Java Authentication and Authorization Service
| Company type | Software library |
|---|---|
| Industry | Information security, software development |
| Founded | 1999 |
| Headquarters | United States |
| Products | Authentication and authorization framework for Java applications |
Java Authentication and Authorization Service, commonly known as JAAS and pronounced "Jazz," represents the Java-based realization of the standard Pluggable Authentication Module (PAM) framework within the information security domain. Initially released as an add-on library in Java Platform, Standard Edition 1.3 and subsequently incorporated into version 1.4, JAAS facilitates the decoupling of user authentication processes for independent administration. In contrast to prior approaches that concentrated on verifying code provenance and signatures, JAAS introduces validation of the entity executing the code, thereby strengthening security models for Java applications that require both authentication and authorization.
Administration
System administrators work with two main types of configuration files in JAAS:
*.login.conf: integrates login modules provided by vendors with specific software applications*.policy: specifies the permissions assigned to various identities, whether users or software entities
An example excerpt from a login.conf file for an application might look like:
PetShopApplication {
com.sun.security.auth.module.LdapLoginModule sufficient;
com.foo.SmartcardLoginModule requisite;
com.sun.security.auth.module.UnixLoginModule required debug=true;
}
Application interface
From a developer’s perspective, JAAS offers:
- Mechanisms to represent user identities (Principal) and containers for credentials (Subject)
- A login service that triggers application callbacks to gather user credentials, ultimately producing a new Subject
- Functionality to determine whether a given Subject holds administrator-assigned permissions
Security system integration
For those integrating security solutions, JAAS provides interfaces that allow:
- Defining identity namespaces usable by applications
- Associating credentials with execution threads through Subjects
- Creating login modules capable of interacting with users via callbacks, validating input, and constructing Subjects
Login Modules
Within JAAS, login modules are dedicated to handling authentication by implementing the javax.security.auth.spi.LoginModule interface. The essential methods include:
- initialize: Prepares the login module, typically by storing configuration parameters internally.
- login: Authenticates credentials using a
javax.security.auth.Callbackmechanism (such as querying a database). If authentication fails, it must throw aFailedLoginExceptionto prevent unauthorized access. - commit: Upon successful verification, this method assigns
PrincipalandGroups(roles) to the authenticated subject. This step is vital in enterprise contexts to comply with Java EE server requirements; failure here should also trigger aFailedLoginException. - abort: Called when authentication does not succeed; returning false results in the login module being disregarded.
- logout: Carries out logout operations like removing
Principalentries from theSubjector invalidating user sessions.
These login modules can support single sign-on (SSO) through standards such as SAML, OpenID, and SPNEGO, and may also work with hardware security devices like USB tokens. In multi-tier architectures, login modules might be deployed on both client and server sides.
LoginModule (javax.security.auth.spi.LoginModule)
This interface outlines the authentication procedures within login modules, which verify users by matching provided credentials against stored passwords or other validation methods.
LoginContext (javax.security.auth.login.LoginContext)
The LoginContext triggers the JAAS authentication sequence by generating a Subject, which is subsequently filled with principals and credentials throughout the authentication process.
Subject (javax.security.auth.Subject)
A subject denotes an individual user, entity, or system—essentially a client—seeking authentication.
Principal (java.security.Principal)
A principal signifies the identity linked to a subject, capturing its attributes or characteristics. Multiple principals can be associated with a single subject.
Credentials
Credentials comprise data related to the subject, including account identifiers, passwords, or certificates. To maintain security and manage their lifecycle, interfaces such as javax.security.auth.Destroyable and javax.security.auth.Refreshable facilitate credential management. For instance, after user authentication, a confidential ID credential might be granted for accessing sensitive services but should be discarded after a predetermined duration using Destroyable. Likewise, Refreshable handles credentials that have an expiration timeframe.