider

public JaasAuthenticationProvider()

Method Detail

afterPropertiesSet

public void afterPropertiesSet()
                        throws Exception

Specified by:

afterPropertiesSet in interface InitializingBean

Throws:

Exception

authenticate

public Authentication authenticate(Authentication auth)
                            throws AuthenticationException

Attempts to login the user given the Authentication objects principal and credential

Specified by:

authenticate in interface AuthenticationProvider

Parameters:

auth - The Authentication object to be authenticated.

Returns:

The authenticated Authentication object, with it's grantedAuthorities set.

Throws:

AuthenticationException - This implementation does not handle 'locked' or 'disabled' accounts. This method only throws a AuthenticationServiceException, with the message of the LoginException that will be thrown, should the loginContext.login() method fail.

configureJaas

protected void configureJaas(Resource loginConfig)
                      throws IOException

Hook method for configuring Jaas.

Parameters:

loginConfig - URL to Jaas login configuration

Throws:

IOException - if there is a problem reading the config resource.

handleLogout

protected void handleLogout(SessionDestroyedEvent event)

Handles the logout by getting the SecurityContext for the session that was destroyed. MUST NOT use SecurityContextHolder as we are logging out a session that is not related to the current user.

Parameters:

event -

onApplicationEvent

public void onApplicationEvent(SessionDestroyedEvent event)

Specified by:

onApplicationEvent in interface ApplicationListener<SessionDestroyedEvent>

publishFailureEvent

protected void publishFailureEvent(UsernamePasswordAuthenticationToken token,
                                   AuthenticationException ase)

Publishes the JaasAuthenticationFailedEvent. Can be overridden by subclasses for different functionality

Parameters:

token - The authentication token being processed

ase - The excetion that caused the authentication failure

publishSuccessEvent

protected void publishSuccessEvent(UsernamePasswordAuthenticationToken token)

Publishes the JaasAuthenticationSuccessEvent. Can be overridden by subclasses for different functionality.

Parameters:

token - The token being processed

setAuthorityGranters

public void setAuthorityGranters(AuthorityGranter[] authorityGranters)

Set the AuthorityGranters that should be consulted for role names to be granted to the Authentication.

Parameters:

authorityGranters - AuthorityGranter array

See Also:

JaasAuthenticationProvider

setCallbackHandlers

public void setCallbackHandlers(JaasAuthenticationCallbackHandler[] callbackHandlers)

Set the JAASAuthentcationCallbackHandler array to handle callback objects generated by the LoginContext.login method.

Parameters:

callbackHandlers - Array of JAASAuthenticationCallbackHandlers

getLoginConfig

public Resource getLoginConfig()

setLoginConfig

public void setLoginConfig(Resource loginConfig)

Set the JAAS login configuration file.

Parameters:

loginConfig -

See Also:

JAAS Reference

setLoginContextName

public void setLoginContextName(String loginContextName)

Set the loginContextName, this name is used as the index to the configuration specified in the loginConfig property.

Parameters:

loginContextName -

setLoginExceptionResolver

public void setLoginExceptionResolver(LoginExceptionResolver loginExceptionResolver)

setRefreshConfigurationOnStartup

public void setRefreshConfigurationOnStartup(boolean refresh)

If set, a call to Configuration#refresh() will be made by #configureJaas(Resource) method. Defaults to true.

Parameters:

refresh - set to false to disable reloading of the configuration. May be useful in some environments.

See Also:

SEC-1320

supports

public boolean supports(Class<? extends Object> aClass)

Description copied from interface: AuthenticationProvider

Returns true if this AuthenticationProvider supports the indicated Authentication object.

Returning true does not guarantee an AuthenticationProvider will be able to authenticate the presented instance of the Authentication class. It simply indicates it can support closer evaluation of it. An AuthenticationProvider can still return null from the AuthenticationProvider.authenticate(Authentication) method to indicate another AuthenticationProvider should be tried.

Selection of an AuthenticationProvider capable of performing authentication is conducted at runtime the ProviderManager.

Specified by:

supports in interface AuthenticationProvider

Returns:

true if the implementation can more closely evaluate the Authentication class presented

setApplicationEventPublisher

public void setApplicationEventPublisher(ApplicationEventPublisher applicationEventPublisher)

Specified by:

setApplicationEventPublisher in interface ApplicationEventPublisherAware

getApplicationEventPublisher

protected ApplicationEventPublisher getApplicationEventPublisher()