Bug 53777 - Ability to bundle JAAS Configuration in Webappp
Ability to bundle JAAS Configuration in Webappp
Status: RESOLVED FIXED
Product: Tomcat 7
Classification: Unclassified
Component: Catalina
unspecified
All All
: P2 enhancement with 1 vote (vote)
: ---
Assigned To: Tomcat Developers Mailing List
:
Depends on:
Blocks:
  Show dependency tree
 
Reported: 2012-08-24 13:50 UTC by eolivelli
Modified: 2013-07-01 15:01 UTC (History)
0 users



Attachments
This is a subclass of JASSRealm that implements the feature (7.33 KB, text/plain)
2012-08-24 15:05 UTC, eolivelli
Details
Patch on JAASRealm (tomcat 7 trunk) (4.67 KB, patch)
2012-08-24 15:29 UTC, eolivelli
Details | Diff
Patch on JAASRealm (tomcat 7 trunk) (4.22 KB, patch)
2012-08-26 15:51 UTC, eolivelli
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description eolivelli 2012-08-24 13:50:52 UTC
I would like to let JAASRealm to load JAAS Configuration from a .properties file bundled in a web application (either in WEB-INF/classes or in any JAR on the classpath of the context)

Actually (7.0.29) JAASRealm creates a LoginContext using the 2-args constructor
loginContext = new LoginContext(appName, callbackHandler); 

I propose to add a new configuration parameter on JAASRealm to let it load a javax.security.auth.login.Configuration from the ContextClassLoader

this new Configuration has to be passed to the 4-args constructor
loginContext = new LoginContext(appName, subject, callbackHandler, configuration); 

http://docs.oracle.com/javase/6/docs/api/javax/security/auth/login/LoginContext.html#LoginContext%28java.lang.String,%20javax.security.auth.Subject,%20javax.security.auth.callback.CallbackHandler,%20javax.security.auth.login.Configuration%29
Comment 1 eolivelli 2012-08-24 14:55:18 UTC
method parseClassNames in JAASRealm sometimes (not always) uses as ContextClassLoader this one

WebappClassLoader
  context: /manager
  delegate: false
  repositories:
----------> Parent Classloader:
org.apache.catalina.loader.StandardClassLoader@9fa0f19

In my case this causes JASSRealm not to find custom Principal classes (userClassNames and roleClassNames)
Comment 2 eolivelli 2012-08-24 15:05:45 UTC
Created attachment 29274 [details]
This is a subclass of JASSRealm that implements the feature
Comment 3 eolivelli 2012-08-24 15:29:46 UTC
Created attachment 29275 [details]
Patch on JAASRealm (tomcat 7 trunk)

I tried to write a patch against JAASREalm.java (don't know if it is the correct format)

Patch is for Tomcat 7 trunk

this is what is does:
- adds "configfile" property (will be resolved as ClassLoader.getResource().toURI) to require the use of a custom JAAS Configuration file
- instantiates a "sun" ConfigFile (using Reflection) to have a Configuration
- uses the 4-args constructor of LoginContext (in order to use the custom configuration)
- sets a work-around for a bug in Realm setup (parseClassNames) because sometimes that method is not called with a good contextclassloader
Comment 4 Konstantin Kolinko 2012-08-25 14:18:30 UTC
(In reply to comment #1)
> method parseClassNames in JAASRealm sometimes (not always) uses as
> ContextClassLoader this one
> 
> WebappClassLoader
>   context: /manager
>   delegate: false
>   repositories:
> ----------> Parent Classloader:
> org.apache.catalina.loader.StandardClassLoader@9fa0f19
> 
> In my case this causes JASSRealm not to find custom Principal classes
> (userClassNames and roleClassNames)

If your <Realm> is in conf/context.xml this behaviour is as expected,
because the conf/context.xml file is shared by all web applications, including the Manager one.

If you observe it is different circumstances, please file a separate bug report and include the stacktrace from the thread that calls parseClassNames.
(If TCCL is set incorrectly by the calling thread that would be a bug).
Comment 5 eolivelli 2012-08-26 06:49:27 UTC
Sorry,
I was using TomEE (Tomcat + OpenEJB).
With a raw Tomcat the problem does not happen, I reported this problem on OpenEJB list
Comment 6 eolivelli 2012-08-26 15:51:00 UTC
Created attachment 29280 [details]
Patch on JAASRealm (tomcat 7 trunk)

Updating the patch, without the workaround for TomEE cl bug (that has been resolved too, in openejb trunk)
Comment 7 Mark Thomas 2013-07-01 15:01:12 UTC
Thanks for the patch.

It has been applied (with minor changes) to trunk and 7.0.x and will be included in 7.0.42 onwards. I also added some documentation for the new option.