Programmatic Login to Authenticate Against a EJB in Glassfish

What?

This is the method used to authenticate a standalone java client (including Eclipse RCP plugins) to the Glassfish EJB container.

References

1. http://java.sun.com/developer/EJTechTips/2006/tt0225.html#2

How?

See here on how to configure Glassfish's server.policy file: https://glassfish.dev.java.net/javaee5/docs/DG/beabg.html#beacm

Make sure the following jars from Glassfish are in the classpath:

1. javaee.jar
2. appserv-admin.jar
3. appserv-deployment-client.jar
4. appserv-ext.jar
5. appserv-rt.jar
6. and your client classes with the EJB lookup code

The following parameter needs to be passed the VM

-Djava.security.auth.login.config=/appclientlogin.conf

where PATH is the fully qualified path to the appclientlogin.conf. You can get this file from your glassfish installation. This file should be shipped with your client code.

Edit the appclientlogin.conf to add the following

file {
com.sun.enterprise.security.auth.login.ClientPasswordLoginModule required debug=true;
};

where "file" is the realm name you have configured in Glassfish. By default glassfish comes with the file realm pre-configured. See [here|http://weblogs.java.net/blog/tchangu/archive/2007/01/ldap_security_r.html] for instructions on how to configure an LDAP realm.

Now, add the following code to your client to authenticate a bean:

Properties props = new Properties();

props.put(Context.INITIAL_CONTEXT_FACTORY,
"com.sun.enterprise.naming.SerialInitContextFactory");
props.setProperty("org.omg.CORBA.ORBInitialHost", "localhost");
// NOTE: IIOP is set on port 3701 but this works on port 3700
props.setProperty("org.omg.CORBA.ORBInitialPort", "3700");
// props.setProperty("java.security.auth.login.config", "");

ProgrammaticLogin programmaticLogin = new ProgrammaticLogin();
try {

Boolean login = programmaticLogin.login("myuser", "password",
"file", false);
// login always returns true
// always uses default realm for some reason
System.out.println("State:" + login);
} catch (Exception e) {
e.printStackTrace();
}
System.out.println();

InitialContext ctx;
try {
ctx = new InitialContext(props);
// this is where the actual login happens!
serviceBean = (PermitServiceRemote) ctx
.lookup("ejb/permit/stateless/PermitServiceBean");
} catch (NamingException e1) {
// TODO Auto-generated catch block
e1.printStackTrace();
}

You should be set. For some of discussions surrounding this see here:

1. http://fisheye5.cenqua.com/browse/glassfish/appserv-core/src/java/com/sun/appserv/security/ProgrammaticLogin.java?r=1.5
2. http://forums.java.net/jive/thread.jspa?messageID=242260&#242260
3. http://forum.java.sun.com/thread.jspa?threadID=761291&tstart=255
4. https://glassfish.dev.java.net/javaee5/docs/DG/beabg.html#beacm