Java Authentication and Authorization Service, or JAAS, pronounced "Jazz", is a Java security framework for user-centric security to augment the Java code-based security. Since Java Runtime Environment 1.4 JAAS has been integrated with the JRE - previously JAAS was supplied as an extension library by Sun.
JAAS's main goal is to separate the concerns of user authentication so that they may be managed independently. JAAS introduces a new term to the security architecture of the Java platform as an additional layer for the verification. While the former authentication mechanism contained information about where the code originated from and who is the signer of the code snippet, the latter platform adds a marker about who runs the code. By extending the verification vectors JAAS extends the security architecture for Java applications that require authentication and authorization modules.
Contents |
For the system administrator, JAAS consists of two kinds of configuration file:
For example, an application may have this login.conf file indicating how different authentication mechanisms are to be run to authenticate the user:
PetShopApplication {
com.sun.security.auth.module.LdapLoginModule sufficient;
com.foo.SmartcardLoginModule requisite;
com.sun.security.auth.module.UnixLoginModule required debug=true;
};
For the application developer, JAAS is a standard library that provides:
For the security system integrator, JAAS provides interfaces:
|
|||||