{"type":"doc","content":[{"type":"paragraph","content":[{"text":"Current File(s):","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"conf/authn/password-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":", ","type":"text"},{"text":"conf/authn/jaas-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":" (V4.0)","type":"text"},{"text":", conf/authn/authn.properties","type":"text","marks":[{"type":"em"}]},{"text":" (V4.1+)","type":"text"},{"text":", conf/authn/jaas.config","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"Format:","type":"text","marks":[{"type":"strong"}]},{"text":" Native Spring, Properties, JAAS","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"minLevel":{"value":"1"},"maxLevel":{"value":"2"}},"macroMetadata":{"macroId":{"value":"49efe098453aaff5481b0ed15ad048fb"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"4bf281e4-6053-4fa2-8d93-c83d0f8a06d9"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"JAAS","type":"text","marks":[{"type":"link","attrs":{"href":"http://docs.oracle.com/javase/8/docs/technotes/guides/security/jaas/JAASRefGuide.html"}}]},{"text":" (Java Authentication and Authorization Service) is a desktop authentication mechanism in Java that has been commonly misappropriated as a server-side technology. A variety of \"login module\" plugins exist for different password-based technologies. Support is provided for using JAAS as a CredentialValidator for the ","type":"text"},{"text":"password authentication","type":"text","marks":[{"type":"link","attrs":{"__confluenceMetadata":{"isRenamedTitle":true,"linkType":"page","contentTitle":"PasswordAuthnConfiguration","versionAtSave":"47"},"href":"/wiki/spaces/IDP4/pages/1265631611"}}]},{"text":" login flow.","type":"text"}]},{"type":"paragraph","content":[{"text":"In V3, JAAS was the primary mechanism for supporting chains of back-end systems in combination with each other. V4 now supports this directly, though in some cases JAAS may still be simpler to configure and certainly remains supported.","type":"text"}]},{"type":"paragraph","content":[{"text":"A particular advantage of the V4 alternative approach is that the native ","type":"text"},{"text":"Kerberos","type":"text","marks":[{"type":"link","attrs":{"__confluenceMetadata":{"isRenamedTitle":true,"linkType":"page","contentTitle":"KerberosAuthnConfiguration","versionAtSave":"17"},"href":"/wiki/spaces/IDP4/pages/1265631614"}}]},{"text":" feature is more secure than the Java-supplied JAAS alternative, so deployments combining the JAAS Kerberos module with other back-ends should seriously consider migrating away from that approach.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"General Configuration","type":"text"}]},{"type":"expand","attrs":{"title":"V4.0"},"content":[{"type":"paragraph","content":[{"text":"Configuring JAAS as a back-end in the simplest fashion relies on beans defined via an import in ","type":"text"},{"text":"authn/password-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":":","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Import in authn/password-authn-config.xml","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"","type":"text"}]},{"type":"paragraph","content":[{"text":"A few beans are defined in this file to globally configure this back-end by setting some JAAS-related options. With V4, these beans are chiefly used for backward compatibility, and as default settings that can be overridden on specific instances of beans inheriting from ","type":"text"},{"text":"shibboleth.JAASValidator","type":"text","marks":[{"type":"strong"}]},{"text":" defined in ","type":"text"},{"text":"authn/password-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":" in the ","type":"text"},{"text":"shibboleth.authn.Password.Validators","type":"text","marks":[{"type":"strong"}]},{"text":" bean.","type":"text"}]},{"type":"paragraph","content":[{"text":"In the simple case of JAAS used alone:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Defining use of JAAS in password-authn-config.xml","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n","type":"text"}]}]},{"type":"expand","attrs":{"title":"V4.1+"},"content":[{"type":"paragraph","content":[{"text":"Configuring JAAS as a back-end relies on beans internally that are configured using ","type":"text"},{"text":"authn/authn.properties","type":"text","marks":[{"type":"em"}]},{"text":". Generally the defaults are sufficient to rely on a single JAAS configuration named \"ShibUserPassAuth\".","type":"text"}]},{"type":"paragraph","content":[{"text":"Older releases included an ","type":"text"},{"text":"authn/jaas-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":" file; this remains supported but is no longer required or provided.","type":"text"}]},{"type":"paragraph","content":[{"text":"Adding additional beans may be needed in very advanced cases where a higher degree of control is required, and you are welcome to place them within ","type":"text"},{"text":"authn/password-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"In the simple case of JAAS used alone:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Defining use of JAAS in password-authn-config.xml","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"If desired, it's possible to directly configure the various settings within the validator bean instead of or in addition to relying on the defaults. Refer to the ","type":"text"},{"text":"JAASCredentialValidator","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.impl.JAASCredentialValidator"}}]},{"text":" javadoc for a complete summary.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"JAAS Configuration","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Simple JAAS Usage","type":"text"}]},{"type":"paragraph","content":[{"text":"JAAS has its own configuration format (see ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"http://docs.oracle.com/javase/8/docs/api/javax/security/auth/login/Configuration.html"}}]},{"text":"). By default, the named application configuration used is called \"ShibUserPassAuth\". This can be changed using the ","type":"text"},{"text":"shibboleth.authn.JAAS.LoginConfigNames","type":"text","marks":[{"type":"strong"}]},{"text":" bean (V4.0) or the ","type":"text"},{"text":"idp.authn.JAAS.loginConfigNames","type":"text","marks":[{"type":"strong"}]},{"text":" property (V4.1+), or turned into a list of more than one configuration, with each one tried in series until a success. This is equivalent to the JAAS keyword \"sufficient\".","type":"text"}]},{"type":"paragraph","content":[{"text":"Using separate configurations allows errors to be isolated per-module instead of masked by generic JAAS exceptions, but again, this is now a feature natively supported by the IdP independently of JAAS.