This is an automated email from the ASF dual-hosted git repository.
ChristopherSchultz pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new 92c8cb8eea Remove additional references to JAASRealm
92c8cb8eea is described below
commit 92c8cb8eea0f399fcae74a2b8ec83dba164befa2
Author: Christopher Schultz <[email protected]>
AuthorDate: Tue Oct 13 18:37:13 2026 +0100
Remove additional references to JAASRealm
---
build.xml | 1 -
.../apache/catalina/realm/LocalStrings.properties | 20 ----
.../catalina/realm/LocalStrings_cs.properties | 1 -
.../catalina/realm/LocalStrings_de.properties | 6 --
.../catalina/realm/LocalStrings_es.properties | 21 ----
.../catalina/realm/LocalStrings_fr.properties | 20 ----
.../catalina/realm/LocalStrings_ja.properties | 20 ----
.../catalina/realm/LocalStrings_ko.properties | 18 ----
.../catalina/realm/LocalStrings_pt_BR.properties | 2 -
.../catalina/realm/LocalStrings_zh_CN.properties | 18 ----
java/org/apache/catalina/realm/RealmBase.java | 2 -
.../apache/catalina/realm/mbeans-descriptors.xml | 53 ----------
webapps/docs/config/manager.xml | 4 +-
webapps/docs/config/realm.xml | 109 -------------------
webapps/docs/realm-howto.xml | 117 ---------------------
webapps/docs/security-howto.xml | 4 -
16 files changed, 2 insertions(+), 414 deletions(-)
diff --git a/build.xml b/build.xml
index 4ee4e2bac3..0af0468a8a 100644
--- a/build.xml
+++ b/build.xml
@@ -623,7 +623,6 @@
<exclude name="org/apache/catalina/realm/DataSourceRealm.class" />
<exclude name="org/apache/catalina/realm/JAASCallbackHandler.class" />
<exclude name="org/apache/catalina/realm/JAASMemoryLoginModule.class" />
- <exclude name="org/apache/catalina/realm/JAASRealm.class" />
<exclude name="org/apache/catalina/realm/JNDIRealm$User.class" />
<exclude name="org/apache/catalina/realm/JNDIRealm.class" />
<exclude name="org/apache/catalina/realm/LockOutRealm*" />
diff --git a/java/org/apache/catalina/realm/LocalStrings.properties
b/java/org/apache/catalina/realm/LocalStrings.properties
index 99630ed3be..83a22bf44f 100644
--- a/java/org/apache/catalina/realm/LocalStrings.properties
+++ b/java/org/apache/catalina/realm/LocalStrings.properties
@@ -54,26 +54,6 @@ jaasMemoryLoginModule.noConfig=Cannot load configuration
file [{0}]
jaasMemoryLoginModule.parseError=Error processing configuration file [{0}]
jaasMemoryLoginModule.unknownAuthenticationMethod=Unknown authentication method
-jaasRealm.accountExpired=Username [{0}] NOT authenticated due to expired
account
-jaasRealm.appName=Set JAAS app name [{0}]
-jaasRealm.authenticateFailure=Username [{0}] NOT successfully authenticated
-jaasRealm.authenticateSuccess=Username [{0}] successfully authenticated as
Principal [{1}] -- Subject was created too
-jaasRealm.beginLogin=JAASRealm login requested for username [{0}] using
LoginContext for application [{1}]
-jaasRealm.checkPrincipal=Checking Principal [{0}] [{1}]
-jaasRealm.classNotFound=Class [{0}] was not found
-jaasRealm.configFileNotFound=JAAS configuration resource [{0}] was not found
-jaasRealm.credentialExpired=Username [{0}] NOT authenticated due to expired
credential
-jaasRealm.failedLogin=Username [{0}] NOT authenticated due to failed login
-jaasRealm.loginContextCreated=JAAS LoginContext created for username [{0}]
-jaasRealm.loginException=Login exception authenticating username [{0}]
-jaasRealm.notPrincipal=Class [{0}] not added as it does not implement
java.security.Principal
-jaasRealm.nullSubject=Login succeeded for username [{0}] but a null Subject
was returned
-jaasRealm.rolePrincipalAdd=Adding role Principal [{0}] to this user
Principal''s roles
-jaasRealm.rolePrincipalFailure=No valid role Principals found.
