Java Authentication and Authorization Service JAAS

Authentication Providers 4-5

4.1.3 Java Authentication and Authorization Service JAAS

Whether the client is an application, applet, Enterprise JavaBean EJB, or servlet that requires authentication, WebLogic Server uses the Java Authentication and Authorization Service JAAS classes to reliably and securely authenticate to the client. JAAS implements a Java version of the Pluggable Authentication Module PAM framework, which permits applications to remain independent from underlying authentication technologies. Therefore, the PAM framework allows the use of new or updated authentication technologies without requiring modifications to your application. WebLogic Server uses JAAS for remote fat-client authentication, and internally for authentication. Therefore, only developers of custom Authentication providers and developers of remote fat client applications need to be involved with JAAS directly. Users of thin clients or developers of within-container fat client applications for example, those calling an Enterprise JavaBean EJB from a servlet do not require the direct use or knowledge of JAAS.

4.1.3.1 How JAAS Works With the WebLogic Security Framework

Generically, authentication using the JAAS classes and WebLogic Security Framework is performed in the following manner: 1. A client-side application obtains authentication information from a user or system process. The mechanism by which this occurs is different for each type of client. 2. The client-side application can optionally create a CallbackHandler containing the authentication information. a. The client-side application passes the CallbackHandler to a local client-side LoginModule using the LoginContext class. The local LoginModule could be UsernamePasswordLoginModule, which is provided as part of WebLogic Server. b. The local LoginModule passes the CallbackHandler containing the authentication information to the appropriate WebLogic Server container for example, RMI, EJB, servlet, or IIOP. Note: For more information about the LoginModule control flag setting and the LoginModule interface, see the Java Authentication and Authorization Service JAAS 1.0 LoginModule Developers Guide http:java.sun.comsecurityjaasdocmodule.html and the J2SE 6.0 API Specification for the LoginModule interface http:java.sun.comjavase6docsapijavaxsecurit yauthspiLoginModule.html , respectively. 4-6 Developing Security Providers for Oracle WebLogic Server 3. The WebLogic Server container calls into the WebLogic Security Framework. If there is a client-side CallbackHandler containing authentication information, this is passed into the WebLogic Security Framework. 4. For each of the configured Authentication providers, the WebLogic Security Framework creates a CallbackHandler using the authentication information that was passed in. These are internal CallbackHandlers created on the server-side by the WebLogic Security Framework, and are not related to the clients CallbackHandler. 5. The WebLogic Security Framework calls the LoginModule associated with the Authentication provider that is, the LoginModule that is specifically designed to handle the authentication information. The LoginModule attempts to authenticate the client using the authentication information. 6. If the authentication is successful, the following occurs: a. Principals users and groups are signed by a Principal Validation provider to ensure their authenticity between programmatic server invocations. For more Note: A CallbackHandler is a highly-flexible JAAS standard that allows a variable number of arguments to be passed as complex objects to a method. There are three types of CallbackHandlers: NameCallback, PasswordCallback, and TextInputCallback, all of which reside in the javax.security.auth.callback package. The NameCallback and PasswordCallback return the username and password, respectively. TextInputCallback can be used to access the data users enter into any additional fields on a login form that is, fields other than those for obtaining the username and password. When used, there should be one TextInputCallback per additional form field, and the prompt string of each TextInputCallback must match the field name in the form. WebLogic Server only uses the TextInputCallback for form-based Web application login. For more information about CallbackHandlers, see the J2SE 6.0 API Specification for the CallbackHandler interface http:java.sun.comjavase6docsapijavaxsecurit yauthcallbackCallbackHandler.html . For more information about the LoginContext class, see the J2SE 6.0 API Specification for the LoginContext class http:java.sun.comjavase6docsapijavaxsecurit yauthspiLoginModule.html . For more information about the UsernamePasswordLoginModule, see the WebLogic Server API Reference Javadoc for the UsernamePasswordLoginModule class. If you do not want to use a client-side LoginModule, you can specify the username and password in other ways: for example, as part of the initial JNDI lookup. Note: For more information about LoginModules, see Section 4.1.2, LoginModules. Authentication Providers 4-7 information about Principal Validation providers, see Chapter 6, Principal Validation Providers. b. The LoginModule associates the signed principals with a subject, which represents the user or system process being authenticated. For more information about subjects and principals, see Section 4.1.1, Users and Groups, Principals and Subjects.

4.1.3.2 Example: Standalone T3 Application

Figure 4–3 illustrates how the JAAS classes work with the WebLogic Security Framework for a standalone, T3 application, and an explanation follows. Figure 4–3 Authentication Using JAAS Classes and WebLogic Server For this example, authentication using the JAAS classes and WebLogic Security Framework is performed in the following manner: 1. The T3 application obtains authentication information username, password, and URL from a user or system process. 2. The T3 application creates a CallbackHandler containing the authentication information. a. The T3 application passes the CallbackHandler to the UsernamePasswordLoginModule using the LoginContext class. Note: For authentication performed entirely on the server-side, the process would begin at step 3, and the WebLogic Server container would call the weblogic.security.services.authentication.login method prior to step 4. 4-8 Developing Security Providers for Oracle WebLogic Server b. The UsernamePasswordLoginModule passes the CallbackHandler containing the authentication information that is, username, password, and URL to the WebLogic Server RMI container. 3. The WebLogic Server RMI container calls into the WebLogic Security Framework. The client-side CallbackHandler containing authentication information is passed into the WebLogic Security Framework. 4. For each of the configured Authentication providers, the WebLogic Security Framework creates a CallbackHandler containing the username, password, and URL that was passed in. These are internal CallbackHandlers created on the server-side by the WebLogic Security Framework, and are not related to the clients CallbackHandler. 5. The WebLogic Security Framework calls the LoginModule associated with the Authentication provider that is, the LoginModule that is specifically designed to handle the authentication information. The LoginModule attempts to authenticate the client using the authentication information. 6. If the authentication is successful, the following occurs: a. Principals users and groups are signed by a Principal Validation provider to ensure their authenticity between programmatic server invocations. b. The LoginModule associates the signed principals with a subject, which represents the user or system being authenticated. c. The WebLogic Security Framework returns the authentication status to the T3 client application, and the T3 client application retrieves the authenticated subject from the WebLogic Security Framework.

4.2 The Authentication Process