Chapter 1. Login Module Overview

Login Module Functional Organization

• Login Modules Without External Identity Store

  • Identity Login Module - Used when a fixed or hard-coded user name is needed.
  • UsersRoles Login Module - Loads user names and roles from a local Java properties files.
  • PropertiesUsers Login Module - Loads only user names from a local Java properties files.
  • SimpleUsers Login Module - Defines user names and passwords directly in the login module configuration.
  • SecureIdentity Login Module - Legacy, allows for a static principal and encrypted password to be defined directly in the module configuration.
  • ConfiguredIdentity Login Module - Associates a static principal to any authenticated user.
  • Simple Login Module - A module for quick security setup for testing.
  • Disabled Login Module - A module that always fails authentication.
  • Anon Login Module - A module to specify the identity for an unauthenticated user.
  • RunAs Login Module - Helper module for adding an additional static role during the authentication phase.
  • RoleMapping Login Module - Helper module for adding to or replacing the roles of an authenticated user with one or more roles.
  • RealmDirect Login Module - Delegates authentication to a security realm.
  • RealmUsersRoles Login Module - Legacy module replaced by RealmDirect.

• Login Modules With External Identity Store

  • Database Login Module - Uses a database to store users and role mappings.
  • DatabaseUsers Login Module - Alias to Database for compatibility.
  • Ldap Login Module - Uses an LDAP server to store users and role mappings.
  • LdapExtended Login Module
  • AdvancedLdap Login Module - Provides additional functionality when authenticating using an LDAP server.
  • AdvancedAdLdap Login Module - Provides additional functionality used in Microsoft Active Directory.
  • LdapUsers Login Module - Legacy module replaced by LdapExtended and AdvancedLdap.
  • Kerberos Login Module - Used with Kerberos authentication.
  • SPNEGO Login Module - Used with Kerberos authentication.

• Certificate-Based Login Modules

  • Certificate Login Module - Authenticates users via X509 certificates.
  • CertificateRoles Login Module - Extends Certificate module with role mapping.
  • DatabaseCertificate Login Module - Extends Certificate module with role mapping stored in a database.

• Login Modules for EJBs and Remoting

  • Remoting Login Module - Used in securing remote EJB invocations.
  • Client Login Module - Used in local, in-JVM, EJB calls for establishing client identity.
• Custom Login Modules

Login Module Extension Hierarchy

• AbstractServer Login Module

  • AbstractPasswordCredential Login Module

    • SecureIdentity Login Module
    • ConfiguredIdentity Login Module

  • Certificate Login Module

    • CertificateRoles Login Module
    • DatabaseCertificate Login Module

  • Common Login Module

    • AdvancedLdap Login Module

      • AdvancedAdLdap Login Module
    • SPNEGO Login Module
  • Identity Login Module
  • RoleMapping Login Module
  • Remoting Login Module

  • UsernamePassword Login Module

    • Database Login Module
    • LdapExtended Login Module
    • Ldap Login Module
    • LdapUsers Login Module
    • Simple Login Module
    • Anon Login Module
    • RealmDirect Login Module

    • UsersRoles Login Module

      • RealmUsersRoles Login Module

      • PropertiesUsers Login Module

        • SimpleUsers Login Module
• Client Login Module
• DatabaseUsers Login Module
• Disabled Login Module
• Kerberos Login Module
• RunAs Login Module