Where to place security configuration file in WAR?

Question

I'm trying to use JAAS for authentication in my WAR. I understand that my configuration file (another link) should be placed somewhere (as explained here). Unfortunately, I can't understand where exactly, if we're talking about WAR? And how to name the file?

// JAAS has to find the file and retrieve "foo" from it
LoginContext ctx = new LoginContext("foo", this);

Bowleg

Answer 1

I had the same problem and I wanted to see if I couldn't dynamically set this property based on the current classpath (which would be located inside the war itself).

public class SecurityListener implements ServletContextListener {
    public SecurityListener() {
    }

    @Override
    public void contextDestroyed(ServletContextEvent arg0) {
    }

    @Override
    public void contextInitialized(ServletContextEvent arg0) {
        if(System.getProperty("java.security.auth.login.config") == null) {
            String jaasConfigFile = null;
            URL jaasConfigURL = this.getClass().getClassLoader().getResource("login.conf");
            if(jaasConfigURL != null) {
                jaasConfigFile = jaasConfigURL.getFile();
            }
            System.setProperty("java.security.auth.login.config", jaasConfigFile);
        }
    }
}

Obviously, you need to add the listener to your web.xml:

<listener>
    <listener-class>example.SecurityListener</listener-class>
</listener>

What this does is set the property java.security.auth.login.config upon instantiation of the web application if it has not yet been defined. This means you could throw it in your source folder and load it automatically if not otherwise redefined elsewhere. I have tested this and it works on Tomcat 6.

So, for example if your tomcat installation was in "C:\program files\tomcat6\" with your war deployed in "C:\program files\tomcat6\webapps\mywar", the path it would find would be "C:\program files\tomcat6\webapp\mywar\WEB-INF\classes" which is always accurate. Not sure if this solution also works with other web applications, but I would imagine so since login.conf is going to be where the classpath root is.

Hope that helps!

Veronicaveronika

Answer 2

You can encapsulate the client_jaas.conf in the jar, and use the code to specify the configuration dynamically

System.setProperty("java.security.auth.login.config", XXX.class.getClassLoader().getResource("client_jaas.conf").toString());

Francie

Answer 3

Unfortunately the only way I was able to get it to work was to create a file jass.conf and specify it using either:

• In the Tomcat java parameters:

  -Djava.security.auth.login.config==c:\\path\\To\\file.conf
  

• or from within the Java code:

  System.setProperty("java.security.auth.login.config","c:\\path\\To\\file.conf");
  

I'd also like to know a better way to specify the configuration. I want to package that configuration in my WAR.

Dimitris

well, it's an option. Maybe we can set this java.security.auth.login.config param somewhere in .properties file inside WAR? In your case this setting will be global for all applications in Tomcat. – Bowleg

did you find a way to refer to the .conf file which is placed inside your WAR file ? – Demount