You want to use JAAS in TomEE with custom (or OpenEJB) LoginModules.
TomEE tries to keep as possible as it is Tomcat so simply configure your JAAS LoginModule as in Tomcat.
Note: only the first one will be used.
Add to your CATALINA_OPTS
the java.security.auth.login.config
system property:
-Djava.security.auth.login.config=$CATALINA_BASE/conf/login.config
Configure your realm in server.xml file
<?xml version='1.0' encoding='utf-8'?>
<Server port="8005" shutdown="SHUTDOWN">
<Listener className="org.apache.tomee.loader.OpenEJBListener" />
<Listener className="org.apache.catalina.security.SecurityListener" />
<Service name="Catalina">
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
<Engine name="Catalina" defaultHost="localhost">
<!-- here is the magic -->
<Realm className="org.apache.catalina.realm.JAASRealm" appName="PropertiesLogin"
userClassNames="org.apache.openejb.core.security.jaas.UserPrincipal"
roleClassNames="org.apache.openejb.core.security.jaas.GroupPrincipal">
</Realm>
<Host name="localhost" appBase="webapps"
unpackWARs="true" autoDeploy="true" />
</Engine>
</Service>
</Server>
Configure your login.config
file
PropertiesLogin {
org.apache.openejb.core.security.jaas.PropertiesLoginModule required
Debug=false
UsersFile="users.properties"
GroupsFile="groups.properties";
};
Configure your login module specifically (users.properties
for snippets of this page for instance).
Place users.properties
and groups.properties
files in $CATALINA_BASE/conf/
folder.
users.properties
file contains user name and associated password entries, ex.:
me=password
tomee=tomee
groups.properties
file specifies groups and their users, ex.:
my-role=me
manager-gui=tomee,me
tomee-admin=tomee
NOTE: users.properties
and groups.properties
file names and file location are fixed. If other names are used, the files must be placed in %CATALINA_BASE/lib/
folder instead.