Simple User/Pass Config. (JAAS? Resolver?)

[Peter Schober]

* Joaquin Menchaca <jmenchaca at verticalresponse.com> [2013-10-16 02:55]:
> So, I'm wondering how to setup a simple user=password scenario for my
> proof-of-concept to demonstrate Shibboleth IdP works.  How could I go
> about this?

Another simple and (pure Java) alternative to adding Apache httpd in
front of the Java servlet container is to use the "Tagish" JAAS
modules, which (as I've re-checked back now) also contain a FileLogin
variant.

That allows authentication against a local plain text file of the form
username:md5(password) -- plus optional roles at the end.

Since the tagish module vanished from the web long a go one version
still available is that by Michal Prochazka of Masaryk University, at
http://frakira.fi.muni.cz/~tauceti/?Shibboleth:JAAS_RDBMS_JDBC

Here's a writeup of what I had to do, assuming a modern UNIX-like
environment (feel free to add that to the wiki):

You'll need a Java JDK (javac) installed to build this, then do:
$ svn co https://vcs.ics.muni.cz/repos/shibboleth/jaas-rdbms/trunk tagish_jaas
$ cd tagish_jaas
$ make

If javac is not in /usr/bin/ adjust the first like of the Makefile and
re-run make.
Copy the resulting file tagishauth.jar to your Shib IdP distribution's
lib/ directory and rebuild the war file, by calling ./install.sh

Switch to the UsernamePassword login handler in handler.xml (from the
default RemoteUser login handler).

Create an md5-hashed password, e.g. for "s3cret":
$ export HISTCONTROL=ignorespace
$  echo -n s3cret | md5sum 
33e1b232a4e6fa0028a6670753749a17  -

Create the password file for user "foo" with the above password:
$  echo "foo:33e1b232a4e6fa0028a6670753749a17" > /path/to/password.txt

Make sure the user your servlet container runs as has read permissions
for that password file (and noone else), e.g.
# chown root:tomcat /path/to/password.txt
# chmod 640 /path/to/password.txt

Finally, here's the complete login.config example for your
/opt/shibboleth-idp/conf directory:

ShibUserPassAuth {
  com.tagish.auth.FileLogin required pwdFile="/path/to/password.txt";
};

Restart your Java servlet container, you should now be able to log in
as user "foo" with the above password.
-peter