Oracle JHeadstart Developer's Guide - Downloads - Oracle

10.1.2. JAAS Custom Login Module
A great benefit from this approach is that the mechanism behind the retrieval of security
information can be changed, for instance from file- or table based to LDAP (Lightweight
Directory Access Protocol) based, without a single change in the application code itself.
Furthermore, it is very convenient that during development, a simple file-based security
mechanism can be used, while in other environments such as test- and production
environments, a full-blown security implementation such as LDAP can be implemented,
again without any changes to the application code.
When using Oracle’s web container OC4J, the JAAS standard is implemented using the
Oracle AS JAAS Provider, shortened as “JAZN”. JAZN provides out-of-the-box support
for storing the user and roles information in two formats:
• In a simple XML file, typically named jazn-data.xml
• In an LDAP directory. Oracle’s Internet Directory (OID) is a popular
implementation of the LDAP protocol.
In addition, JAZN can be configured to authenticate users against Oracle’s Single Sign-
On Server (SSO).
To use JAAS-JAZN with JHeadstart, you set the Authentication Type property to
“JAAS”.
If you want to use role-based authorization using JAAS, then check the Use Role-Based
Authorization? Checkbox and set the Authorization Type to “JAAS”. This only makes
sense if your LDAP directory contains a useful role structure that is linked to your
application users stored in LDAP. If no role information is present in LDAP, or it is too
coarse-grained to be of use for the authorization levels that need to be applied in your
application, then set the Authorization Type to “Custom”, so you can use the JHeadstart
security tables or your own tables to implement authorization. If LDAP contains useful
role information, and you want to use additional application-specific roles, then set the
Authorization Type to “JAAS and Custom”.
Warning: All application roles need to be listed in the web.xml deployment
descriptor for the isUserInRole() API call to work properly. In other words,
your list of application roles needs to be maintained in two places, in the
LDAP accessed by JAAS, and in the web.xml.
If you need to deploy your ADF-JHeadstart application to another web container, like
JBoss, Tomcat, or Websphere, you need to consult the documentation of this web
container for information on configuring JAAS and availability of out-of-the-box JAAS
providers like OracleAS JAAS (JAZN).
Overview of JAAS-based security in OC4J. OC4J Security Guide, chapter 2
http://downloaduk.oracle.com/docs/cd/B25221_03/web.1013/b14429/jaas_intro.htm
JAAS supports the concept of a Custom Login Module (CLM). A CLM allows you to
retrieve security information from an arbitrary information store, for example a set of
database tables. If none of the standard JAAS providers of your web container meets
your requirements, you can write a custom login module. Since accessing database tables
for obtaining the security information is a common use case for a custom login module,
JHeadstart Developer’s Guide Application Security 10- 3