In my opinion you are going towards the wrong direction.
Using your approach of putting the password change into the LoginModule has some issue.
- User login is usually expected to be "safe" process i.e. process "without" side effects.
- Using the
TextInputCallback to ask for a new passport is at least strange.
The TextInputCallback is meant to ask the user for regular text not for a password for example a second authentication factor like a (timebased) PIN
A client implementing a CallbackHandler does not know that it's a password which may has has to be masked when shown on the scren.
- The approach violates the single responsibilty principle of the LoginModule - a LoginModule is responsible for log in / authenticate the user.
Keep in mind that usually for a password change you need an authenticated / authorized user which has to confirm the password change by re-entering his old password
and which usually also provides a second field where the user can re-enter his new password. Just one xxxCallback seems not be enough.
Even one should not use Exceptions for control flows I'd suggest to use a CredentialExpiredException to signal the client that the user has to change
the password. This is also the way Oracle does it in one of the WebLogic JAAS Examples
After all my remarks if you still want / need to put it into the custom LoginModule then I'd suggest to define your own custom Callbacks
for example PasswordChangeCallback or ConfirmPasswordCallback, NewPasswordCallback, VerifyNewPasswordCallback
You can simply add them to custom LoginModule there is no need to register them. Keep in mind that standard clients may have problems whith these additional callbacks.
Your client then has to implement a the corresponding CallbackHandler.
In JAAS there are two ways to customise the used CallbackHander
* by configuring a custom default CallbackHandler
From the CallbackHandler API documentaion
A default CallbackHandler class implementation may be specified in the
auth.login.defaultCallbackHandler security property. The security
property can be set in the Java security properties file located in
the file named /lib/security/java.security.
refers to the value of the java.home system property, and specifies
the directory where the JRE is installed.
or by passing as argument to the constructor of the LoginContext.
The LoginContext provides two constructors which accept a CallbackHandler
public LoginContext(String name, CallbackHandler callbackHandler)
throws LoginException
public LoginContext(String name, Subject subject,
CallbackHandler callbackHandler) throws LoginException
see LoginContext API Documentation
How does it integrate with removing?
It should be the same way as you already do it. There is not much difference.
How does our fat client receive the TextInputCallback?
Via CallbackHandler Interface similar to the PasswordCallback. You've mentioned that the Login Module uses the CallbackHandler.
void handle(Callback[] callbacks)
If you want to know how to implement the handle method the CallbackHandler API Documentation also provides an example of an implementation of the CallbackHandler handle method.
