Example: A custom single sign-on token login module
This file shows how to determine if the login is an initial login or a propagation login.
For information on initialization and on what to do during login and commit, see Develop custom login modules for a system login configuration for JAAS.
public customLoginModule() { public void initialize(Subject subject, CallbackHandler callbackHandler, Map sharedState, Map options) { _sharedState = sharedState; } public boolean login() throws LoginException { // Handles the WSTokenHolderCallback to see if this is an initial or // propagation login. Callback callbacks[] = new Callback[1]; callbacks[0] = new WSTokenHolderCallback("Authz Token List: "); try { callbackHandler.handle(callbacks); } catch (Exception e) { // handle exception } // Receives the ArrayList of TokenHolder objects (the serialized tokens) List authzTokenList = ((WSTokenHolderCallback) callbacks[0]).getTokenHolderList(); if (authzTokenList != null) { // iterate through the list looking for the custom token for (int i=0; i for (int i=0; i<authzTokenList.size(); i++) { TokenHolder tokenHolder = (TokenHolder)authzTokenList.get(i); // Looks for the name and version of the custom SingleSignonToken // implementation if (tokenHolder.getName().equals("myCookieName") && tokenHolder.getVersion() == 1) { // Passes the bytes into the custom SingleSignonToken constructor // to deserialize customSSOToken = new com.ibm.websphere.security.token.CustomSingleSignonTokenImpl (tokenHolder.getBytes()); } } } else // This is not a propagation login. Create a new instance of the // SingleSignonToken implementation { // Gets the principal from the default SingleSignonToken. This principal // must match all tokens. defaultAuthToken = (com.ibm.wsspi.security.token.AuthenticationToken) sharedState.get(com.ibm.wsspi.security.auth.callback.Constants.WSAUTHTOKEN_KEY); String principal = defaultAuthToken.getPrincipal(); // Adds a new custom single sign-on (SSO) token. This is an initial login. // Pass the principal into the constructor customSSOToken = new com.ibm.websphere.security.token. CustomSingleSignonTokenImpl(principal); // add any initial attributes if (customSSOToken != null) { customSSOToken.addAttribute("key1", "value1"); customSSOToken.addAttribute("key1", "value2"); customSSOToken.addAttribute("key2", "value1"); customSSOToken.addAttribute("key3", "something different"); } } // Note: We can add the token to the Subject during commit in case something // happens during the login. } public boolean commit() throws LoginException { if (customSSOToken != null) { // Sets the customSSOToken token into the Subject try { public final SingleSignonToken customSSOTokenPriv = customSSOToken; // Do this in a doPrivileged code block so that application code does not // need to add additional permissions java.security.AccessController.doPrivileged(new java.security.PrivilegedAction() { public Object run() { try { // Adds the custom SSO token if it is not null and // not already in the Subject if ((customSSOTokenPriv != null) && (!subject.getPrivateCredentials(). contains(customSSOTokenPriv))) { subject.getPrivateCredentials(). add(customSSOTokenPriv); } } catch (Exception e) { throw new WSLoginFailedException (e.getMessage(), e); } return null; } }); } catch (Exception e) { throw new WSLoginFailedException (e.getMessage(), e); } } } // Defines the login module variables com.ibm.wsspi.security.token.SingleSignonToken customSSOToken = null; com.ibm.wsspi.security.token.AuthenticationToken defaultAuthToken = null; java.util.Map _sharedState = null; }
Related tasks
Implement a custom authorization token for security attribute propagation Develop custom login modules for a system login configuration for JAAS