1. The name parameter is used to get the login Configuration
  2. The constructor without a CallbackHandler
  3. Callers of a LoginContext constructor should require an AuthPermission with target “createLoginContext.<name>"

LoginContext Instantiation

  • LoginContext uses application identifier to load the appropriate configuration block
  • LoginContext locates the JAAS configuration file by the javax.security.auth.login.config system property as shown here: “java -Djavax.security.auth.login.config-jaas.config MyApp"

JAAS Configuration

The configuration file format consists of the following entries:

  • LoginEntry: Labels a single entry in the login configuration. The application code implicitly defines the Login Entry label where a particular LoginEntry entry is searched by its login configuration
  • ModuleClass: Specifies the class name of a JAAS login module Example: com.sun.security.auth.module.Krb5LoginModule specifies the class name of the Kerberos login module
  • Flag : Specifies the way to respond when the current login module gives an authentication failure. The flag can be set with anyone of the following values
    – Required – Authentication should succeed irrespective of success or failure, proceed to the next login module in this entry
    – Requisite – Authentication should succeed. For success condition, proceed to the next login module, and in case of failure, return immediately without executing the remaining login modules
    – Sufficient – It is not essential for this login module to succeed in authentication. For success condition, return immediately without executing the remaining login modules, and in case of failure, proceed to the next login module
    – Optional – It is not essential for this login module to succeed in authentication. Irrespective of success or failure, always proceed to the next login module in this entry
  • Option="Value" – Zero or more option settings can be passed to the login module after the flag. The options are given in the form of space-separated lists. The login module lines should be terminated using a semicolon (;)

The JAAS Login Configuration File’s General Format: