WAS v8.5 > Secure applications > Authenticate users > Propagating security attributes among application servers

Use the default authorization token to propagate security attributes

This topic explains how WebSphere Application Server uses the default authorization token. Consider using the default authorization token when we are looking for a place to add string attributes that get propagated downstream. However, make sure the attributes you add to the authorization token are specific to the user associated with the authenticated Subject. If they are not specific to a user, the attributes probably belong in the propagation token, which is also propagated with the request. For more information on the propagation token, see Use the default propagation token to propagate security attributes. To add attributes into the authorization token, you must plug in a custom login module into the various system login modules configured. Any login module configuration that has the com.ibm.ws.security.server.lm.wsMapDefaultInboundLoginModule implementation configured can receive propagated information and can generate propagation information that can be sent outbound to another server.

If propagated attributes are not presented to the login configuration during an initial login, a default authorization token is created in the wsMapDefaultInboundLoginModule login module after the login occurs in the ltpaLoginModule login module. We can obtain a reference to the default authorization token from the login method using the sharedState hashmap. You must plug in the custom login module after the wsMapDefaultInboundLoginModule implementation for WAS to see the default authorization token.

For more information on the Java Authentication and Authorization Service (JAAS) programming model, see the Security: Resources for learning article.


Example

The following example shows the complete task of obtaining a reference to the default authorization token from the login method, adding attributes to the token, and reading from the existing attributes used for authorization. 

public customLoginModule() 
{
 public void initialize(Subject subject, CallbackHandler callbackHandler, 
          Map sharedState, Map options) 
 {
     // (For more information on initialization, see      //  Develop custom login modules for a system login configuration for JAAS.)

  // Get a reference to the sharedState map that is passed in during initialization.
  _sharedState = sharedState;
 }

 public boolean login() throws LoginException 
 {
     // (For more information on what to do during login, see      //  Develop custom login modules for a system login configuration for JAAS.)

  // Look for the default AuthorizationToken in the shared state   defaultAuthzToken  = (com.ibm.wsspi.security.token.AuthorizationToken) 
       sharedState.get 
     (com.ibm.wsspi.security.auth.callback.Constants.WSAUTHZTOKEN_KEY);

  // Might not always have one of these generated. It depends on the login 
     // configuration setup.
  if (defaultAuthzToken != null)
  {
   try    {
    // Add a custom attribute     defaultAuthzToken.addAttribute("key1", "value1");

    // Determine all of the attributes and values that exist in the token.
    java.util.Enumeration listOfAttributes = defaultAuthorizationToken.
              getAttributeNames();
    
    while (listOfAttributes.hasMoreElements())
    {
     String key = (String) listOfAttributes.nextElement();

     String[] values = (String[]) defaultAuthorizationToken.getAttributes (key);

     for (int i=0;  i<values.length; i++)
     {
      System.out.println ("Key: " + key + ", Value[" + i + "]: " 
                  + values[i]);
     }
    }

    // Read the existing uniqueID attribute.
    String[]  uniqueID = defaultAuthzToken.getAttributes 
      (com.ibm.wsspi.security.token.AttributeNameConstants.
               WSCREDENTIAL_UNIQUEID);

     // Getthe uniqueID from the String[]
     String unique_id = (uniqueID != null && 
                uniqueID[0] != null) ? uniqueID[0] : "";

    // Read the existing expiration attribute.
    String[]  expiration = defaultAuthzToken.getAttributes 
      (com.ibm.wsspi.security.token.AttributeNameConstants.
               WSCREDENTIAL_EXPIRATION);

     // An example of getting a long expiration value from the string array.
     long expire_time = 0;
     if (expiration != null && expiration[0] != null) 
      expire_time = Long.parseLong(expiration[0]);

    // Read the existing display name attribute.
    String[]  securityName = defaultAuthzToken.getAttributes 
      (com.ibm.wsspi.security.token.AttributeNameConstants.
               WSCREDENTIAL_SECURITYNAME);

     // Get the display name from the String[]
     String display_name = (securityName != null && 
                securityName[0] != null) ? securityName[0] : "";


    // Read the existing long securityName attribute.
    String[]  longSecurityName = defaultAuthzToken.getAttributes 
     (com.ibm.wsspi.security.token.AttributeNameConstants.
             WSCREDENTIAL_LONGSECURITYNAME);

    // Get the long security name from the String[]
    String long_security_name = (longSecurityName != null && 
              longSecurityName[0] != null) ? longSecurityName[0] : "";


    // Read the existing group attribute.
    String[]  groupList = defaultAuthzToken.getAttributes 
      (com.ibm.wsspi.security.token.AttributeNameConstants.
               WSCREDENTIAL_GROUPS);

    // Get the groups from the String[]
    ArrayList groups = new ArrayList();
    if (groupList != null)
    {
     for (int i=0; i<groupList.length; i++)
     {
      System.out.println ("group[" + i + "] = " + groupList[i]);
      groups.add(groupList[i]);
     }
    }
   }
   catch (Exception e)
   {
    throw new WSLoginFailedException (e.getMessage(), e);
   }
  }

 }

 public boolean commit() throws LoginException 
 {
  // (For more information on what to do during commit, see 
     //  Develop custom login modules for a system login configuration for JAAS.)

 }

 private java.util.Map _sharedState = null;
 private com.ibm.wsspi.security.token.AuthorizationToken defaultAuthzToken = null;}
.


Related


Authenticate users
Propagating security attributes among application servers
Develop custom login modules for a system login configuration for JAAS


Reference:

Use the default propagation token to propagate security attributes
Security: Resources for learning


+

Search Tips   |   Advanced Search