Authentication with JAAS - jaas

Question

I have a web application where users connect to their profiles.
I am able to authenticate a user using JAAS againt a database, when he requests a protected ressource (in this case a profile.xhtml page).
After authentication, I can access the profile page, which is obviously empty (no data were transfered from the database).
So, my problem is that : I can't figure out how to serve him his appropriate profile (full of this user information) after the authentication. In other words:
1) How can I grab the username(this id of the table User) from the login module to my profile's page?
2) How can I put the information of the user tuple in the served JSF page so that it can be rendered to the user?
This is my Login module ( a bit long so I cut just the login method ):
#Override
public boolean login() throws LoginException {
if (callbackHandler == null) {
throw new LoginException("Error: no CallbackHandler available "
+ "to garner authentication information from the user");
}
Callback[] callbacks = new Callback[2];
callbacks[0] = new NameCallback("username");
callbacks[1] = new PasswordCallback("password: ", false);
try {
callbackHandler.handle(callbacks);
username = ((NameCallback) callbacks[0]).getName();
password = ((PasswordCallback) callbacks[1]).getPassword();
if (debug) {
System.out.println("Username :" + username);
System.out.println("Password : " + password);
}
if (username == null || password == null) {
System.out.println("Callback handler does not return login data properly");
throw new LoginException(
"Callback handler does not return login data properly");
}
if (isValidUser()) { // validate user.
Profile profile = new Profile();
profile.setUsername(username);
succeeded = true;
return true;
}
} catch (IOException e) {
e.printStackTrace();
} catch (UnsupportedCallbackException e) {
e.printStackTrace();
}
return false;
}
This is my form authentication which pops up after requesting the profile.xhtml page (I configured this rule in web.xml ):
<form method=post action="j_security_check">
<p>
<span>Username:</span> <br /> <input type="text" name="j_username">
</p>
<p>
<span>Password:</span> <br /> <input type="password"
name="j_password">
</p>
<p>
<input type="submit" value="Login">
</p>
</form>
And this is a part of my profile's jsf page, associated to "profile.java" which is the managedBean for this page. I don't know how to get information after authentication and put it in the managedBean and serve it to he profile jsf page:
<h:form>
<h:outputText value="#{profile.username}"/><br/>
<h:outputText value="#{profile.password}"/><br/>
</h:form>
If you need other pieces of code, please let me know.
Thank you
Ok, now I am able to display some junk information in my profile.xhtml page using the #PostConstruct annotation like this:
#PostConstruct
private void prepareProfile(){
Subject subject = new Subject();
username = String.valueOf(subject.getPrincipals().size());
System.out.println(username);
}
However, I ignore how to grab information from the just-authenticated user.
Do you have any idea?
Thank you

Answer 1

This may come too late, but as I came across this page in my search this might do other people some good.
We resolved this by storing an authenticated user in the session.
You can retrieve the session from your CustomLoginModule using: ((HttpRequest)PolicyContext.getContext("javax.servlet.http.HttpServletRequest")).getSession()
You can then retrieve it from the session wherever you need it.
In your case, using JSF, you could store it in a session bean.
Injection will not automatically be performed in your CustomLoginModule due to reasons I will not go into here, you will need to ask for injection, for example in the initialize method.
An example method requesting injection for your class here:
public static <T> void programmaticInjection(Class clazz, T injectionObject) throws NamingException {
log.trace("trying programmatic injection for "+clazz.getSimpleName());
InitialContext initialContext = new InitialContext();
Object lookup = initialContext.lookup("java:comp/BeanManager");
BeanManager beanManager = (BeanManager) lookup;
AnnotatedType annotatedType = beanManager.createAnnotatedType(clazz);
InjectionTarget injectionTarget = beanManager.createInjectionTarget(annotatedType);
CreationalContext creationalContext = beanManager.createCreationalContext(null);
injectionTarget.inject(injectionObject, creationalContext);
creationalContext.release();
}
Call it like this: programmaticInjection(CustomLoginModule.class, this);
Then, inject your session bean, insert your user information, and use it in your profile backing bean as desired.