org.apereo.cas.authentication.handler.support

Class JaasAuthenticationHandler

java.lang.Object

org.apereo.cas.authentication.AbstractAuthenticationHandler

org.apereo.cas.authentication.handler.support.AbstractPreAndPostProcessingAuthenticationHandler

org.apereo.cas.authentication.handler.support.AbstractUsernamePasswordAuthenticationHandler

org.apereo.cas.authentication.handler.support.JaasAuthenticationHandler

All Implemented Interfaces:

org.apereo.cas.authentication.AuthenticationHandler, org.apereo.cas.authentication.PrePostAuthenticationHandler, org.springframework.core.Ordered

public class JaasAuthenticationHandler
extends AbstractUsernamePasswordAuthenticationHandler

JAAS Authentication Handler for CAAS. This is a simple bridge from CAS' authentication to JAAS.

Using the JAAS Authentication Handler requires you to configure the appropriate JAAS modules. You can specify the location of a jass.conf file using the following VM parameter:

 -Djava.security.auth.login.config=$PATH_TO_JAAS_CONF/jaas.conf
 

This example jaas.conf would try Kerberos based authentication, then try LDAP authentication:

 CAS {
   com.sun.security.auth.module.Krb5LoginModule sufficient
     client=TRUE
     debug=FALSE
     useTicketCache=FALSE;
   edu.uconn.netid.jaas.LDAPLoginModule sufficient
     java.naming.provider.url="ldap://ldapserver.my.edu:389/dc=my,dc=edu"
     java.naming.security.principal="uid=jaasauth,dc=my,dc=edu"
     java.naming.security.credentials="password"
     Attribute="uid"
     startTLS="true";
 };
 

Since:

3.0.0

See Also:

CallbackHandler, PasswordCallback, NameCallback

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
protected static class	JaasAuthenticationHandler.UsernamePasswordCallbackHandler A simple JAAS CallbackHandler which accepts a Name String and Password String in the constructor.

Field Summary

Fields inherited from class org.apereo.cas.authentication.AbstractAuthenticationHandler

principalFactory, servicesManager

Fields inherited from interface org.apereo.cas.authentication.AuthenticationHandler

SUCCESSFUL_AUTHENTICATION_HANDLERS

Fields inherited from interface org.springframework.core.Ordered

HIGHEST_PRECEDENCE, LOWEST_PRECEDENCE

Constructor Summary

Constructors

Constructor and Description
JaasAuthenticationHandler(java.lang.String name, org.apereo.cas.services.ServicesManager servicesManager, org.apereo.cas.authentication.principal.PrincipalFactory principalFactory, java.lang.Integer order) Instantiates a new Jaas authentication handler, and attempts to load/verify the configuration.

Method Summary

Modifier and Type	Method and Description
protected org.apereo.cas.authentication.HandlerResult	authenticateUsernamePasswordInternal(UsernamePasswordCredential credential, java.lang.String originalPassword) Authenticates a username/password credential by an arbitrary strategy with extra parameter original credential password before encoding password.
void	setKerberosKdcSystemProperty(java.lang.String kerberosKdcSystemProperty) Typically, the default realm and the KDC for that realm are indicated in the Kerberos krb5.conf configuration file.
void	setKerberosRealmSystemProperty(java.lang.String kerberosRealmSystemProperty) Typically, the default realm and the KDC for that realm are indicated in the Kerberos krb5.conf configuration file.
void	setRealm(java.lang.String realm)

Methods inherited from class org.apereo.cas.authentication.handler.support.AbstractUsernamePasswordAuthenticationHandler

doAuthentication, getPasswordPolicyConfiguration, matches, setCredentialSelectionPredicate, setPasswordEncoder, setPasswordPolicyConfiguration, setPrincipalNameTransformer, supports

Methods inherited from class org.apereo.cas.authentication.handler.support.AbstractPreAndPostProcessingAuthenticationHandler

authenticate, createHandlerResult

Methods inherited from class org.apereo.cas.authentication.AbstractAuthenticationHandler

getName, getOrder

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apereo.cas.authentication.PrePostAuthenticationHandler

postAuthenticate, preAuthenticate

Methods inherited from interface org.apereo.cas.authentication.AuthenticationHandler

getName

Methods inherited from interface org.springframework.core.Ordered

getOrder

Constructor Detail

JaasAuthenticationHandler

public JaasAuthenticationHandler(java.lang.String name,
                                 org.apereo.cas.services.ServicesManager servicesManager,
                                 org.apereo.cas.authentication.principal.PrincipalFactory principalFactory,
                                 java.lang.Integer order)

Instantiates a new Jaas authentication handler, and attempts to load/verify the configuration.

Parameters:

name - the name

servicesManager - the services manager

principalFactory - the principal factory

order - the order

Method Detail

authenticateUsernamePasswordInternal

protected org.apereo.cas.authentication.HandlerResult authenticateUsernamePasswordInternal(UsernamePasswordCredential credential,
                                                                                           java.lang.String originalPassword)
                                                                                    throws java.security.GeneralSecurityException,
                                                                                           org.apereo.cas.authentication.PreventedException

Description copied from class: AbstractUsernamePasswordAuthenticationHandler

Authenticates a username/password credential by an arbitrary strategy with extra parameter original credential password before encoding password. Override it if implementation need to use original password for authentication.

Specified by:

authenticateUsernamePasswordInternal in class AbstractUsernamePasswordAuthenticationHandler

Parameters:

credential - the credential object bearing the transformed username and password.

originalPassword - original password from credential before password encoding

Returns:

HandlerResult resolved from credential on authentication success or null if no principal could be resolved from the credential.

Throws:

java.security.GeneralSecurityException - On authentication failure.

org.apereo.cas.authentication.PreventedException - On the indeterminate case when authentication is prevented.

setRealm

public void setRealm(java.lang.String realm)

setKerberosRealmSystemProperty

public void setKerberosRealmSystemProperty(java.lang.String kerberosRealmSystemProperty)

Typically, the default realm and the KDC for that realm are indicated in the Kerberos krb5.conf configuration file. However, if you like, you can instead specify the realm value by setting this following system property value.

If you set the realm property, you SHOULD also configure the setKerberosKdcSystemProperty(String).

Also note that if you set these properties, then no cross-realm authentication is possible unless a krb5.conf file is also provided from which the additional information required for cross-realm authentication may be obtained.

If you set values for these properties, then they override the default realm and KDC values specified in krb5.conf (if such a file is found). The krb5.conf file is still consulted if values for items other than the default realm and KDC are needed. If no krb5.conf file is found, then the default values used for these items are implementation-specific.

Parameters:

kerberosRealmSystemProperty - system property to indicate realm.

Since:

4.1.0

See Also:

Oracle documentation

setKerberosKdcSystemProperty

public void setKerberosKdcSystemProperty(java.lang.String kerberosKdcSystemProperty)

Typically, the default realm and the KDC for that realm are indicated in the Kerberos krb5.conf configuration file. However, if you like, you can instead specify the kdc value by setting this system property value.

If you set the realm property, you SHOULD also configure the setKerberosRealmSystemProperty(String).

Also note that if you set these properties, then no cross-realm authentication is possible unless a krb5.conf file is also provided from which the additional information required for cross-realm authentication may be obtained.

If you set values for these properties, then they override the default realm and KDC values specified in krb5.conf (if such a file is found). The krb5.conf file is still consulted if values for items other than the default realm and KDC are needed. If no krb5.conf file is found, then the default values used for these items are implementation-specific.

Parameters:

kerberosKdcSystemProperty - system property to indicate kdc

Since:

4.1.0

See Also:

Oracle documentation