jespa.security

Class LoginModule

java.lang.Object

jespa.security.LoginModule

All Implemented Interfaces:

javax.security.auth.spi.LoginModule

public class LoginModule
extends java.lang.Object
implements javax.security.auth.spi.LoginModule

A JAAS LoginModule that uses a Jespa SecurityProvider to validate credentials (the Jespa NtlmSecurityProvider is the default).

IMPORTANT: If you are using the NtlmSecurityProvider (which is the default provider) this LoginModule will not work until you create a Computer account as described in the Installation section in the Jespa Operator's Manual.

JAAS LoginModules are described in detail in the JAAS LoginModule Developer's Guide.

The following table describes the options supported by this login module. Options prefixed with "jespa." will be stripped of the prefix and passed through to the SecurityProvider constructor.

Options for LoginModule

Option	Description
useFirstPass	The account name and password will be queried from shared state using the "javax.security.auth.login.name" and "javax.security.auth.login.password" keys. If the authentication fails, a LoginException is thrown.
tryFirstPass	The account name and password will be queried from shared state using the "javax.security.auth.login.name" and "javax.security.auth.login.password" keys. If the authentication fails, the CallbackHandler is tried. If the CallbackHandler fails or is not supplied, a LoginException is thrown.
storePass	Stores the account name and password acquired during authentication into the shared state with the keys "javax.security.auth.login.name" and "javax.security.auth.login.password" for use by subsequent LoginModules.
doNotPrompt	Do not use the CallbackHandler to prompt the caller for a password.
principal	Specifies the account name being authenticated.
provider.classname	Specifies an alternative Jespa SecurityProvider that should be used to authenticate the supplied credentials. If this proeprty is not set, the default value is "jespa.ntlm.NtlmSecurityProvider".

If authentication fails due to a SecurityProviderException with a status code of either STATUS_ACCOUNT_NOT_FOUND or STATUS_INVALID_CREDENTIALS, a FailedLoginException will be thrown - otherwise a LoginException is thrown.

The NtlmSecurityProvider (which is the default security provider used by this LoginModule) requires the following options to authenticate users against the NETLOGON service:

Options for the NtlmSecurityProvider

Option	Description	Example
jespa.bindstr	The fully qualified DNS domain name the Active Directory domain against which clients will be authenticated. The fully qualified DNS hostname of a specific AD server may also be specified.	example.com
jepsa.service.acctname	The qualified Computer account name.	JESPA1$@EXAMPLE.COM
jepsa.service.password	The password for the above account	a89609c53443ce1c72e59275a8a1e1ce

Constructor Summary

Constructors

Constructor and Description
LoginModule()

Method Summary

Modifier and Type	Method and Description
boolean	abort()
boolean	commit()
protected boolean	getOptionAsBoolean(java.lang.String name, boolean def)
void	initialize(javax.security.auth.Subject subject, javax.security.auth.callback.CallbackHandler callbackHandler, java.util.Map sharedState, java.util.Map options)
boolean	login()
boolean	logout()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

LoginModule

public LoginModule()

Method Detail

initialize

public void initialize(javax.security.auth.Subject subject,
                       javax.security.auth.callback.CallbackHandler callbackHandler,
                       java.util.Map sharedState,
                       java.util.Map options)

Specified by:

initialize in interface javax.security.auth.spi.LoginModule

getOptionAsBoolean

protected boolean getOptionAsBoolean(java.lang.String name,
                                     boolean def)

login

public boolean login()
              throws javax.security.auth.login.LoginException

Specified by:

login in interface javax.security.auth.spi.LoginModule

Throws:

javax.security.auth.login.LoginException

commit

public boolean commit()
               throws javax.security.auth.login.LoginException

Specified by:

commit in interface javax.security.auth.spi.LoginModule

Throws:

javax.security.auth.login.LoginException

abort

public boolean abort()
              throws javax.security.auth.login.LoginException

Specified by:

abort in interface javax.security.auth.spi.LoginModule

Throws:

javax.security.auth.login.LoginException

logout

public boolean logout()
               throws javax.security.auth.login.LoginException

Specified by:

logout in interface javax.security.auth.spi.LoginModule

Throws:

javax.security.auth.login.LoginException