Recently we refactored and enabled Digest authentication support for both HTTP and SIP Container in Sun Java System Communication Application Server(SJSCAS/Sailfin).Supporting digest authentication with different backends can be done by writing custom Login modules and a custom realm. 1.Custom Login Module
2.Custom Realm
1.Custom Login module:
can be provided either by extendingcom.sun.enterprise.security.auth.login.DigestLogin abstract class or by implementing javax.security.auth.spi.LoginModule standard interface. If one chooses to extend from DigestLogin module class then below mentioned abstract method has to be implemented. The getGroups method returns all the groups the user belongs to.
protected abstract Enumeration getGroups(String username);
The login module has to be configured in login.conf file under $AS_INSTALL_HOME/domains/domain1/config/login.conf directory.
Eg: of JDBC Digest Login module in login.conf file is shown below
++++++
/* Copyright 2004 Sun Microsystems, Inc. All rights reserved. */
/* SUN PROPRIETARY/CONFIDENTIAL. Use is subject to license terms. */
fileRealm {
com.sun.enterprise.security.auth.login.FileLoginModule required;
};
ldapRealm {
com.sun.enterprise.security.auth.login.LDAPLoginModule required;
};
solarisRealm {
com.sun.enterprise.security.auth.login.SolarisLoginModule required;
};
jdbcRealm {
com.sun.enterprise.security.auth.login.JDBCLoginModule required;
};
jdbcDigestRealm {
com.sun.enterprise.security.auth.login.JDBCDigestLoginModule required;
};
++++++
Sample implementation of DigestLogin Module is shown below.
public class JDBCDigestLoginModule extends DigestLoginModule {
public JDBCDigestLoginModule() {
}
protected Enumeration getGroups(String username) {
try {
return this.getRealm().getGroupNames(username);
} catch (InvalidOperationException ex) {
Logger.getLogger("global").log(Level.SEVERE, null, ex);
} catch (NoSuchUserException ex) {
Logger.getLogger("global").log(Level.SEVERE, null, ex);
}
return null;
}
}
2.Custom Realm :
Inorder to provide a custom realm one has to write a new custom realm[1] or modfiy existing realms by extending from com.sun.enterprise.security.auth.realm.DigestRealmBase abstract class. The method validate is an abstract method in DigestRealmBase.
public boolean validate(String username, DigestAlgorithmParameter[] params);
the implementors validate function will have to retrieve the password from the backend and invoke the validate method of the super class. The validate method syntax of the super class DigestRealmBase is shown below. The validate method will return true if digest validation has succeeded or false if digest does not match. The DigestAlgorithmParameter parameter shown below represents the digest algorithm parameters retrieved from incoming SIP/HTTP request.
protected final boolean validate(Password passwd, DigestAlgorithmParameter[] params) throws NoSuchAlgorithmException ;
com.sun.enterprise.security.auth.digest.api.Password is used to pass the password either a prehashed (username+realmname+password) password or plain text password to validate the digest.
public interface Password {
public static final int PLAIN_TEXT= 0;
public static final int HASHED = 1;
/**
* returns PLAIN_TEXT or HASHED.
* @returns int
*/
public int getType();
/**
* returns password.
* @returns byte[]
*/
public byte[] getValue();
}
This custom realm can be configured for use in SIP/HTTP applications as described in docs [2].
You can download sailfin/SJSCAS builds from https://sailfin.dev.java.net/.
[1]http://docs.sun.com/app/docs/doc/819-3659/6n5s6m58k?a=view
[2]http://docs.sun.com/app/docs/doc/819-3658/6n5s5nkmq?l=en&a=view#ablpi
Note : Interfaces and classes described above are subject to improvement and change in future milestone releases of SJSCAS
Powered by ScribeFire.
