Use the Java Authentication and Authorization Service model for Web authentication

WAS supports the Java EE declarative security model. We can define the authentication and access control policy using the Java EE deployment descriptor. We can further stack custom login modules to customize the WAS authentication mechanism.

A custom login module can perform principal and credential mapping, custom security token and custom credential-processing, and error-handling among other possibilities. Typically, you do not need to use application code to perform authentication function. Use the programming techniques that are described in this section if we have to perform authentication function in application code. For example, if we have applications that programmed to the SSOAuthenticator helper function, we can use the following programming interface. The SSOAuthenticator helper function was deprecated starting with WAS V4.0. Use declarative security as a rule; use the techniques that are described in this section as a last resort.

When the LTPA mechanism SSO option is enabled, the Web client login session is tracked by an LTPA SSO token cookie after successful login. At logout, this token is deleted to terminate the login session, but the server-side subject is not deleted. When you use the declarative security model, the WAS Web container performs client authentication and login session management automatically. We can perform authentication in application code by setting a login page without a Java EE security constraint and by directing client requests to the login page first. Your login page can use the Java Authentication and Authorization Service (JAAS) model to perform authentication. To enable WAS Web login modules to generate SSO cookies, use the following steps.

 

1. Create a new system login JAAS configuration. To access the panel, click...
   Security | Global security

   Under Java Authentication and Authorization Service, click System logins.

2. Manually clone the WEB_INBOUND login configuration, and give it a new alias. To clone the login configuration, click New, enter a name for the configuration, click Apply, then click JAAS login modules under Additional properties. Click New and configure the JAAS login module.

   See Login module settings for Java Authentication and Authorization Service. WAS Web container uses the WEB_INBOUND login configuration to authenticate Web clients.

   Changing the WEB_INBOUND login configuration affects all Web apps in the cell. You should create our own login configuration by cloning the contents of the WEB_INBOUND login configuration.

3. Select the wsMapDefaultInboundLoginModule login module and click Custom properties. There are two login modules defined in the login configuration: ltpaLoginModule and wsMapDefaultInboundLoginModule.

4. Add a login property name cookie with a value of true.

   The two login modules are enabled to generate LTPA SSO cookies. Do not add the cookie login option to the original WEB_INBOUND login configuration.

5. Stack the custom LoginModule(s) in the new login configuration (optional).

6. Use the login page for programmatic login by perform a JAAS LoginContext.login using the newly defined login configuration. After a successful login, either the ltpaLoginModule or the wsMapDefaultInboundLoginModule generates an LTPA SSO cookie upon a successful authentication. Exactly which LoginModule generates the SSO cookie depends on many factors, including system authentication configuration and runtime condition (which is beyond the scope of this section).

7. Call the modified WSSubject.setRunAsSubject method to add the subject to the authentication cache. The subject must be a JAAS subject created by LoginModule. Adding the subject to the authentication cache recreates a subject from SSO token.

8. Use the programmatic logout page to revoke SSO cookies by invoking the revokeSSOCookies method from the WSSecurityHelper class. The term cookies is used because WAS Release 5.1.1 (and later) release supports a new LTPA SSO token with a different encryption algorithm, but can be configured to generate the original LTPA SSO token for backward compatibility. Note that the subject is still in the authentication cache and only the SSO cookies are revoked.

 

Example

Use the following code sample to perform authentication.

Avoid trouble: If we set the password for the WSCallbackHandlerFactoryset factory class for getting handlers to null, as is done in the following example, you allow identity assertion without a password.

Suppose you wrote a LoginServlet.java:

  Import com.ibm.wsspi.security.auth.callback.WSCallbackHandlerFactory;
  Import com.ibm.websphere.security.auth.WSSubject;

  public Object login(HttpServletRequest req, HttpServletResponse res) 
  throws ServletException {

  PrintWriter out = null;
  try {
    out =  res.getWriter();
      res.setContentType("text/html");
  } catch (java.io.IOException e){
    
// Error handling
  }

  Subject subject = null;
  try {
  LoginContext lc = new LoginContext("system.Your_login_configuration", WSCallbackHandlerFactory.getInstance().getCallbackHandler( userid, null, password, req, res, null));
    lc.login();
    subject = lc.getSubject();
      WSSubject.setRunAsSubject(subject);
  } catch(Exception e) {
    
// catch all possible exceptions if we want or handle them separately
    out.println("Exception in LoginContext login + Exception = " +
 e.getMessage());
    throw new ServletException(e.getMessage());
  }
 
The following is sample code to revoke the SSO cookies upon a programming logout:

 The LogoutServlet.java:

  public void logout(HttpServletRequest req, HttpServletResponse res,  Object retCreds)  throws ServletException {
     PrintWriter out =null;
     try {
       out =  res.getWriter();
        res.setContentType("text/html");
     } catch (java.io.IOException e){
      
// Error Handling
     }
     try {
        WSSecurityHelper.revokeSSOCookies(req, res);
     } catch(Exception e) {
       
// catch all possible exceptions if we want or handle them separately
       out.println("JAASLogoutServlet: logout Exception = " + e.getMessage());
       throw new ServletException(e);
     }
   }

 

Next steps

See on JAAS authentication, refer to Develop programmatic logins with the Java Authentication and Authorization Service.

See on the AuthenLoginModule login module, refer to Example: Customizing a server-side Java Authentication and Authorization Service authentication and login configuration.

Develop custom login modules for a system login configuration for JAAS
Customizing application login with Java Authentication and Authorization Service

 

Related concepts

Programmatic login for JAAS

 

Related tasks

Develop programmatic logins with the Java Authentication and Authorization Service
Authenticate users

 

Related

Customizing a server-side Java Authentication and Authorization Service authentication and login configuration