{"type":"doc","content":[{"type":"paragraph","content":[{"text":"Current File(s):","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"conf/authn/password-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":", ","type":"text"},{"text":"conf/authn/authn.properties, conf/authn/jaas.config","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"Format:","type":"text","marks":[{"type":"strong"}]},{"text":" Native Spring, Properties, JAAS","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"minLevel":{"value":"1"},"maxLevel":{"value":"2"}},"macroMetadata":{"macroId":{"value":"49efe098453aaff5481b0ed15ad048fb"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"4bf281e4-6053-4fa2-8d93-c83d0f8a06d9"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"JAAS","type":"text","marks":[{"type":"link","attrs":{"href":"http://docs.oracle.com/javase/8/docs/technotes/guides/security/jaas/JAASRefGuide.html"}}]},{"text":" (Java Authentication and Authorization Service) is a desktop authentication mechanism in Java that has been commonly misappropriated as a server-side technology. A variety of \"login module\" plugins exist for different password-based technologies. Support is provided for using JAAS as a CredentialValidator for the ","type":"text"},{"text":"password authentication","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP5/pages/3199505587"}}]},{"text":" login flow.","type":"text"}]},{"type":"paragraph","content":[{"text":"Most uses of JAAS are historical at this point since the IdP now natively supports mechanisms to chain validators in ways that go beyond what JAAS can do. In particular, ","type":"text"},{"text":"Kerberos","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP5/pages/3199505778"}}]},{"text":" authentication is best handled using the custom support we provide rather than the JAAS module for it, as the module lacks service ticket validation support and so is less secure.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"General Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"Configuring JAAS as a back-end relies on beans internally that are configured using ","type":"text"},{"text":"authn/authn.properties","type":"text","marks":[{"type":"em"}]},{"text":". Generally the defaults are sufficient to rely on a single JAAS configuration named \"ShibUserPassAuth\".","type":"text"}]},{"type":"paragraph","content":[{"text":"Older releases included an ","type":"text"},{"text":"authn/jaas-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":" file; this remains supported but is no longer required or provided.","type":"text"}]},{"type":"paragraph","content":[{"text":"Adding additional beans may be needed in very advanced cases where a higher degree of control is required, and you are welcome to place them within ","type":"text"},{"text":"authn/password-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"In the simple case of JAAS used alone:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Defining use of JAAS in password-authn-config.xml","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"If desired, it's possible to directly configure the various settings within the validator bean instead of or in addition to relying on the defaults. Refer to the ","type":"text"},{"text":"JAASCredentialValidator","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.impl.JAASCredentialValidator"}}]},{"text":" javadoc for a complete summary.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"JAAS Configuration","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Simple JAAS Usage","type":"text"}]},{"type":"paragraph","content":[{"text":"JAAS has its own configuration format (see ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"http://docs.oracle.com/javase/8/docs/api/javax/security/auth/login/Configuration.html"}}]},{"text":"). By default, the named application configuration used is called \"ShibUserPassAuth\". This can be changed using the ","type":"text"},{"text":"idp.authn.JAAS.loginConfigNames","type":"text","marks":[{"type":"strong"}]},{"text":" property, or turned into a list of more than one configuration, with each one tried in series until a success. This is equivalent to the JAAS keyword \"sufficient\".","type":"text"}]},{"type":"paragraph","content":[{"text":"Using separate configurations allows errors to be isolated per-module instead of masked by generic JAAS exceptions, but again, this is now a feature natively supported by the IdP independently of JAAS.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Advanced JAAS Usage","type":"text"},{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"More advanced options exist to:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"supply the JAAS configuration name(s) dynamically using a function","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"associate particular JAAS configuration(s) with a set of custom ","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":" objects to attach to the authentication result","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"For the former, a ","type":"text"},{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":" bean named ","type":"text"},{"text":"shibboleth.authn.JAAS.LoginConfigStrategy","type":"text","marks":[{"type":"strong"}]},{"text":" is reserved. This allows the set of JAAS configurations to be supplied at runtime. The signature of this function is fairly complex:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Signature of shibboleth.authn.JAAS.LoginConfigStrategy Function","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"java"},"content":[{"text":"Function>>","type":"text"}]},{"type":"paragraph","content":[{"text":"The