Java Authentication and Authorization Service, or JAAS, pronounced "Jazz", is the Java implementation
of the standard Pluggable Authentication Module information security framework.
JAAS was introduced as an extension library to the Java Platform, Standard Edition 1.3
and was integrated in version 1.4.
The main goal of JAAS is to separate the concerns of user authentication so that they may be
managed independently.
While the former authentication mechanism contained information about where the code
originated from and who signed that code, JAAS adds a marker about who runs the code.
By extending the verification vectors JAAS extends the security architecture for Java
applications that require authentication and authorization modules.
Administration For the system administrator, JAAS consists
of two kinds of configuration file: *.login.conf: specifies how to plug vendor-supplied
login modules into particular applications *.policy: specifies which identities are granted
which permissions For example, an application may have this
login.conf file indicating how different authentication mechanisms are to be run to authenticate the
user:
PetShopApplication { com.sun.security.auth.module.LdapLoginModule
sufficient; com.foo.SmartcardLoginModule requisite;
com.sun.security.auth.module.UnixLoginModule required debug=true;
}
Application interface For the application developer, JAAS is a standard
library that provides: a representation of identity and a set of
credentials a login service that will invoke your application
callbacks to ask the user things like username and password.
It returns a new Subject a service that tests if a Subject was granted
a permission by an administrator.
Security system integration For the security system integrator, JAAS provides
interfaces: to provide your identity namespace to applications
to attach credentials to threads for developing login modules.
Your module invokes callbacks to query the user, checks their response and generates
a Subject.
Login Modules Login modules are primarily concerned with
authentication rather than authorization and form a widely used component of JAAS.
A login module is required to implement the javax.security.auth.spi.LoginModule interface,
which specifies the following methods: Note: A Subject is the user that is attempting
to log in.
initialize: Code to initialize the login module, usually by storing the parameters passed into
appropriate fields of the Class.
login: Actually check the credentials provided via an Object that implements the javax.security.auth.Callback
interface.
This method could prompt the user for their login and password or it could use details
previously obtained.
It is important to note here that, if invalid credentials are supplied then a javax.security.auth.login.FailedLoginException
should be thrown.
commit: The identity of the subject has been verified, so code in this method sets up the
Principal and Groups for the successfully authenticated subject.
This method has to be written carefully in enterprise applications as Java EE application
servers often expect the relationships between the Principal and Group objects to be set
up in a certain way.
This method should throw a javax.security.auth.login.FailedLoginException if authentication fails.
abort: Called if the authentication process itself fails.
If this method returns false, then this Login Module is ignored.
logout: Code that should be executed upon logout.
Login modules can provide single sign on via a particular SSO protocol/framework, can check
for the presence of hardware security tokens, e.t.c.
In an n-tier application, Login Modules can be present on both the client side and server
side.
LoginModule Login modules are written by implementing
this interface; they contain the actual code for authentication.
It can use various mechanisms to authenticate user credentials.
The code could retrieve a password from a database and compare it to the password supplied
to the module.
LoginContext The login context is the core of the JAAS
framework which kicks off the authentication process by creating a Subject.
As the authentication process proceeds, the subject is populated with various principals
and credentials for further processing.
Subject A subject represents a single user, entity
or system –in other words, a client– requesting authentication.
Principal A principal represents the face of a subject.
It encapsulates features or properties of a subject.
A subject can contain multiple principals.
Credentials Credentials are nothing but pieces of information
regarding the subject in consideration.
They might be account numbers, passwords, certificates etc.
As the credential represents some important information, the further interfaces might
be useful for creating a proper and secure credential – javax.security.auth.Destroyable
and javax.security.auth.Refreshable.
Suppose that after the successful authentication of the user you populate the subject with
a secret ID with which the subject can execute some critical services, but the credential
should be removed after a specific time.
In that case, one might want to implement the Destroyable interface.
Refreshable might be useful if a credential has only a limited timespan in which it is
valid.
Form Authentication Form authentication is another commonly used
part of JAAS.
In this process the user is typically presented with a web page containing a form asking for
a username and password.
This data is then submitted via POST to a URL containing the text "j_security_check",
e.g. www.example.com/j_security_check . The credentials are checked on the server side
and a session ID is returned to the client via a cookie.
This authentication method is flexible in that a Java HTTP client such as Apache HTTP
client can be used in place of a web-browser, e.g. in a desktop application, as long as
the following standard steps are followed: Request a protected URL in web.xml.
The server will return a redirect to the security check URL mentioned above along with a cookie
containing the session ID.
Send the username and password along with the cookie via an HTTP POST to the security
check URL.
If authentication is successful, the server will send a 302 back to the original protected
URL.
Send a GET request to that URL, passing the session ID cookie.
Additional assertions can be added to the above process.
See also Apache Shiro
Keystore References
External links JAAS Tutorial
jGuard : open source project which can secure standalone or web applications based on JAAS
All that JAAS - Java World