[KARAF-172] Implement a mechanism that would allow a karaf application to distingush between UserPrincipal & RolePrincipal without depending from Karaf JAAS Modules

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.1.0
• Assignee: Ioannis Canellos
• Reporter: Ioannis Canellos
• Created: 26/Aug/10 13:34
• Updated: 25/Jul/11 11:45
• Resolved: 03/Sep/10 13:11

Description

A karaf application that makes use of JAAS for authentication and authorization will obtain a LoginContext that contains UserPrincipal and RolePrincipal objects (both classes are inside org.apache.karaf.jaas:org.apache.karaf.jaas.modules).

If such application needs to distinguish between those two(e.g role based authorization), will have to depend from org.apache.karaf.jaas:org.apache.karaf.jaas.modules.

I think that the application needs to be decoupled from Karaf JAAS Modules and this is why I think that an alternative needs to be provided to the user.

Such alternative could be the use of a convention (maybe like having a prefix on Roles, or goruping roles under a Group with a fixed name (jboss approach)). This mechanism could be implemented by Karaf Login Modules and even better could be pluggable.