JAAS microservice authentication

2
votes

I am trying to design a JAAS microservice which handles user authentication for multiple J2EE applications. Currently we have multiple applications which authenticate against our LDAP and have seperate role-systems. Now I am stuck at designing the interface between the application and the authentication backend.

Via custom LoginModule: Design a custom login module which uses a nonsecured EJB interface from our LoginService to authenticate and authorize, but i remembered reading that login modules can't be injected with EJBs / use EJBs.

Is this the right starting point, or do i have other possibilities to refactor JAAS security out of our applications? Has somebody done something like that before?

1
javaauthenticationjakarta-eeejbjaas

1 Answers

1
votes

I had been curious about Java security some time before. I have found nice framework Picketlink.

Despite it needs quite high threshold to entry, it is much more flexible than JAAS and handles most typical needs.