Programatic JAAS authentication in a web application on NetWeaver AS

[Former Member]

Not sure whether this forum is meant for JAAS related discussions. If any moderator feels this the wrong place to ask this question, please move it to an appropriate forum.

We have a J2EE application deployed on NetWeaver application server. We use programattic JAAS login through a Custom Login Module. We followed the steps mentioned at:

http://help.sap.com/saphelp_nw2004s/helpdata/en/95/fcd340fa1a732ae10000000a155106/content.htm

Our's is a web application and the user information is propagated to the custom login module through servlets. We have been observing that the login does not succeed unless you add the users (along with the password) in the SAP's UME store.

1) Why would we be required to add the user information to the UME store even when we are using the custom login module? Or are we missing something here?

2) We have configured the login module as mentioned at:

http://help.sap.com/saphelp_nw2004s/helpdata/en/07/0ce13d8ee4535ee10000000a114084/frameset.htm

(Haven't followed the step 3 over there "Remove a registered login module". Is this required?)

Any help is appreciated.

Thanks.

[Former Member]

Not sure whether this forum is meant for JAAS related discussions. If any moderator feels this the wrong place to ask this question, please move it to an appropriate forum.

We have a J2EE application deployed on NetWeaver application server. We use programattic JAAS login through a Custom Login Module. We followed the steps mentioned at:

http://help.sap.com/saphelp_nw2004s/helpdata/en/95/fcd340fa1a732ae10000000a155106/content.htm

Our's is a web application and the user information is propagated to the custom login module through servlets. We have been observing that the login does not succeed unless you add the users (along with the password) in the SAP's UME store.

1) Why would we be required to add the user information to the UME store even when we are using the custom login module? Or are we missing something here?

2) We have configured the login module as mentioned at:

http://help.sap.com/saphelp_nw2004s/helpdata/en/07/0ce13d8ee4535ee10000000a114084/frameset.htm

(Haven't followed the step 3 over there "Remove a registered login module". Is this required?)

Any help is appreciated.

Thanks.

[Former Member]

Hi,

yes you are missing something here

The JAAS modules will just populate information the UME uses for user management. If you do not put the user in shared stated or the user does not exist, the authentication can not succeed. So they are there to serve the UME as a tool to identify the users. They are still maintained in the UME. Maybe the info <a href="https://www.sdn.sap.comhttp://www.sdn.sap.comhttp://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/library/uuid/b311df90-0201-0010-068e-fe6a496259ff">from this presentation</a> can help.

Did you intend to create your own user management ?

Step 3 is only required if you want to delete a module.

Regards,

Patrick

[Former Member]

Patrick,

That presentation was exactly what i was looking for. That will now help me to explain in more detail as to what i am looking for. I am new to NetWeaver and have been working mainly on WebSphere and JBoss, so some of NetWeaver terms that i use might not be the correct ones.

That presentation mentions that there are 2 options for authenticating users (slide 16). One is Container based authentication and the other is the UME based authentication. If i have understood this correctly, Container based authentication is what we are looking for. We have the following scenario in our application:

- Some user accesses our login page and submits his username and password

- The application then passes this information to a servlet

- This servlet programatically does a JAAS login using the LoginModule that we have configured.

- The custom login module class has some logic written to check whether the username and password are correct (authentication). This logic can be anything and is solely left the implementing class. Depending on the outcome of this logic, the login will either fail or pass.

Now given this scenario and the presentation that you mentioned, our application would be using Container based authentication and NOT UME based authentication. Is this correct?

Do we follow the same steps to configure the login modules both for UME as the Container-based authentication?

The whole reason why i am behind this is, it does not make sense (may be because i havent completely got a grasp of how JAAS is configured in NetWeaver) that we have to put in the user information in the SAP user store which defeats the whole purpose of having our own custom login module which would be responsible for maintaining/interacting with this user information.

[Former Member]

Hi Jaikiran,

container based auth is referring to J2EE Security. In this case, you just configure this in the web.xml of your application. In this case, the app is only invoked after the user has been authenticated.

As you outline your app, it makes use of programmatic authentication, i.e. asking the system to authenticate the user, potentialy after doing some interactions with him. This can be done using J2EE security and UME API. For a better explanation I would like to refer you to <a href="http://help.sap.com/saphelp_nw2004s/helpdata/en/21/f8424089ff2571e10000000a155106/frameset.htm">Tutorials for using Roles and Permissions</a>. There the different mechanics and the APIs are explained.

If you hae access to the teched Materials for 2005, you can also have a look at the session AGS350, which was about the UME based approach.

Actually, what I would recommend, is not to do the authentication on your own, but leave this to the app server, if it is only userid and password stuff.

Maybe you could explain to me, why maintaing your own users makes more sense, then leaving this to the UME. You can not use J2EE security nor UME security this way, but will have to code all the authorizations including the management parts on your own.

Kind regards,

Patrick

[Former Member]

Patrick, you have been of great help so far. Thanks for the same. I apologise for the delay in replying.

This application that i am talking about is already deployed on WebSphere and currently we are trying to port it to various application servers, one of them being NetWeaver. If i have to go for the UME approach, then it would mean that the application would have to rely on the server specific authentication. UME is specific to NetWeaver is not available on other server. Each server will have it own login modules. In order to avoid having server specific logic, we have our own custom login module which relies on its own user data store. My understanding was, the main intention of allowing custom login modules was to provide the freedom to the application to do whatever it has to do during the authentication.

You are right when you say that the application will have to take of coding the authorization process. This is already in place.

Going by the resources that you pointed me to, there appears to be no way to not let the UME come into picture while doing the authentication in NetWeaver, isnt it?

[Former Member]

Hi,

from the login module perspective, you can do close to everything you like, the only thing required is, that you put a username in shared state which is also configured in the UME persistence. Otherwise the authentication will fail (if it would not, J2EE security would not work).

From an application perspective, this is not the case. There is no standard for user management on JEE servers (maybe there will be one in the future). If you do not want to create you own security functions within your application (in which case, you would not even need to have a login module), you have to rely on the standard functions from the SUN JEE specs or you can use UME Security.

Regards,

Patrick