This section covers the following topics:
The following realms are supported in the Application Server:
For detailed information about configuring each of these realms, see How to Configure a Realm.
You can configure a realm in one of these ways:
Use the asadmin create-auth-realm command to configure realms on local servers. For details, see the Sun Java System Application Server Platform Edition 9 Reference Manual.
sun-application element in sun-application.xml
web-app element in web.xml
as-context element in sun-ejb-jar.xml
client-container element in sun-acc.xml
client-credential element in sun-acc.xml
If modules within an application specify realms, these are ignored. If present, the realm defined in sun-application.xml is used, otherwise the domain’s default realm is used.
For example, a realm is specified in sun-application.xml as follows:
<sun-application> ... <realm>ldap</realm> </sun-application>
For more information about the deployment descriptor files and elements, see Appendix A, Deployment Descriptor Files, in Sun Java System Application Server Platform Edition 9 Application Deployment Guide.
You can create a custom realm by providing a custom Java Authentication and Authorization Service (JAAS) login module class and a custom realm class. Note that client-side JAAS login modules are not suitable for use with the Application Server.
JAAS is a set of APIs that enable services to authenticate and enforce access controls upon users. JAAS provides a pluggable and extensible framework for programmatic user authentication and authorization. JAAS is a core API and an underlying technology for Java EE security mechanisms. For more information about JAAS, refer to the JAAS specification for Java SDK, available at http://java.sun.com/products/jaas/.
For general information about realms and login modules, see “Chapter 29: Introduction to Security in Java EE” in the Java EE 5 Tutorial.
For Javadoc tool pages relevant to custom realms, go to http://glassfish.dev.java.net/nonav/javaee5/api/index.html and click on the com.sun.appserv.security package.
Custom login modules must extend the com.sun.appserv.security.AppservPasswordLoginModule class. This class implements javax.security.auth.spi.LoginModule. Custom login modules must not implement LoginModule directly.
Custom login modules must provide an implementation for one abstract method defined in AppservPasswordLoginModule:
abstract protected void authenticateUser() throws LoginException
This method performs the actual authentication. The custom login module must not implement any of the other methods, such as login(), logout(), abort(), commit(), or initialize(). Default implementations are provided in AppservPasswordLoginModule which hook into the Application Server infrastructure.
The custom login module can access the following protected object fields, which it inherits from AppservPasswordLoginModule. These contain the user name and password of the user to be authenticated:
protected String _username; protected String _password;
The authenticateUser() method must end with the following sequence:
String grpList; // populate grpList with the set of groups to which // _username belongs in this realm, if any return commitUserAuthentication(_username, _password, _currentRealm, grpList);
public void init(Properties props) throws BadRealmException, NoSuchRealmException
This method is invoked during server startup when the realm is initially loaded. The props argument contains the properties defined for this realm in domain.xml. The realm can do any initialization it needs in this method. If the method returns without throwing an exception, the Application Server assumes that the realm is ready to service authentication requests. If an exception is thrown, the realm is disabled.
public String getAuthType()
This method returns a descriptive string representing the type of authentication done by this realm.
public abstract Enumeration getGroupNames(String username) throws InvalidOperationException, NoSuchUserException
This method returns an Enumeration (of String objects) enumerating the groups (if any) to which the given username belongs in this realm.