Developing a Bulletproof Access Control System for a Java Web Application - Secure Java: For Web Application Development - page 152

ORJLQ

uses

/RJLQ&RQWH[W

JHW6XEMHFW

ORJRXW

Application

what
/RJLQ0RGXOH to
be used

loads

Configuration
Information

to
understand

/RJLQ&RQWH[W

-QGL/RJLQ0RGXOH

.UE/RJLQ0RGXOH

Authenticating
Mechanisms

interfaces
with

/RJLQ0RGXOH

17/RJLQ0RGXOH

8QL[/RJLQ0RGXOH

LQLWLDOL]H

/RJLQ

/RJLQ0RGXOH

&RPPLW

$ERUW

ORJRXW

Figure 7.5 Process of authentication using JAAS.

◾ NTLoginModule —his module uses the current user's underlying Microsoft's NT oper-

ating environment's security information to authenticate.

he LoginModule interface has ive methods— i n itialize(), lo gi n(), c o m m it(),
a b or t(), and logout() . hese modules need to be appropriately implemented by the devel-
oper relecting the needs of the authentication part of the Web application.

◾ initialize() —his method is called after the LoginModule is constructed.

◾

login() —his method performs the authentication.

commit()

◾

—his method is called by the LoginContext after it has accepted the results
from all LoginModules deined for this application. he principals and credentials are
assigned to the subject at this stage.
abort() ◾ —his method is called when any LoginModule for this application fails. No

principals or credentials are assigned to the subject when this method is invoked.
logout() ◾

—Invocation of this method removes the principals and credentials associated
with the subject in consideration.

7.4.3.3 Authorization Classes and Interfaces

here are three authorization-speciic classes/interfaces in the JAAS module. hey are the Policy
abstract class and the AuthPermission and PrivateCredentialPermission classes.
We will irst describe the functionalities of these classes and interfaces: