OpenJDK 27 · com.sun.jmx.remote.security.FileLoginModule

This LoginModule performs file-based authentication.

A supplied username and password is verified against the corresponding user credentials stored in a designated password file. If successful then a new JMXPrincipal is created with the user's name and it is associated with the current Subject. Such principals may be identified and granted management privileges in the access control file for JMX remote management or in a Java security policy. By default, the following password file is used:

    ${java.home}/conf/management/jmxremote.password

A different password file can be specified via the passwordFile configuration option.

This module recognizes the following Configuration options:

passwordFile: the path to an alternative password file. It is used instead of the default password file.
useFirstPass: if true, this module retrieves the username and password from the module's shared state, using "javax.security.auth.login.name" and "javax.security.auth.login.password" as the respective keys. The retrieved values are used for authentication. If authentication fails, no attempt for a retry is made, and the failure is reported back to the calling application.
tryFirstPass: if true, this module retrieves the username and password from the module's shared state, using "javax.security.auth.login.name" and "javax.security.auth.login.password" as the respective keys. The retrieved values are used for authentication. If authentication fails, the module uses the CallbackHandler to retrieve a new username and password, and another attempt to authenticate is made. If the authentication fails, the failure is reported back to the calling application.
storePass: if true, this module stores the username and password obtained from the CallbackHandler in the module's shared state, using "javax.security.auth.login.name" and "javax.security.auth.login.password" as the respective keys. This is not performed if existing values already exist for the username and password in the shared state, or if authentication fails.
clearPass: if true, this module clears the username and password stored in the module's shared state after both phases of authentication (login and commit) have completed.
hashPasswords: if true, this module replaces each clear text password with its hash, if present.

Field Summary

Modifier and Type	Field and Description
private CallbackHandler	callbackHandler
private boolean	clearPass
private boolean	commitSucceeded
private static final String	DEFAULT_PASSWORD_FILE_NAME
private boolean	hashPasswords
private HashedPasswordManager	hashPwdMgr
private static final ClassLogger	logger
private Map<String, ?>	options
private char[]	password
private static final String	PASSWORD_FILE_NAME
private static final String	PASSWORD_KEY
private String	passwordFile
private String	passwordFileDisplayName
private Map<String, Object>	sharedState
private boolean	storePass
private Subject	subject
private boolean	succeeded
private boolean	tryFirstPass
private boolean	useFirstPass
private JMXPrincipal	user
private String	username
private static final String	USERNAME_KEY
private boolean	userSuppliedPasswordFile

Constructor Summary

Access	Constructor and Description
public	FileLoginModule()

Method Summary

Modifier and Type	Method and Description
public boolean	Returns: false if this LoginModule's own login and/or commit attempts failed, and true otherwise. abort() Implements javax.security.auth.spi.LoginModule.abort. Abort user authentication (Authentication Phase 2).
private void	attemptAuthentication(boolean a flag to tell this method whether to retrieve the password from the sharedState. usePasswdFromSharedState) Attempt authentication
private void	cleanState() Clean out state because of a failed authentication attempt
public boolean	Returns: true if this LoginModule's own login and commit attempts succeeded, or false otherwise. commit() Implements javax.security.auth.spi.LoginModule.commit. Complete user authentication (Authentication Phase 2).
private void	getUsernamePassword(boolean boolean that tells this method whether to retrieve the password from the sharedState. usePasswdFromSharedState) Get the username and password.
public void	initialize(Subject the `Subject` to be authenticated. subject, CallbackHandler a `CallbackHandler` to acquire the user's name and password. callbackHandler, Map<String, ?> shared `LoginModule` state. sharedState, Map<String, ?> options specified in the login `Configuration` for this particular `LoginModule`. options) Implements javax.security.auth.spi.LoginModule.initialize. Initialize this `LoginModule`.
public boolean	Returns: true always, since this `LoginModule` should not be ignored. login() Implements javax.security.auth.spi.LoginModule.login. Begin user authentication (Authentication Phase 1).
public boolean	Returns: true in all cases since this `LoginModule` should not be ignored. logout() Implements javax.security.auth.spi.LoginModule.logout. Logout a user.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

callbackHandler	back to summary
private CallbackHandler callbackHandler

clearPass	back to summary
private boolean clearPass

commitSucceeded	back to summary
private boolean commitSucceeded

DEFAULT_PASSWORD_FILE_NAME	back to summary
private static final String DEFAULT_PASSWORD_FILE_NAME

hashPasswords	back to summary
private boolean hashPasswords

hashPwdMgr	back to summary
private HashedPasswordManager hashPwdMgr

logger	back to summary
private static final ClassLogger logger

options	back to summary
private Map<String, ?> options

password	back to summary
private char[] password

PASSWORD_FILE_NAME	back to summary
private static final String PASSWORD_FILE_NAME

PASSWORD_KEY	back to summary
private static final String PASSWORD_KEY

passwordFile	back to summary
private String passwordFile

passwordFileDisplayName	back to summary
private String passwordFileDisplayName

sharedState	back to summary
private Map<String, Object> sharedState

storePass	back to summary
private boolean storePass

subject	back to summary
private Subject subject

succeeded	back to summary
private boolean succeeded

tryFirstPass	back to summary
private boolean tryFirstPass

useFirstPass	back to summary
private boolean useFirstPass

user	back to summary
private JMXPrincipal user

username	back to summary
private String username

USERNAME_KEY	back to summary
private static final String USERNAME_KEY

userSuppliedPasswordFile	back to summary
private boolean userSuppliedPasswordFile

Constructor Detail

FileLoginModule	back to summary
public FileLoginModule()

Method Detail

abort back to summary

abort	back to summary
public boolean abort() throws LoginException Implements javax.security.auth.spi.LoginModule.abort. Abort user authentication (Authentication Phase 2). This method is called if the LoginContext's overall authentication failed (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules did not succeed). If this LoginModule's own authentication attempt succeeded (checked by retrieving the private state saved by the `login` and `commit` methods), then this method cleans up any state that was originally saved. Returns:boolean false if this LoginModule's own login and/or commit attempts failed, and true otherwise. Exceptions LoginException: if the abort fails.

public boolean abort() throws LoginException

Implements javax.security.auth.spi.LoginModule.abort.

Abort user authentication (Authentication Phase 2).

This method is called if the LoginContext's overall authentication failed (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules did not succeed).

If this LoginModule's own authentication attempt succeeded (checked by retrieving the private state saved by the login and commit methods), then this method cleans up any state that was originally saved.

Returns:boolean

false if this LoginModule's own login and/or commit attempts failed, and true otherwise.

Exceptions

LoginException:: if the abort fails.

attemptAuthentication	back to summary
private void attemptAuthentication(boolean usePasswdFromSharedState) throws LoginException Attempt authentication Parameters usePasswdFromSharedState:boolean a flag to tell this method whether to retrieve the password from the sharedState.

attemptAuthentication

back to summary

private void attemptAuthentication(boolean usePasswdFromSharedState) throws LoginException

Attempt authentication

Parameters

usePasswdFromSharedState:boolean: a flag to tell this method whether to retrieve the password from the sharedState.

cleanState	back to summary
private void cleanState() Clean out state because of a failed authentication attempt

commit back to summary

commit	back to summary
public boolean commit() throws LoginException Implements javax.security.auth.spi.LoginModule.commit. Complete user authentication (Authentication Phase 2). This method is called if the LoginContext's overall authentication has succeeded (all the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules have succeeded). If this LoginModule's own authentication attempt succeeded (checked by retrieving the private state saved by the `login` method), then this method associates a `JMXPrincipal` with the `Subject` located in the `LoginModule`. If this LoginModule's own authentication attempted failed, then this method removes any state that was originally saved. Returns:boolean true if this LoginModule's own login and commit attempts succeeded, or false otherwise. Exceptions LoginException: if the commit fails

public boolean commit() throws LoginException

Implements javax.security.auth.spi.LoginModule.commit.

