Developing a Bulletproof Access Control System for a Java Web Application - Secure Java: For Web Application Development - page 147

7.4.3 JAAS Core

he core classes and interfaces the JAAS can be classiied into the following three categories:

◾

Common classes

◾ Authorization classes and interfaces Authentication classes and interfaces

◾

Figure 7.3 provides an overview of these core classes and interfaces of the JAAS module.

7.4.3.1 Common Classes

As the name suggests, the classes and interfaces that are shared by both authentication and autho-
rization operations are termed as common classes . here are three of them, namely, subject class,
principal class, and credentials class.
A subject represents a source of a request and represents an entity such as a person or a service.
A subject will be associated with two main attributes— principals and credentials . In JAAS, both
these attributes are also represented by Java classes. We will irst deine these two classes (and
attributes) before arriving at the description of the term subject .

Policy

LoginContext

Subject

LoginModule

PrivateCredentialPermission

Principal

CallbackHandler

Credential

Callback

AuthPermission

Authentication Common Authorization

Figure 7.3 Core Classes and Interfaces of JAAS.