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Advanced JAAS Usage","type":"text"},{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"More advanced options exist to:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"supply the JAAS configuration name(s) dynamically using a function","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"associate particular JAAS configuration(s) with a set of custom ","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":" objects to attach to the authentication result","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"For the former, a ","type":"text"},{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":" bean named ","type":"text"},{"text":"shibboleth.authn.JAAS.LoginConfigStrategy","type":"text","marks":[{"type":"strong"}]},{"text":" is reserved. This allows the set of JAAS configurations to be supplied at runtime. The signature of this function is fairly complex:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Signature of shibboleth.authn.JAAS.LoginConfigStrategy Function","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"java"},"content":[{"text":"Function>>","type":"text"}]},{"type":"paragraph","content":[{"text":"The result of the function is a collection of JAAS configuration names together with an optional collection of custom ","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":" objects (wrapped in a Java ","type":"text"},{"text":"Subject","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.security.auth.Subject"}}]},{"text":") to inject into the ","type":"text"},{"text":"Subject","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.security.auth.Subject"}}]},{"text":" produced by the login flow. This allows the result to be tailored based on which JAAS configuration actually succeeds, a common need when combining methods.","type":"text"}]},{"type":"paragraph","content":[{"text":"If the information the function would return is static, a bean named ","type":"text"},{"text":"shibboleth.authn.JAAS.LoginConfigurations","type":"text","marks":[{"type":"strong"}]},{"text":" can be defined.","type":"text"}]},{"type":"expand","attrs":{"title":"V4.0"},"content":[{"type":"paragraph","content":[{"text":"When using either a static or dynamic approach involving custom Principals, the overall login flow generally should advertise all of the possible ","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":" types in its ","type":"text"},{"text":"supportedPrincipals","type":"text","marks":[{"type":"code"}]},{"text":" bean property (in ","type":"text"},{"text":"general-authn.xml","type":"text","marks":[{"type":"em"}]},{"text":") and the automatic injection of all those Principals is turned off by defining a bean like so:","type":"text"}]},{"type":"codeBlock","content":[{"text":"","type":"text"}]}]},{"type":"expand","attrs":{"title":"V4.1+"},"content":[{"type":"paragraph","content":[{"text":"When using either a static or dynamic approach involving custom Principals, the overall login flow generally should advertise all of the possible ","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":" types in its ","type":"text"},{"text":"idp.authn.Password.supportedPrincipals","type":"text","marks":[{"type":"strong"}]},{"text":" property and the automatic injection of all those Principals is turned off via the ","type":"text"},{"text":"idp.authn.Password.addDefaultPrincipals","type":"text","marks":[{"type":"strong"}]},{"text":" property.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reference","type":"text"}]},{"type":"expand","attrs":{"title":"Beans (V4.0)"},"content":[{"type":"paragraph","content":[{"text":"The beans defined in ","type":"text"},{"text":"authn/jaas-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":" follow. These are defaults that can be overridden per-validator in whole or in part.","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"f7a35c13-70ce-4de8-af72-55c68d670419"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[304.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID / Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[221.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[489.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[304.0]},"content":[{"type":"paragraph","content":[{"text":"JAASConfig","type":"text"}]},{"type":"paragraph","content":[{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[221.0]},"content":[{"type":"paragraph","content":[{"text":"%{idp.home}/conf/authn/jaas.config","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[489.0]},"content":[{"type":"paragraph","content":[{"text":"Defines a Spring Resource containing the JAAS config. Normally this just points to a file in the filesystem","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[304.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.JAAS.JAASConfigURI","type":"text"}]},{"type":"paragraph","content":[{"text":"java.net.URI","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.net.URI"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[221.0]},"content":[{"type":"paragraph","content":[{"text":"JAASConfig.URI","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[489.0]},"content":[{"type":"paragraph","content":[{"text":"Defines the URI object containing the JAAS configuration","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[304.