-jaasRealm.unexpectedError=Unexpected error
-jaasRealm.userPrincipalFailure=No valid user Principal found
-jaasRealm.userPrincipalSuccess=Principal [{0}] is a valid user class. We will
use this as the user Principal.
-
jndiRealm.authenticateFailure=Username [{0}] NOT successfully authenticated
jndiRealm.authenticateSuccess=Username [{0}] successfully authenticated
jndiRealm.cipherSuites=Enable [{0}] as cipher suites for tls connection.
diff --git a/java/org/apache/catalina/realm/LocalStrings_cs.properties
b/java/org/apache/catalina/realm/LocalStrings_cs.properties
index e95c816b17..6027dda314 100644
--- a/java/org/apache/catalina/realm/LocalStrings_cs.properties
+++ b/java/org/apache/catalina/realm/LocalStrings_cs.properties
@@ -22,7 +22,6 @@ combinedRealm.authSuccess=Autentizovaný uživatel [{0}] s
REALMem [{1}]
dataSourceRealm.getPassword.exception=Výjima získán hesla pro [{0}]
dataSourceRealm.getRoles.exception=Chyba načtení rolí pro [{0}]
-jaasRealm.loginException=Výjimka přihlášení autentizace uživatele [{0}]
lockOutRealm.authLockedUser=Byl učiněn pokus autentizovat uzamknutého
uživatele [{0}]
diff --git a/java/org/apache/catalina/realm/LocalStrings_de.properties
b/java/org/apache/catalina/realm/LocalStrings_de.properties
index 4d8106a3be..fc6456a50e 100644
--- a/java/org/apache/catalina/realm/LocalStrings_de.properties
+++ b/java/org/apache/catalina/realm/LocalStrings_de.properties
@@ -24,12 +24,6 @@ dataSourceRealm.authenticateSuccess=Benutzername [{0}]
konnte erfolgreich authen
dataSourceRealm.getPassword.exception=Ausnahme beim Holen des Passwortes für
[{0}]
dataSourceRealm.getRoles.exception=Ausnahme beim Holen der Rollen für [{0}]
-jaasRealm.accountExpired=Benutzername [{0}] konnte auf Grund eines
abgelaufenen Kontos NICHT authentifiziert werden
-jaasRealm.authenticateFailure=Benutzername [{0}] konnte NICHT authentifiziert
werden
-jaasRealm.credentialExpired=Benutzername [{0}] konnte auf Grund abgelaufener
Zugangsdaten NICHT authentifiziert werden
-jaasRealm.failedLogin=Benutzername [{0}] konnte auf Grund einer fehlerhaften
Anmeldung NICHT authentifiziert werden
-jaasRealm.loginContextCreated=JAAS LoginContext für Benutzername [{0}] erzeugt
-
jndiRealm.authenticateFailure=Benutzername [{0}] konnte NICHT authentifiziert
werden
jndiRealm.authenticateSuccess=Benutzername [{0}] konnte erfolgreich
authentifiziert werden
diff --git a/java/org/apache/catalina/realm/LocalStrings_es.properties
b/java/org/apache/catalina/realm/LocalStrings_es.properties
index ee335f542b..0012db3d74 100644
--- a/java/org/apache/catalina/realm/LocalStrings_es.properties
+++ b/java/org/apache/catalina/realm/LocalStrings_es.properties
@@ -34,27 +34,6 @@ dataSourceRealm.getRoles.exception=Excepción recuperando
papeles para [{0}]
jaasCallback.username=Devuelto nombre de usuario [{0}]
-jaasRealm.accountExpired=El usuario [{0}] NO ha sido autentificado porque ha
expirado su cuenta
-jaasRealm.authenticateFailure=Nombre de usuario [{0}] NO autenticado con éxito
-jaasRealm.authenticateSuccess=Nombre de usuario [{0}] autenticado con éxito
como Principal [{1}] -- También se ha creado el Asunto
-jaasRealm.beginLogin=JAASRealm login requerido para nombre de usuario [{0}]
usando LoginContext para aplicación [{1}]
-jaasRealm.checkPrincipal=Revisando Principal [{0}] [{1}]
-jaasRealm.credentialExpired=El usuario [{0}] NO ha sido autentificado porque
ha expirado su credencial
-jaasRealm.failedLogin=El usuario [{0}] NO ha sido autentificado porque ha
fallado el login
-jaasRealm.loginContextCreated=JAAS LoginContext creado para nombre de usuario
[{0}]
-jaasRealm.loginException=Excepción de Login autenticando nombre de usuario
[{0}]
-jaasRealm.rolePrincipalAdd=Añadiend papel Principal [{0}] a los papeles de
este usuario Principal
-jaasRealm.rolePrincipalFailure=No se han hallado papeles de Principal válidos.
