Example of Configuration File jps-config.xml

22-4 Oracle Fusion Middleware Application Security Guide OPSS APIs includes the interface oracle.security.jps.service.login.LoginService which allows a Java SE application to invoke not just all login modules in a stack, but a subset of them in a prescribed order. The name of the jps context defined in the configuration file jps-config-jse.xml passed to the method LoginContext in the LoginService interface which is determines the stack of login modules that an application uses. The standard JAAS API LoginContext can also be user to invoke the login modules defined in the default context. The sequence in which a jps context lists the login modules in a stack is significant, since the authentication algorithm takes this order into account in addition to other data, such as the flag that identifies the module security level required, sufficient, requisite, or optional. Out-of-the-box, the identity store service is file-based, its contents being provisioned the file system-jazn-data.xml, but it can be reconfigured to be an LDAP-based identity store. OPSS supports the Identity Store login module in Java SE applications, which can be used for authentication or identity assertion. Identity Store Login Module The class associated with this login module is the following: oracle.security.jps.internal.jaas.module.idstore.IdStoreLoginModule An instance of this module is configured in the file jps-config-jse.xml as illustrated in the following fragment: serviceInstance name=idstore.loginmodule provider=jaas.login.provider descriptionIdentity Store Login Moduledescription property name=loginModuleClassName value=oracle.security.jps.internal.jaas.module.idstore.IdStoreLoginModule property name=jaas.login.controlFlag value=REQUIRED serviceInstance Properties specific to this login module include the following: remove.anonymous.role defaults to true add.application.role defaults to true

22.2.3.2 Using the Identity Store Login Module for Authentication

This section illustrates the use of the Identity Store login module for basic username and password authentication. Invoke IdStoreLoginModule The following code fragment illustrates how to set a callback handler and a context: import javax.security.auth.Subject; import javax.security.auth.login.LoginContext; Subject sub = new Subject; CallbackHandler cbh = new YourCallbackHandler; LoginContext context = new LoginContextappName, subject, cbh; context.login; Authentication for Java SE Applicaitons 22-5 The callback handler must be able to handle NameCallback and PasswordCallback. Configure jps-config-jse.xml The following jps-config-jse.xml fragment illustrates the configuration of the context appName: jpsContext name=appName serviceInstanceRef ref=jaaslm.idstore1 jpsContext serviceProvider type=JAAS_LM name=jaaslm.idstore class=oracle.security.jps.internal.jaas.module.idstore.IdStoreLoginModule descriptionIdentity Store-based LoginModule description serviceProvider serviceInstance name=jaaslm.idstore1 provider=jaaslm.idstore property name=jaas.login.controlFlag value=REQUIRED property name=debug value=true property name=addAllRoles value=true serviceInstance Write the Callback Handler The following code snippet illustrates a callback handler able to handle name and password callback: import javax.security.auth.callback.; import java.io.IOException; public class SampleCallbackHandler implements CallbackHandler { For namepassword callbacks private String name = null;private char[] password = null; public SampleCallbackHandlerString name, char[] pwd { if name == null || name.length == 0 throw new IllegalArgumentExceptionInvalid name ; else this.name = name; if pwd == null || pwd.length == 0 throw new IllegalArgumentExceptionInvalid password ; else this.password = pwd; } public String getName { return name; } public char[] getPassword { return password; } public void handleCallback[] callbacks throws IOException, UnsupportedCallbackException { if callbacks = null callbacks.length 0 { for Callback c : callbacks { if c instanceof NameCallback { NameCallback c.setNamename; } else if c instanceof PasswordCallback { PasswordCallback c.setPasswordpassword; } else { throw new UnsupportedCallbackExceptionc; 22-6 Oracle Fusion Middleware Application Security Guide } } } } }

