Service Provider

Security configuration in OC4J 11 is very granular and allows administrators to define custom providers for credential store, policy and login. The default configuration in OC4J uses the Oracle JAAS provider, which by default stores the user accounts and application roles in jazn-data.xml, a XML formatted ASCII file. The Service provider section is used to register a provider with a type, a name and a reference to the implementation class called by the Oracle Java Platform Security framework.

Service Instances

The service instance is used to configure instances of the declared service providers. For the use of JAAS login modules, the service instances configure a specific LoginModule and its required initialization properties for a specific security provider, like oracle.security.jps.internal.login.jaas.JaasLoginServiceProvider. The Oracle JaasLoginServiceProvider is the default security provider used also for container managed security.

<serviceProvider type="LOGIN" name="jaas.login.provider" class="oracle.security.jps.internal.login.jaas.JaasLoginServiceProvider">
<description>This is Jaas Login Service Provider and is used to configure login module service instances</description>
</serviceProvider>

Custom LoginModules that are used for OC4J container managed security or direct JAAS authentication need to be configured as a named instance in the jps-config.xml configuration file.

<serviceInstance name="adf.demo.sample.auth" provider="jaas.login.provider">
<description>Sample LoginModule</description>
<property name="loginModuleClassName" value="<the login module package and class name>"/>
<property name="jaas.login.controlFlag" value="REQUIRED"/>
</serviceInstance>

In this example, the JAAS LoginModule instance is referencable through its name - adf.demo.sample.auth - an arbitrary string chosen as the name. The provider attribute references the Oracle JAAS security provider by its given registration name. The two mandatory properties configured for this login module are the LoginModule class name and the control flag, which is set to REQUIRED. If the custom LoginModule requires custom properties to be passed upon initialization then this needs to be added here as well.

LoginModule Context

The LoginContext is used in JAAS to reference the JAAS LoginModule configuration from an application for authentication. In the application code, the LoginContext is created with a name identifying the LoginModule configuration defined in the security policy and a CallbackHandler to be used for user interaction. In the jps-config.xml file the context is created as follows:

<jpsContexts>
...
<jpsContext name="how-to-auth-sample-ctx">
<serviceInstanceRef ref="adf.demo.sample.auth"/>
</jpsContext>
...
</jpsContexts>

This is how you setup the JAAS context. The rest should be the same as before

Frank

in <serviceInstances> section, add
<serviceInstances>
<serviceInstance name="testlogin" provider="jaas.login.provider">
<description>Sample LoginModule</description>
<property name="loginModuleClassName" value="oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule"/>
<property name="jaas.login.controlFlag" value="REQUIRED"/>
<property name="table" value="ovs_user"/>
<property name="data_source_name" value="jdbc/OVSDS"/>
<property name="groupMembershipGroupFieldName" value="role_name"/>
<property name="passwordField" value="password"/>
<property name="groupMembershipTableName" value="ovs_user_role_view"/>
<property name="usernameField" value="role_name"/>
<property name="pw_encoding_class" value="role_name"/>
<property name="groupMembershipGroupFieldName" value="oracle.security.jazn.login.module.db.util.DBLoginModuleMD5Encoder"/>
</serviceInstance>

in <jpsContexts> section add
<jpsContext name="testlogin">
<serviceInstanceRef ref="testlogin"/>
</jpsContext>

And I have removed the configuration about custom login module from system-jazn-data.xml.

But the custom login module is still ignored.

Thanx