-jaasRealm.unexpectedError=Error inesperado
-jaasRealm.userPrincipalFailure=No se ha hallado usuario Principal
-jaasRealm.userPrincipalSuccess=El Principal [{0}] es una clase válida de
usuario. La vamos a usar como usuario Principal.
-
-jndiRealm.authenticateFailure=Autentificación fallida para el usuario [{0}]
-jndiRealm.authenticateSuccess=Autentificación correcta para el usuario [{0}]
-jndiRealm.close=Excepción al cerrar la conexión al servidor de directorio
-jndiRealm.exception=Excepción al realizar la autentificación
-jndiRealm.open=Excepción al abrir la conexión al servidor de directorio
-
lockOutRealm.authLockedUser=Se ha intentado autenticar al usuario bloqueado
[{0}]
lockOutRealm.removeWarning=Se ha quitado al usuario [{0}] de la caché de
usuarios fallidos tras [{1}] secgundos para mantener la medida de caché dentro
de los límites
diff --git a/java/org/apache/catalina/realm/LocalStrings_fr.properties
b/java/org/apache/catalina/realm/LocalStrings_fr.properties
index 8028cac508..bec4cd1a46 100644
--- a/java/org/apache/catalina/realm/LocalStrings_fr.properties
+++ b/java/org/apache/catalina/realm/LocalStrings_fr.properties
@@ -53,26 +53,6 @@ jaasMemoryLoginModule.noConfig=Impossible de charger le
fichier de configuration
jaasMemoryLoginModule.parseError=Erreur de traitement du fichier de
configuration [{0}]
jaasMemoryLoginModule.unknownAuthenticationMethod=Méthode d'authentification
inconnue
-jaasRealm.accountExpired=le nom d''utilisateur [{0}] N''A PAS été authentifié
car le compte a expiré
-jaasRealm.appName=Définition du nom d''application JAAS comme [{0}]
-jaasRealm.authenticateFailure=Le nom d''utilisateur [{0}] n''a pas été
authentifié avec succès
-jaasRealm.authenticateSuccess=le nom d''utilisateur [{0}] a été authentifié
avec succès
-jaasRealm.beginLogin=La connection avec le JAASRealm a demandé le nom
d''utilisateur [{0}] en utilisant le LoginContext de l''application [{1}]
-jaasRealm.checkPrincipal=Vérification du principal [{0}] [{1}]
-jaasRealm.classNotFound=La classe [{0}] n''a pas été trouvée
-jaasRealm.configFileNotFound=Le fichier [{0}] de configuration JAAS n''a pas
été trouvé
-jaasRealm.credentialExpired=le nom d''utilisateur [{0}] N''A PAS été
authentifié car son crédit a expiré (expired credential)
-jaasRealm.failedLogin=le nom d''utilisateur [{0}] N''A PAS été authentifié car
son contrôle d''accès (login) a échoué
-jaasRealm.loginContextCreated=Le LoginContext JAAS a été crée pour le nom
d''utilisateur [{0}]
-jaasRealm.loginException=Exception lors de l''authentification par login du
nom d''utilisateur [{0}]
-jaasRealm.notPrincipal=La classe [{0}] n''a pas été ajoutée car elle
n''implémente pas java.security.Principal
-jaasRealm.nullSubject=Le login a réussi pour le nom d''utilisateur [{0}] mais
un Subject null a été retourné
-jaasRealm.rolePrincipalAdd=Ajout du rôle Pincipal [{0}] aux rôles du principal
de l''utilisateur
-jaasRealm.rolePrincipalFailure=Aucun principal avec un rôle valide trouvé
-jaasRealm.unexpectedError=Erreur inattendue
-jaasRealm.userPrincipalFailure=Aucun principal valide trouvé
-jaasRealm.userPrincipalSuccess=Le principal [{0}] est une classe utilisateur
valide, elle sera utilisée comme principal de l''utilisateur
-
jndiRealm.authenticateFailure=Le nom d''utilisateur [{0}] N''A PAS été
authentifié
jndiRealm.authenticateSuccess=Le nom d''utilisateur [{0}] a été authentifié
avec succès
jndiRealm.cipherSuites=La suite de chiffres [{0}] a été activée pour la
connection TLS
diff --git a/java/org/apache/catalina/realm/LocalStrings_ja.properties
b/java/org/apache/catalina/realm/LocalStrings_ja.properties
index 0f9c883576..1e5ecc2a45 100644
--- a/java/org/apache/catalina/realm/LocalStrings_ja.properties
+++ b/java/org/apache/catalina/realm/LocalStrings_ja.properties
@@ -53,26 +53,6 @@ jaasMemoryLoginModule.noConfig=設定ファイルを読み込めませんでし
jaasMemoryLoginModule.parseError=設定ファイル [{0}] 処理中のエラー
jaasMemoryLoginModule.unknownAuthenticationMethod=未知の認証方法です
-jaasRealm.accountExpired=ユーザ名 [{0}] はアカウントの期限が切れているために認証されません
-jaasRealm.appName=JAASアプリケーション名[{0}]を設定します。
-jaasRealm.authenticateFailure=ユーザー名[{0}]は正常に認証されませんでした
-jaasRealm.authenticateSuccess=ユーザ名 [{0}] は Principal [{1}]
として正常に認証されました。Subject も作成されました
-jaasRealm.beginLogin=アプリケーション[{1}]のLoginContextを使用して、ユーザー名[{0}]に対するJAASRealmログインが要求されました。
-jaasRealm.checkPrincipal=プリンシパル [{0}] [{1}] をチェックします
-jaasRealm.classNotFound=クラス [{0}] が見つかりませんでした
-jaasRealm.configFileNotFound=JAAS 構成リソース [{0}] が見つかりませんでした
-jaasRealm.credentialExpired=ユーザ名 [{0}] は証明書の期限が切れたために認証されません
-jaasRealm.failedLogin=ユーザ名 [{0}] はログインに失敗したために認証されませんでした
-jaasRealm.loginContextCreated=ユーザー名[{0}]用に作成されたJAAS LoginContext
-jaasRealm.loginException=ユーザ名 [{0}] の認証中にログイン例外が発生しました
-jaasRealm.notPrincipal=クラス [{0}] はjava.security.Principalを実装していないため追加されません
-jaasRealm.nullSubject=ユーザー名 [{0}] のログインは成功しましたが、Subject が null でした
-jaasRealm.rolePrincipalAdd=このユーザープリンシパルロールにロールプリンシパル [{0}] を追加
-jaasRealm.rolePrincipalFailure=有効な役割はありません。
-jaasRealm.unexpectedError=予期せぬエラー
-jaasRealm.userPrincipalFailure=有効なユーザープリンシパルが見つかりません。
-jaasRealm.userPrincipalSuccess=プリンシパル [{0}]
は有効なユーザークラスです。これをユーザープリンシパルとして使用します。
-
jndiRealm.authenticateFailure=ユーザ名 [{0}] は認証に失敗しました
jndiRealm.authenticateSuccess=ユーザ名 [{0}] は認証に成功しました
jndiRealm.cipherSuites=TLS 接続で暗号スイート [{0}] を有効化しました。
diff --git a/java/org/apache/catalina/realm/LocalStrings_ko.properties
b/java/org/apache/catalina/realm/LocalStrings_ko.properties
index 6be5cd41ea..d84255688c 100644
--- a/java/org/apache/catalina/realm/LocalStrings_ko.properties
+++ b/java/org/apache/catalina/realm/LocalStrings_ko.properties
@@ -46,24 +46,6 @@ jaasMemoryLoginModule.noConfig=설정 파일 [{0}]을(를) 로드할 수 없습
jaasMemoryLoginModule.parseError=설정 파일 [{0}]을(를) 처리하는 중 오류 발생
jaasMemoryLoginModule.unknownAuthenticationMethod=알 수 없는 인증 메소드
-jaasRealm.accountExpired=사용자명 [{0}]은(는) 만료된 계정이라서 인증되지 않았습니다.
-jaasRealm.appName=JAAS 앱 이름 [{0}]을(를) 설정합니다.
-jaasRealm.authenticateFailure=사용자명 [{0}]은(는) 성공적으로 인증되지 못했습니다.
-jaasRealm.authenticateSuccess=사용자명 [{0}]이(가) 성공적으로 Principal [{1}](으)로서
인증되었습니다 -- Subject 또한 생성되었습니다.
-jaasRealm.beginLogin=애플리케이션 [{1}]을(를) 위한 LoginContext를 사용하여, 사용자명 [{0}]을(를) 위한
JAASRealm 로그인이 요청되었습니다.
-jaasRealm.checkPrincipal=Principal [{0}] [{1}]을(를) 점검합니다.
-jaasRealm.classNotFound=클래스 [{0}]을(를) 찾을 수 없었습니다.
-jaasRealm.credentialExpired=만료된 credentials로 인하여, 사용자명 [{0}]이(가) 인증되지 않았습니다.
-jaasRealm.failedLogin=사용자명 [{0}]은(는) 로그인 실패로 인하여 인증되지 않았습니다.
-jaasRealm.loginContextCreated=사용자명 [{0}]을(를) 위해 생성된 JAAS LoginContext
-jaasRealm.loginException=사용자 이름 [{0}]을(를) 인증하는 중 로그인 예외 발생
-jaasRealm.notPrincipal=java.security.Principal을 구현하고 있지 않아, 클래스 [{0}]이(가) 추가되지
않았습니다.
-jaasRealm.rolePrincipalAdd=이 사용자 Principal의 역할들에, 역할 Principal [{0}]을(를) 추가합니다.
-jaasRealm.rolePrincipalFailure=유효한 역할 Principal들을 찾을 수 없습니다.
-jaasRealm.unexpectedError=예기치 않은 오류
-jaasRealm.userPrincipalFailure=유효한 사용자 Principal을 찾을 수 없습니다.
-jaasRealm.userPrincipalSuccess=Principal [{0}]은(는) 유효한 사용자 클래스입니다. 이를 사용자
Principal로 사용하겠습니다.
-
jndiRealm.authenticateFailure=사용자명 [{0}]이(가) 성공적으로 인증되지 못했습니다.
jndiRealm.authenticateSuccess=사용자명 [{0}]이(가) 성공적으로 인증되었습니다.
jndiRealm.cipherSuites=이 tls 연결을 위한 cipher suite들로서, [{0}]을(를) 사용 가능하게 합니다.
diff --git a/java/org/apache/catalina/realm/LocalStrings_pt_BR.properties
b/java/org/apache/catalina/realm/LocalStrings_pt_BR.properties
index 07c4b96a76..d80eb6c5b3 100644
--- a/java/org/apache/catalina/realm/LocalStrings_pt_BR.properties
+++ b/java/org/apache/catalina/realm/LocalStrings_pt_BR.properties
@@ -18,8 +18,6 @@
dataSourceRealm.getRoles.exception=Exceção ao receber papéis para [{0}]
-jaasMemoryLoginModule.unknownAuthenticationMethod=Método de autenticação
desconhecido
-
lockOutRealm.authLockedUser=Foi feita uma tentativa de autenticação do usuário
já bloqueado [{0}]
memoryRealm.loadExist=Arquivo de banco de dados de memória [{0}] ilegível.
