Location of configuration file parameter UsernamePassword Login Handler

[Brent Putman]

On 3/23/12 5:34 AM, Rod Widdowson wrote:
>
> In handler.xml we can specify configuration file as a parameter but then I cannot see where in the
> code this parameter is acquired, UsernamePasswordLoginHandler takes as input "servletUrl".
>

As Rod said, it happens via Spring wiring.

Additionally, there is something a little unintuitive about the way the
JAAS config file parameter there is handled.  As you can see in the bean
definition parser class that Rod referenced, the config file value is
merely set as the value of Java system property '
java.security.auth.login.config'.  It's done this way b/c IdP v2
targeted Java 5, and prior to Java 6, there was no
implementation-independent way to parse a JAAS config file into a JAAS
Configuration instance.

Using the system property means that the config specified there becomes
the single JAAS global Configuration.  Therefore, it's not possible to
have different  JAAS configurations for different handlers (nor for
other non-IdP JAAS based apps/things running in the same container).  So
all the JAAS-based handlers would need to point to the same file, and
use different application names to reference different named blocks in
the config.  If you were to specify multiple config locations, only one
of them would "win", depending on the ordering, so that doesn't work.

Clearly this is suboptimal.  It would be possible to fix by eliminating
Java 5 support and targeting a minimum of Java 6.  That won't happen in
IdP v2.  IdP v3 will target (at least) Java 6, perhaps even 7 (can't
remember off-hand where that discussion went), so would be possible
there.  However, based on current design the authN components shipped as
a part of IdP v3 will no longer be based on JAAS.

--Brent

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120323/f77ca047/attachment.html