JBoss JAAS Custom Login Module

Question

I am trying to use the native JAAS authentication module for a web application hosted on JBoss 5.1.0.GA Thus, everything works fine until the number of users increases, and the sessions (as they think) begin to mix.

The reason I use custom JAAS is due to my own authentication and the need to return a password for future use in the application.

When I call request.getUserPrincipal in servlets, I get an object of type SimplePrincipal instead in my usual principle. To get the user, I use SecurityAssociation.getSubject().getPrincipals() and suspect that at the moment I'm getting the wrong principle.

What is the correct way to implement a custom login module and get the Loggedin Principal log at the web level (Serlets) on JBoss?

EDIT: The problem exists at the EJB level, https://issues.jboss.org/browse/EJBTHREE-1756

Ref:

• http://stuffthathappens.com/blog/2008/05/16/writing-a-custom-jaas-loginmodule/
• http://community.jboss.org/wiki/SecurityJAASLoginModule
• http://community.jboss.org/message/531986#531986
• http://download.oracle.com/javase/1.4.2/docs/guide/security/jaas/JAASLMDevGuide.html
• http://community.jboss.org/thread/44388
• http://docs.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/5/pdf/Security_Guide/JBoss_Enterprise_Application_Platform-5-Security_Guide-en-US.pdf

Answer 1

I could not get LoginModule with my usual main job. I created a Tomcat valve that encrypts and pushes the password for the HttpSession . Other servlets will extract and decrypt the password.