[jetty-user] Custom JAAS Form authentication

Hi,

I'm trying to customize a JAAS based Form authentication, by extending 
the FormAuthenticator class, but I'm running into a few issues and maybe 
I don't have the right approach.

I have a custom LoginModule and basically I'd like to build upon the 
FormAuthenticator in order to
- provide Authentication caching to achieve Single Sign On accross webapps
- display the login failure cause on the form
- enable specific redirections based on JAAS roles

My first problem is that the JAASLoginService catches all 
LoginExceptions thrown by my LoginModule and only returns null in case 
of failure.
This leaves me with no option to convey the root cause information (bad 
login? bad password? account expired?...).
Subclassing doesn't seem to be an elegant option: since I only want the 
exception, I end up copying most of the code from Jetty sources, 
including some private methods!

My second problem is about redirections.
Once authenticated, the FormAuthenticator naturally redirects the user 
to the original requested URL, but sometimes I'll need to redirect to 
another information page first.
Of course when I try another redirect, I get an "IllegalStateException: 
committed".
One typical use case is upon first login, the user is requested to 
change his password. This case is translated by the LoginModule in a 
special role which triggers the redirection.


Of course, all this can be implemented if I just copy hundreds of lines 
from the Jetty sources and insert my specific needs but it seems awfully 
inelegant and makes me very dependent on the evolutions of Jetty... 
there must be another way!


I hope this wan't too confusing.
Please advise.

Thanks,
-arjun


---------------------------------------------------------------------
To unsubscribe from this list, please visit:

    http://xircles.codehaus.org/manage_email