jaas authentication failover

[Cantor, Scott]

On 3/28/19, 6:33 PM, "users on behalf of Liam Hoekenga" <users-bounces at shibboleth.net on behalf of liamr at umich.edu> wrote:

> I have it working, but I don't totally understand (yet) how it works.

That's basically "worst case" of needing to customize nearly everything, so it has to end up plugging into nearly every customization point in the authentication system. The design is not meant to be simple, only to make it possible to do just about anything you can think of without changing the code. It's been proven possible to do that, but the cost of that flexibility is an incredibly complex amount of design surface.

Slide 26 is really the bulk of the JAAS wiring. It's a map of lists (that's trivial in Spring XML), injected into the scripted function bean via p:customObjectRef, and the script decides which entry in the map corresponds to the "right" JAAS configuration block/name to return.
 
The real complexity is in the Principal object machinery, which is the other side of the map's value pair. That's not all that important if all the JAAS options amount to a single "kind" of authentication. If it were all just "password" login options that are equivalent to the outside world, then you can leave the Subject "slot" empty, and it's a bit simpler.

e.g. From slide 26, set all the "second" properties to nulls.

<util:list id="JAASDefaultLoginConfigurations">
	<bean parent="shibboleth.Pair" p:first="CatnetNetIdAuth" />
	<bean parent="shibboleth.Pair" p:first="CatnetAdminAuth" />
	<bean parent="shibboleth.Pair" p:first="CatnetSvcAcctAuth" />
</util:list>

The purpose of the second slot in those pairs is to customize the contents of the Java Subject that the authentication result returns. If it doesn't have to be customized, then the default product of the JAAS Password flow will be used. Often that's good enough.

I'll see if I can come up with a sensible example that has some concrete meaning based on that idea.

This is what it takes to come up with an example. I have to start with a giant "complete" solution and then cut all the fancy parts out. It doesn’t work to invent just the simple part up front. Not for me anyway.

-- Scott