Integration with JBoss/Jetty

Hi All,

New to securityfilter, couldn't find any talk of integration with
JBoss/Jetty, so did a little playing of my own and came up with the
following code. It's a realm class that authenticates the user against
the Web application's realm (usually via JAAS in JBoss).

The nice upside is that the Principal is correctly instantiated (well
appears to be) within the container and so propagated to the EJB layer.

Regards,

Sean

(I'm no JBoss expert, but it works for me and would value anyone else
who knows better, their opinion).

-- 
Dr. Sean Radford, MBBS, MSc
<[email protected]>
http://bladesys.demon.co.uk/
Blade Systems

============================================================

/*
 * @author sradford
 * <p>Created 07-Jul-2003</p>
 * <p>Copyright © 2002-2003, Aegeus Technology Limited.
 * <p>All rights reserved.</p>
 * <p>Use at you desire with no liability to the author.</p>
 */
package com.aegeus.securityfilter

import java.security.Principal;
import java.util.HashSet;
import java.util.Set;

import javax.naming.Context;
import javax.naming.InitialContext;
import javax.naming.NamingException;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.jboss.security.AuthenticationManager;
import org.jboss.security.RealmMapping;
import org.jboss.security.SecurityAssociation;
import org.jboss.security.SimplePrincipal;
import org.jboss.security.SubjectSecurityManager;
import org.securityfilter.realm.SecurityRealmInterface;

/**
 * @author sradford
 *
 */
public class JBossRealm implements SecurityRealmInterface {

	private static final Log log = LogFactory.getLog(JBossRealm.class);

	private InitialContext iniCtx = null;
	private Context securityCtx = null;


	/* (non-Javadoc)
	 * @see
org.securityfilter.realm.SecurityRealmInterface#authenticate(java.lang.String, java.lang.String)
	 */
	public Principal authenticate(String username, String password) {
		try {
			SubjectSecurityManager subSecMgr = getSecurityManager();
			SimplePrincipal p = new SimplePrincipal(username);
			char[] pChars = password.toCharArray();
			if (subSecMgr.isValid(p, pChars)) {
				SecurityAssociation.setPrincipal(p);
				SecurityAssociation.setCredential(pChars);
				return p;
			}
		} catch (Exception e) {
			log.debug(e);
		}
		return null;
	}


	/* (non-Javadoc)
	 * @see
org.securityfilter.realm.SecurityRealmInterface#isUserInRole(java.security.Principal, java.lang.String)
	 */
	public boolean isUserInRole(Principal principal, String rolename) {
		Set set = new HashSet();
		set.add(new SimplePrincipal(rolename));
		try {
			return getRealmMapping().doesUserHaveRole(principal, set);
		} catch (NamingException e) {
			log.debug(e);
			return false;
		}
	}

	private SubjectSecurityManager getSecurityManager()
		throws NamingException {
		try {
			AuthenticationManager authMgr =
				(AuthenticationManager) getSecurityContext().lookup(
					"securityMgr");
			if (authMgr instanceof SubjectSecurityManager) {
				return (SubjectSecurityManager) authMgr;
			}
			throw new IllegalStateException(
				"java:comp/env/security is not of type SubjectSecurityManager: "
					+ authMgr.getClass().getName());
		} catch (NamingException e) {
			log.error(
				"java:comp/env/security does not appear to be correctly set up",
				e);
			throw e;
		}
	}

	private RealmMapping getRealmMapping() throws NamingException {
		try {
			return (RealmMapping) getSecurityContext().lookup("realmMapping");
		} catch (NamingException e) {
			log.error(
				"java:comp/env/security does not appear to be correctly set up",
				e);
			throw e;
		}

	}

	private synchronized InitialContext getInitialContext()
		throws NamingException {
		if (iniCtx == null) {
			iniCtx = new InitialContext();
		}
		return iniCtx;
	}

	private synchronized Context getSecurityContext() throws
NamingException {
		if (securityCtx == null) {
			securityCtx =
				(Context) getInitialContext().lookup("java:comp/env/security");
		}
		return securityCtx;
	}


}



-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01