dev@glassfish.java.net

Re: custom SAM using glassfish SSO?

From: Derek Knapp <derek.knapp_at_me.com>
Date: Fri, 21 Sep 2012 01:44:22 -0700

Is it possible to @Inject my custom principal in to an ejb?

It seems that when I inject a principal using,

@Inject
private Principal principal;

it returns a org.jboss.weld.security.Principal, which seems to wrap my custom principal (I say this because the toString method uses my custom principal's toString)

Normally this wouldn't matter, but I actually have some custom data I was hoping to access.


Derek

On Sep 17, 2012, at 11:27 AM, Ron Monzillo <ron.monzillo_at_oracle.com> wrote:

> On 9/17/12 10:38 AM, Derek Knapp wrote:
>> Is there any way for my custom SAM to use glassfish's build in SSO abilities?
>>
>> If not, anyone have any experience doing SSO across multiple applications with a custom SAM?
> Derek,
>
>
> Yes, by using a proprietary extension to the Servlet Profile of JASPIC, a SAM can tell the Glassfish
> Servlet container to "register" an authentication session.
>
> From validateRequest, and after having used the container callback handler to
> set the caller identity, the SAM would return the following key value pair in the MessageInfo (map)
>
> key = "com.sun.web.RealmAdapter.register"
> value = "true"
>
> Then when the SAM returns to the container, with return value AuthStatus.SUCCESS,
> the container will bind the request to a container authentication session.
>
> Ron