Programmatic login (authentication) in WebLogic (JAAS)

Question

We have an existing Java EE application running under WebLogic and I want to authenticate a user programmatically as though the user was logged in via the existing web login process. That is to say, in the end, I want to have a valid session (cookie) that can be returned to the caller and later returned back the server without re-authentication. (This is to enable JAX-WS stateful Web Service calls).

We have a custom LoginModule that, when the user logs in via Forms Authentication, is eventually called via j_security_check. I guess what I'd like to do is to somehow get WebLogic to invoke that LoginModule on my behalf, ask me for the credentials, and yield an authenticated session and a valid subject etc. (i.e. all the JAAS goodness).

Is this a JAAS thing? Is there a WebLogic call?

Arjan Tijms · Accepted Answer · 2012-12-09 18:06:39Z

2

You can do this using the HttpServletRequest#login method. This will trigger the same kind of login chain that would otherwise be executed if your used accessed a protected resource.

answered Dec 9, 2012 at 18:06

Arjan Tijms

38.2k12 gold badges112 silver badges144 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

psparago Over a year ago

Thank you very much for the reply Arjan. Unfortunately, in our case, we are not using Servlet 3.0. We are using Servlet 2.5 and the login (and authenticate) methods are not supported. Is there anything like this in the 2.5 version?

Arjan Tijms Over a year ago

In Servlet 2.5 there's nothing like this unfortunately. JBoss and GlassFish both have a proprietary mechanism, but I don't know if this is available in WebLogic. Might be worth a shot to look for it.

psparago Over a year ago

Thank you again, Arjan, for responding.

David G · Accepted Answer · 2014-09-30 14:13:28Z

0

WebLogic security uses a security service plug-in (SSPI) architecture that allows you to implement security providers. Container (such as servlet) authentication is handled by authentication providers that use the SSPI. An authentication provider wraps a JAAS login module.

Writing and configuring security providers is extensively documented.

If you implement an authentication provider to wrap your login module and configure it for the WebLogic domain, it will be called automatically by the WebLogic security framework for all container authentication.

answered Sep 30, 2014 at 14:13

David G

6,3374 gold badges35 silver badges31 bronze badges

Collectives™ on Stack Overflow

Programmatic login (authentication) in WebLogic (JAAS)

2 Answers 2

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related