JAAS tutorial - how to force application to run with policy

Posted by wuntee on Stack Overflow See other posts from Stack Overflow or by wuntee
Published on 2010-05-26T04:15:52Z Indexed on 2010/05/26 4:21 UTC
Read the original article Hit count: 301

Filed under:

jaas

I just went through this tutorial:

http://java.sun.com/docs/books/tutorial/security/tour2/index.html

And was curios about the basic concept of JAAS... If every applcation needs to be run with the '-Djava.security.manager -Djava.security.policy=...' flags, what is enforcing security? Is it up to the end user to know when any Java application is being run, and modify the executable/script/whatever to include those flags? Or, how does a developer enforce that an application is run with the security manager enabled?

The whole concept doesnt seem very functional to me - as it is by default not enabled... Am I missing something?

Related posts about jaas

jaas authentication using jetty and gwt

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello, I am trying to use JAAS to authenticate my users. My project is in GWT v2, which runs jetty. I use eclipse for development. From http://code.google.com/p/google-web-toolkit/issues/detail?id=4462 I found out that jetty doesn't like any realm definitions in web.xml, so I moved them to jetty-web… >>> More
Enable Grizzly to perform JaaS simple HTTP AUTH

as seen on Stack Overflow - Search for 'Stack Overflow'
How can I make Grizzly HTTP server allow JaaS for simple HTTP AUTH? I can't see any code/sample out there: There's another post here in StackOverflow that directly assumes that jaaS is available in Grizzly, but doesn't explain how to add it. >>> More
URLCallback with JAAS on WAS?

as seen on Stack Overflow - Search for 'Stack Overflow'
I extended the JAAS javax.security.auth.spi.LoginModule, and installed it into a WAS server. It works; all logins go through the code in this new class, and if it says to not let them login, they're prevented from logging in. The root problem: I don't want it to filter logins for the admin console… >>> More
JAAS and WebLogic 10.3: Granting specific codebase permissions to a JAR bundled within an EAR

as seen on Stack Overflow - Search for 'Stack Overflow'
Here's my scenario: I have a JAR within the APP-INF/lib of my EAR, to be deployed within WebLogic 10g Release 3 against which I wish to grant specific permissions. e.g., grant codebase "file:/c:/somedir/my.jar" { permission java.net.SocketPermission "*:-","accept,connect,listen, resolve"; permission… >>> More
JAAS tutorial - how to force application to run with policy

as seen on Stack Overflow - Search for 'Stack Overflow'
I just went through this tutorial: http://java.sun.com/docs/books/tutorial/security/tour2/index.html And was curios about the basic concept of JAAS... If every applcation needs to be run with the '-Djava.security.manager -Djava.security.policy=...' flags, what is enforcing security? Is it up to… >>> More

Developer IT