result of the function is a collection of JAAS configuration names together with an optional collection of custom ","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":" objects (wrapped in a Java ","type":"text"},{"text":"Subject","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.security.auth.Subject"}}]},{"text":") to inject into the ","type":"text"},{"text":"Subject","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.security.auth.Subject"}}]},{"text":" produced by the login flow. This allows the result to be tailored based on which JAAS configuration actually succeeds, a common need when combining methods.","type":"text"}]},{"type":"paragraph","content":[{"text":"If the information the function would return is static, a bean named ","type":"text"},{"text":"shibboleth.authn.JAAS.LoginConfigurations","type":"text","marks":[{"type":"strong"}]},{"text":" can be defined.","type":"text"}]},{"type":"paragraph","content":[{"text":"When using either a static or dynamic approach involving custom Principals, the overall login flow generally should advertise all of the possible ","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":" types in its ","type":"text"},{"text":"idp.authn.Password.supportedPrincipals","type":"text","marks":[{"type":"strong"}]},{"text":" property and the automatic injection of all those Principals is turned off via the ","type":"text"},{"text":"idp.authn.Password.addDefaultPrincipals","type":"text","marks":[{"type":"strong"}]},{"text":" property.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reference","type":"text"}]},{"type":"expand","attrs":{"title":"Beans"},"content":[{"type":"paragraph","content":[{"text":"The following are placeholders that may be defined in ","type":"text"},{"text":"authn/password-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":" for advanced control over JAAS configuration use. These are alternatives to the typical cases addressed by simple properties.","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"4122a5ab-75d4-4925-8251-c0a371ae96a7"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[366.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[388.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[437.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[366.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.JAAS.LoginConfigurations","type":"text"},{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[388.0]},"content":[{"type":"paragraph","content":[{"text":"Collection","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Collection"}}]},{"text":"<","type":"text"},{"text":"Pair","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-shared.cgi/net.shibboleth.shared.collection.Pair"}}]},{"text":"<","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":",","type":"text"},{"text":"Collection","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Collection"}}]},{"text":"<","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":">>>","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[437.0]},"content":[{"type":"paragraph","content":[{"text":"Static list of JAAS application configuration names along with mappings to custom ","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":" objects","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[366.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.JAAS.LoginConfigStrategy","type":"text"},{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[388.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":"<","type":"text"},{"text":"Collection","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Collection"}}]},{"text":"<","type":"text"},{"text":"Pair","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-shared.cgi/net.shibboleth.shared.collection.Pair"}}]},{"text":"<","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":",","type":"text"},{"text":"Subject","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.security.auth.Subject"}}]},{"text":">>>","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[437.0]},"content":[{"type":"paragraph","content":[{"text":"For advanced use, you can inject a function to supply at runtime the information that the previous bean would supply statically","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Properties"},"content":[{"type":"paragraph","content":[{"text":"The following properties are usable in ","type":"text"},{"text":"authn/authn.properties","type":"text","marks":[{"type":"em"}]},{"text":" to control simple JAAS use:","type":"text"}]},{"type":"table","attrs":{"layout":"wide","localId":"38f18f00-7ad7-4b21-a763-43bf6f38da93"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[302.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[580.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[302.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.JAAS.loginConfigNames","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"ShibUserPassAuth","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[580.0]},"content":[{"type":"paragraph","content":[{"text":"Comma-delimited set of JAAS application configuration names to use","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[302.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.JAAS.loginConfig","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[299.0]},"content":[{"type":"paragraph","content":[{"text":"%{idp.home}/conf/authn/jaas.config","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[580.0]},"content":[{"type":"paragraph","content":[{"text":"Location of JAAS configuration file","type":"text"}]}]}]}]}]},{"type":"paragraph"}],"version":1}