Complete user authentication (Authentication Phase 2).

This method is called if the LoginContext's overall authentication has succeeded (all the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules have succeeded).

If this LoginModule's own authentication attempt succeeded (checked by retrieving the private state saved by the login method), then this method associates a JMXPrincipal with the Subject located in the LoginModule. If this LoginModule's own authentication attempted failed, then this method removes any state that was originally saved.

Returns:boolean

true if this LoginModule's own login and commit attempts succeeded, or false otherwise.

Exceptions

LoginException:: if the commit fails

getUsernamePassword	back to summary
private void getUsernamePassword(boolean usePasswdFromSharedState) throws LoginException Get the username and password. This method does not return any value. Instead, it sets global name and password variables. Also note that this method will set the username and password values in the shared state in case subsequent LoginModules want to use them via use/tryFirstPass. Parameters usePasswdFromSharedState:boolean boolean that tells this method whether to retrieve the password from the sharedState.

getUsernamePassword

back to summary

private void getUsernamePassword(boolean usePasswdFromSharedState) throws LoginException

Get the username and password. This method does not return any value. Instead, it sets global name and password variables.

Also note that this method will set the username and password values in the shared state in case subsequent LoginModules want to use them via use/tryFirstPass.

Parameters

usePasswdFromSharedState:boolean: boolean that tells this method whether to retrieve the password from the sharedState.

initialize back to summary

initialize	back to summary
public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState, Map<String, ?> options) Implements javax.security.auth.spi.LoginModule.initialize. Initialize this `LoginModule`. Parameters subject:Subject the `Subject` to be authenticated. callbackHandler:CallbackHandler a `CallbackHandler` to acquire the user's name and password. sharedState:Map<String, ?> shared `LoginModule` state. options:Map<String, ?> options specified in the login `Configuration` for this particular `LoginModule`.

public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState, Map<String, ?> options)

Implements javax.security.auth.spi.LoginModule.initialize.

Initialize this LoginModule.

Parameters

subject:Subject: the Subject to be authenticated.
callbackHandler:CallbackHandler: a CallbackHandler to acquire the user's name and password.
sharedState:Map<String, ?>: shared LoginModule state.
options:Map<String, ?>: options specified in the login Configuration for this particular LoginModule.

login	back to summary
public boolean login() throws LoginException Implements javax.security.auth.spi.LoginModule.login. Begin user authentication (Authentication Phase 1). Acquire the user's name and password and verify them against the corresponding credentials from the password file. Returns:boolean true always, since this `LoginModule` should not be ignored. Exceptions LoginException: if this `LoginModule` is unable to perform the authentication. FailedLoginException: if the authentication fails.

public boolean login() throws LoginException

Implements javax.security.auth.spi.LoginModule.login.

Begin user authentication (Authentication Phase 1).

Acquire the user's name and password and verify them against the corresponding credentials from the password file.

Returns:boolean

true always, since this LoginModule should not be ignored.

Exceptions

LoginException:: if this LoginModule is unable to perform the authentication.
FailedLoginException:: if the authentication fails.

logout back to summary

logout	back to summary
public boolean logout() throws LoginException Implements javax.security.auth.spi.LoginModule.logout. Logout a user. This method removes the Principals that were added by the `commit` method. Returns:boolean true in all cases since this `LoginModule` should not be ignored. Exceptions LoginException: if the logout fails.

public boolean logout() throws LoginException

Implements javax.security.auth.spi.LoginModule.logout.

Logout a user.

This method removes the Principals that were added by the commit method.

Returns:boolean

true in all cases since this LoginModule should not be ignored.

Exceptions

LoginException:: if the logout fails.

public Class FileLoginModule

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail