Unable to retrieve password in user LoginModule

Question

I am trying to write my own LoginModule with a name CustomLoginModulefor Wildfly 8.0.0.CR1, which is registered for a security domain in standalone.xml:

<security-domain name="other" cache-type="default">  
  <authentication>  
    <login-module code="Remoting" flag="optional">  
      <module-option name="password-stacking" value="useFirstPass"/>  
    <login-module>  
    <login-module code="com.someExample.CustomLoginModule" flag="required">  
      <module-option name="password-stacking" value="useFirstPass"/>  
    </login-module>  
  </authentication>  
</security-domain>

In my remote client, I use the following jboss-ejb-client.properties:

endpoint.name=client-endpoint  
remote.connectionprovider.create.options.org.xnio.Options.SSL_ENABLED=false  
remote.connections=default  
remote.connection.default.host=[...]  
remote.connection.default.port=[...]  
remote.connection.default.connect.options.org.xnio.Options.SASL_POLICY_NOANONYMOUS=false  
remote.connection.default.username=myUserName  
remote.connection.default.password=abcde  

Getting the InitialContext in the client is as follows:

Properties props = new Properties();  
props.put(Context.URL_PKG_PREFIXES,  "org.jboss.ejb.client.naming");  
InitialContext ctx = new InitialContext(props);  

Basically, this works great, and my login module is called when accessing the EJB via a remote interface, which is annotated with the correct one @SecurityDomain.

In the login module, I can read the username using the callback or sharedState, which is passed to the method initialize. But I could not get the password provided (in this example, I would expect to get a string elsewhere abcde).

, . (, JBoss 5) sharedState... org.jboss.security.auth.spi.UsernamePasswordLoginModule JBoss-Quickstart, , . , org.jboss.as.security.remoting.RemotingConnectionCredential@....

: LoginModule ( ):

import javax.security.auth.callback.*;
import javax.security.auth.login.LoginException;
import javax.security.auth.spi.LoginModule;

public class CustomLoginModule implements LoginModule
{
    private CallbackHandler callbackHandler;

    public void initialize(Subject subject, CallbackHandler callbackHandler,
      Map<String, ?> sharedState, Map<String, ?> options)
    {
        this.callbackHandler = callbackHandler;
    }

    public boolean login() throws LoginException
    {
        NameCallback namecallback = new NameCallback("Username");
        PasswordCallback passwordcallback = new PasswordCallback("Password", false);
        CallbackHandler handler = this.callbackHandler;
        try {
            handler.handle(new Callback[] { namecallback, passwordcallback });
        }
        catch (Exception e) {
            e.printStackTrace();
        }
        String username = namecallback.getName();
        char[] password2 = passwordcallback.getPassword();
        String password = new String(password2);
        System.out.println(username + " / " + password);
        if (username == null || password == null) {
            return false;
        }
        // do authentication...
        return true;
    }

    public boolean commit() throws LoginException
    { ... }

    public boolean abort() throws LoginException
    { ... }

    public boolean logout() throws LoginException
    { ... }
}

Answer 1

, , . , .

ClientLoginModule ( Wildfly) (ApplicationRealm, - ). (-?), .

<security-realm name="ApplicationRealm">
    <authentication>
        <jaas name="AppRealmLoopThrough"/>
    </authentication>
</security-realm>

, :

<security-domain name="AppRealmLoopThrough" cache-type="default">
    <authentication>
        <login-module code="Client" flag="required">
            <module-option name="multi-threaded" value="true"/>
        </login-module>
    </authentication>
</security-domain>
<security-domain name="other" cache-type="default">
    <authentication>
        <login-module code="com.someExample.CustomLoginModule" flag="required"/>
    </authentication>
</security-domain>

CustomLoginModule ( UsernamePasswordLoginModule) , :

final String[] usernameAndPassword = getUsernameAndPassword();
System.out.println("received username: " + usernameAndPassword[0] + " and password " + usernameAndPassword[1]);

getUsernameAndPassword() - , UsernamePasswordLoginModule.

, EJB @SecurityDomain("other") ( ), CustomLoginModule.

Btw: , other - - ...;)

, . , - : , AppRealmLoopThrough ApplicationRealm, http-remoting-connector. "" . "" - CustomLoginModule, EJB. ( ). ?