- For individual users
- Instant access to solutions
- Ask your tech questions
- Start your 30-day Free Trial
Main Topics
Browse All TopicsI am trying to figure out how to integrate a custom JAAS Login Module into Websphere for use with Form Based Authentication. I am new to Websphere but have extensive experience with other Application Servers and the J2EE platform in general. So this problem has me pretty frustrated.
Maybe my expectations are off, but I am anticipating that I should be able to register my custom login module in such a way that when a user enters their credentials at the login page the authentication is handled by my login module instead of the default websphere user registry. Note that in my web.xml file I am using FORM based authentication.
Before I describe my situation in detail I'll ask the questions that I think will get me a working solution.
How do you register a JAAS login module so that it will be called during the processing of the j_security_check servlet?
Background thusfar:
o Global Security is Enabled
o A JAAS Application Login Configuration called myrealm has been created and associated with my login module class (called TestJaasModule)
o In the JAAS System Login Configuration I have inserted TestJaasModule into WEB_INBOUND and RMI_INBOUND in the first ordered spots.
o I've gotten FORM based authentication to work against the default user registry (unfortunately this is not the security store that the production app will be using).
When I attempt to log into the application using credentials from the default user registry, it works. However, if I use credentials from the security store serviced by my login module, then NO JOY!
Thanks kindly for your attention.
Here is web.xml
<web-app>
<display-name>authtest</di
<session-config>
<session-timeout>2</sessio
</session-config>
<welcome-file-list>
<welcome-file>/secure/welc
</welcome-file-list>
<security-constraint>
<web-resource-collection>
<web-resource-name>ReportC
<description>
Coarse access to use the report central application
</description>
<url-pattern>/secure/*</ur
<http-method>GET</http-met
<http-method>POST</http-me
</web-resource-collection>
<auth-constraint>
<role-name>All Authenticated Users</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE<
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-me
<realm-name>myrealm</realm
<form-login-config>
<form-login-page>/login.js
<form-error-page>/errorLog
</form-login-config>
</login-config>
<security-role>
<role-name>All Authenticated Users</role-name>
</security-role>
</web-app>
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Business Accounts
Answer for Membership
by: tonyvessPosted on 2006-05-19 at 14:46:03ID: 16721938
With WebSphere you have three options that you can use as your authenication mechanism, which are Local Operating System, LDAP, and Custom Registry. When you choose Local Operating System as your repository you must use SWAM as the type of authenication, if you use either LDAP or Custom Registry then you will need to utilize LTPA. If you are not using LDAP you should look into the requirements for utiltization of the custom registry which is a java class that must be implemented according to the IBM Guidelines. Authenication Users is the topic which can be found at http://publib.boulder.ibm. com/infoce nter/wasin fo/v6r0/ in dex.jsp?to pic=/com.i bm.websphe re.base.do c/info/aes /ae/ tsec_a uthusers.h tml
This will put you well on your way.
Once you have properly established the communication for security you will need to add the roles that you have defined to whichever registry that you are working with. This can be done many ways depending on which means you are using for your security mechanism.