Example 2. java.security entry for login module configuration

login.config.url.1=file:${java.home}/lib/security/tagish.login
login.config.url.2=file:${java.home}/lib/security/struts.login

This entry specifies the location of files containing authentication scheme definitions. Also, note that java system properties may be referenced in java.security.

Example 3. Setting the location of the login scheme configuration file on the command line

$ java ... \
-Djava.security.auth.login.config==$JAVA_HOME/jre/lib/security/tagish.login ...

Example 6. The authenticate Method of the FileAuth Class

     1	    public boolean authenticate() {
     2	        try {
     3	            lc = new LoginContext("FileLogin", \
                        new MyCallBackHandler(username,password));
     4	            lc.login();
     5	        } catch (LoginException le) {
     6	            return false;
     7	        }
     8	        return true;
     9	    }

On line 3, the LoginContext object is told to look for the FileLogin authentication scheme, and passed a custom callback handler. Normally, callback handlers interact with the user and retrieve information needed for authentication, but the ActionForm class has already done this. In a way, the form is a "call forward" handler, because the request/response paradigm of the web does not fit well with the client/server architecture of which the callback handler is part. The problem is worked around by passing the needed information to the callback handler on instantiation.

On line 4, the LoginContext attempts to login the user via the modules found in the FileLogin authentication scheme. If the login fails for any reason, a LoginException will be thrown, otherwise flow continues normally. A Subject is instantiated by the login module and exposed as a property of the LoginContext object. The Subject is also populated with the Principals associated with that user by the login module.

Example 7. The FileAuth Class Exposes the Subject

     1	    public Subject getSubject() {
     2	        if (lc == null) {
     3	            throw new IllegalStateException("either login failed or \
                the authenticate method hasn't been called.");
     5	        } else {
     6	            return lc.getSubject();
     7	        }
     8	    }

The getSubject method can only be called after the authenticate method.

Example 9. java.security entry for permission policy configuration

auth.policy.url.1=file:${java.home}/lib/security/struts.policy
auth.policy.url.2=file:${user.home}/.struts.policy

This example should check the policy files in both places. Note also that java system properties can be referenced in the java.security file.

Example 10. Setting the location of the JAAS policy file on the command line

$ java ... \
-Djava.security.auth.policy==$JAVA_HOME/jre/lib/security/struts.policy ...

This command line overrides any previously set location of the JAAS policy file. If there was only one =, the property would indicate an additional policy file path.

Example 12. The Overridden process Method

     1	   protected void process(HttpServletRequest request, \
            HttpServletResponse response)
     2	   throws ServletException, java.io.IOException
     3	   {
     4	       String loginPage = request.getContextPath()+"/logon.do";
     5	       String pageReq = request.getRequestURI();
     6	       Permission perm = \
                PermissionFactory.getInstance().getPermission(pageReq);
     7	       Subject subject = \
                ((Subject)(request.getSession().getAttribute( \
                    Auth.SUBJECT_SESSION_KEY)));
     8	       if (subject == null && \
                (! request.getRequestURI().equals(loginPage))) {
     9	           // redirect to login page
    10	       } else if (subject == null &&  \
                request.getRequestURI().equals(loginPage)) {
    11	           // login page is always permitted
    12	            super.process(request,response);
    13	
    14	       } else {
    15              if ( ! AuthUtils.permitted(subject, perm) ) {
    16  	           // subject is not permitted; redirect to error page
    17  	    } else {
    18	                super.process(request,response);
    19	            }
    20	        }
    21	   }

Lines 6 and 7 get needed information including the Permission that represents the URL the user is trying to access (PermissionFactory is a factory class that returns the appropriate Permission), and the cached Subject.

Example 13. An Abridged Permission Checking Class

     1	package com.xor.auth;
     2	
     3	import java.security.*;
     4	import javax.security.auth.*;
     5	import java.util.*;
     6	
     7	public class AuthUtils {
     8	
     9	    static public boolean permitted(Subject subj, final Permission p) {
    10	        final SecurityManager sm;
    11	        if (System.getSecurityManager() == null) {
    12	            sm = new SecurityManager();
    13	        } else {
    14	            sm = System.getSecurityManager();
    15	        }
    16	        try {
    17	            Subject.doAsPrivileged(subj, new PrivilegedExceptionAction() {
    18	                public Object run() { 
    19	                    sm.checkPermission(p);
    20	                    return null;
    21	                }
    22	                },null);
    23	            return true;
    24	        } catch (AccessControlException ace) {
    25	            return false;
    26	        } catch (PrivilegedActionException pae) {
    27	            return false;
    28	        }
    29	    }
    30	}

The example has had all logging, error checking and comments removed for brevity. Production code should, for example, test to see that neither the Permission nor the Subject are null.