22.2.3.3 Using the Identity Login Module for Assertion

To use the Identity Store login module for assertion, a developer must: ■ Provide the appropriate permission for the caller to execute the protected method setIdentity. This requires granting the permission oracle.security.jps.JpsPermission with the name IdentityAssertion. ■ Implement a callback handler that uses the class oracle.security.jps.callback.IdentityCallback as shown in the code sample below. The above two requirements are illustrated in the following configuration and code samples. Provisioning the JpsPermission The following configuration sample illustrates a grant allowing the code MyApp the required JpsPermission to execute protected methods in the assertion login module: grant grantee codesource urlfile:{soa.oracle.home}applicationmyApp.earurl -- soa.oracle.home is a system property set when the server JVM is started -- codesource grantee permissions permission classoracle.security.jps.JpsPermissionclass nameIdentityAssertionname permission permissions grant The following configuration sample illustrates a grant allowing the principal jdoe the required JpsPermission to execute the assertion login module: grant grantee principals principal classweblogic.security.principal.WLSUserImplclass namejdoename principal principals grantee permissions permission classoracle.security.jps.JpsPermissionclass nameIdentityAssertionname permission permissions Authentication for Java SE Applicaitons 22-7 grant Implementing the CallbackHandler The following code fragment illustrates an implementation of the callback handler: import javax.security.auth.callback.Callback; import javax.security.auth.callback.CallbackHandler; import javax.security.auth.callback.NameCallback; import javax.security.auth.callback.PasswordCallback; import javax.security.auth.callback.UnsupportedCallbackException; import oracle.security.jps.callback.IdentityCallback; public class CustomCallbackHandler implements CallbackHandler { private String name = null; private char[] password; public CustomCallbackHandlerString name { this.name = name; } public CustomCallbackHandlerString name, char[] password { this.name = name; this.password = password; } public void handleCallback[] callbacks throws IOException, UnsupportedCallbackException { for Callback callback : callbacks { if callback instanceof NameCallback { NameCallback nc = NameCallback callback; nc.setNamename; } else if callback instanceof PasswordCallback { PasswordCallback pc = PasswordCallback callback; pc.setPasswordpassword; } else if callback instanceof IdentityCallback { IdentityCallback idcb = IdentityCallbackcallback; idcb.setIdentityname; idcb.setIdentityAssertedtrue; idcb.setAuthenticationTypeCUSTOM; } else { throw exception throw new UnsupportedCallbackExceptioncallback; } } } } The following code fragment illustrates the implementation of a login module: import javax.security.auth.callback.CallbackHandler; import javax.security.auth.login.LoginContext; import oracle.security.jps.service.JpsServiceLocator; import oracle.security.jps.service.login.LoginService; public class LoginModuleExample { private static final String CONTEXT_NAME = JSE_UserAuthnAssertion; 22-8 Oracle Fusion Middleware Application Security Guide public LoginModuleExample { super; } public Subject assertUserfinal String username throws Exception { CallbackHandler cbh = AccessController.doPrivilegednew PrivilegedExceptionActionCallbackHandler { public CallbackHandler run throws Exception { return new CustomCallbackHandlerusername; } }; Subject sub = new Subject; LoginService ls = JpsServiceLocator.getServiceLocator.lookupLoginService.class; LoginContext context = ls.getLoginContextsub, cbh; context.login; Subject s = context.getSubject; return s; } public Subject authenticatefinal String username, final char[] password throws Exception { CallbackHandler cbh = new CustomCallbackHandlerusername, password; Subject sub = new Subject; LoginService ls = JpsServiceLocator.getServiceLocator.lookupLoginService.class; LoginContext context = ls.getLoginContextsub, cbh; context.login; Subject s = context.getSubject; return s; } public static void mainString[] args { LoginModuleExample loginModuleExample = new LoginModuleExample; try { System.out.printlnauthenticated user subject = + loginModuleExample.authenticatetestUser, welcome1.toCharArray; System.out.printlnasserted user subject = + loginModuleExample.assertUsertestUser; } catch Exception e { e.printStackTrace; } } }

22.2.4 Using the OPSS API LoginService in Java SE Applications

To invoke a login module programmatically in Java SE applications, use the method getLoginContext of the interface oracle.security.jps.service.login.LoginService. Similar to the method LoginContext in the standard JAAS API, getLoginContext returns an instance of a LoginContext object that can be used to authenticate a user,