chaining LoginModules in IDP ShibUserPassAuth

[Cantor, Scott]

On 3/26/12 10:49 AM, "Eugene Dvorkin" <Eugene.Dvorkin at ARTstor.org> wrote:

>I have a requirement to create an IDP login page that will first check
>against database for a set of test
>usernames/ passwords and then, if not found, use LDAP directory to
>search for users.
>Can I combine LdapLoginModule with DatabaseLoginModule in some kind of
>chain in login.config file?

To a degree, yes. JAAS can compose modules for you as documented in its
configuration page. Specifically, you want the "sufficient" tag applied to
each one.

But you get very poor error handling, because JAAS will swallow the module
specific exceptions. If you want real error handling, you need a custom
login handler. My contributed handler (see Contributions page) addresses
that, in fact.

-- Scott