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.JAAS.LoginConfigNames","type":"text"}]},{"type":"paragraph","content":[{"text":"Collection","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Collection"}}]},{"text":"<","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[221.0]},"content":[{"type":"paragraph","content":[{"text":"[\"ShibUserPassAuth\"]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[489.0]},"content":[{"type":"paragraph","content":[{"text":"Simple list of JAAS application configuration names to use","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[304.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.JAAS.LoginConfigurations","type":"text"}]},{"type":"paragraph","content":[{"text":"Collection","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Collection"}}]},{"text":"<","type":"text"},{"text":"Pair","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-support.cgi/net.shibboleth.utilities.java.support.collection.Pair"}}]},{"text":"<","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":",","type":"text"},{"text":"Collection","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Collection"}}]},{"text":"<","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":">>>","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[221.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[489.0]},"content":[{"type":"paragraph","content":[{"text":"Static list of JAAS application configuration names along with mappings to custom ","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":" objects","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[304.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.JAAS.LoginConfigStrategy","type":"text"}]},{"type":"paragraph","content":[{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":"<","type":"text"},{"text":"Collection","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Collection"}}]},{"text":"<","type":"text"},{"text":"Pair","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-support.cgi/net.shibboleth.utilities.java.support.collection.Pair"}}]},{"text":"<","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":",","type":"text"},{"text":"Subject","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.security.auth.Subject"}}]},{"text":">>>","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[221.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[489.0]},"content":[{"type":"paragraph","content":[{"text":"For advanced use, you can inject a function to supply at runtime the information that the previous bean would supply statically","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Beans (V4.1+)"},"content":[{"type":"paragraph","content":[{"text":"The following are placeholders that may be defined in ","type":"text"},{"text":"authn/password-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":" for advanced control over JAAS configuration use. These are alternatives to the typical cases addressed by simple properties.","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"4122a5ab-75d4-4925-8251-c0a371ae96a7"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[282.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[432.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[282.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.JAAS.LoginConfigurations","type":"text"},{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Collection","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Collection"}}]},{"text":"<","type":"text"},{"text":"Pair","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-support.cgi/net.shibboleth.utilities.java.support.collection.Pair"}}]},{"text":"<","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":",","type":"text"},{"text":"Collection","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Collection"}}]},{"text":"<","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":">>>","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[432.0]},"content":[{"type":"paragraph","content":[{"text":"Static list of JAAS application configuration names along with mappings to custom ","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":" objects","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[282.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.JAAS.LoginConfigStrategy","type":"text"},{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[300.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":"<","type":"text"},{"text":"Collection","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Collection"}}]},{"text":"<","type":"text"},{"text":"Pair","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-support.cgi/net.shibboleth.utilities.java.support.collection.Pair"}}]},{"text":"<","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":",","type":"text"},{"text":"Subject","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.security.auth.Subject"}}]},{"text":">>>","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[432.0]},"content":[{"type":"paragraph","content":[{"text":"For advanced use, you can inject a function to supply at runtime the information that the previous bean would supply statically","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Properties (V4.1+)"},"content":[{"type":"paragraph","content":[{"text":"The following properties are usable in ","type":"text"},{"text":"authn/authn.properties","type":"text","marks":[{"type":"em"}]},{"text":" to control simple JAAS use:","type":"text"}]},{"type":"table","attrs":{"layout":"wide","localId":"38f18f00-7ad7-4b21-a763-43bf6f38da93"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[231.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[550.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.JAAS.loginConfigNames","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[231.0]},"content":[{"type":"paragraph","content":[{"text":"ShibUserPassAuth","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[550.0]},"content":[{"type":"paragraph","content":[{"text":"Comma-delimited set of JAAS application configuration names to use","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.JAAS.loginConfig","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[231.0]},"content":[{"type":"paragraph","content":[{"text":"%{idp.home}/conf/authn/jaas.config","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[550.0]},"content":[{"type":"paragraph","content":[{"text":"Location of JAAS configuration file","type":"text"}]}]}]}]}]},{"type":"paragraph"}],"version":1}