diff --git a/java/org/apache/catalina/realm/LocalStrings_zh_CN.properties
b/java/org/apache/catalina/realm/LocalStrings_zh_CN.properties
index b5f2f5870f..37827360cb 100644
--- a/java/org/apache/catalina/realm/LocalStrings_zh_CN.properties
+++ b/java/org/apache/catalina/realm/LocalStrings_zh_CN.properties
@@ -46,24 +46,6 @@ jaasMemoryLoginModule.noConfig=无法加载配置文件 [{0}]
jaasMemoryLoginModule.parseError=处理配置文件[{0}]时出错
jaasMemoryLoginModule.unknownAuthenticationMethod=未知的身份验证方法
-jaasRealm.accountExpired=由于帐户过期，用户名[{0}]未通过身份验证
-jaasRealm.appName=设置JAAS应用程序名称[{0}]
-jaasRealm.authenticateFailure=用户 [{0}] 认证失败
-jaasRealm.authenticateSuccess=用户名 [{0}] 已被成功认证为身份 [{1}] -- 主体也已创建
-jaasRealm.beginLogin=使用应用程序[{1}]的LoginContext为用户名[{0}]请求JAASRealm登录
-jaasRealm.checkPrincipal=正在检查主体[{0}][{1}]
-jaasRealm.classNotFound=找不到类 [{0}]
-jaasRealm.credentialExpired=由于凭据过期，用户名[{0}]未通过身份验证
-jaasRealm.failedLogin=由于登录失败，用户名 [{0}] 无法授权
-jaasRealm.loginContextCreated=为用户名创建的JAAS 登陆上下文[{0}]
-jaasRealm.loginException=登录异常，认证用户名 [{0}]
-jaasRealm.notPrincipal=类[{0}]未添加，因为它未实现java.security.Principal
-jaasRealm.rolePrincipalAdd=已经将角色主体[{0}]添加到此用户主体的角色
-jaasRealm.rolePrincipalFailure=找不到有效的角色主体。
-jaasRealm.unexpectedError=意外错误
-jaasRealm.userPrincipalFailure=未发现有效的用户Principal
-jaasRealm.userPrincipalSuccess=主体[{0}]是有效的用户类。我们将其用作用户主体。
-
jndiRealm.authenticateFailure=用户名[{0}]没有成功认证
jndiRealm.authenticateSuccess=用户名[{0}]成功认证
jndiRealm.cipherSuites=启用 [{0}] 作为 TLS 连接的加密套件。
diff --git a/java/org/apache/catalina/realm/RealmBase.java
b/java/org/apache/catalina/realm/RealmBase.java
index 4866ddc40f..1ab00452cd 100644
--- a/java/org/apache/catalina/realm/RealmBase.java
+++ b/java/org/apache/catalina/realm/RealmBase.java
@@ -909,7 +909,6 @@ public abstract class RealmBase extends LifecycleMBeanBase
implements Realm {
}
}
- // Should be overridden in JAASRealm - to avoid pretty inefficient
conversions
if (principal == null || role == null) {
return false;
}
@@ -975,7 +974,6 @@ public abstract class RealmBase extends LifecycleMBeanBase
implements Realm {
* Realm; otherwise return <code>false</code>.
*/
protected boolean hasRoleInternal(Principal principal, String role) {
- // Should be overridden in JAASRealm - to avoid pretty inefficient
conversions
if (!(principal instanceof GenericPrincipal gp)) {
return false;
}
diff --git a/java/org/apache/catalina/realm/mbeans-descriptors.xml
b/java/org/apache/catalina/realm/mbeans-descriptors.xml
index 16a0087835..b97374fb0a 100644
--- a/java/org/apache/catalina/realm/mbeans-descriptors.xml
+++ b/java/org/apache/catalina/realm/mbeans-descriptors.xml
@@ -85,59 +85,6 @@
</mbean>
- <mbean name="JAASRealm"
- description="Implementation of Realm that authenticates users via
the Java Authentication and Authorization Service (JAAS)"
- domain="Catalina"
- group="Realm"
- type="org.apache.catalina.realm.JAASRealm">
-
- <attribute name="allRolesMode"
- description="The all roles mode."
- type="java.lang.String"/>
-
- <attribute name="appName"
- description="The application name passed to the JAAS LoginContext,
which uses it to select the set of relevant LoginModules"
- type="java.lang.String"/>
-
- <attribute name="className"
- description="Fully qualified class name of the managed object"
- type="java.lang.String"
- writeable="false"/>
-
- <attribute name="roleClassNames"
- description="Comma-delimited list of javax.security.Principal
classes that represent security roles"
- type="java.lang.String"/>
-
- <attribute name="realmPath"
- description="The realm path"
- type="java.lang.String"/>
-
- <attribute name="stateName"
- description="The name of the LifecycleState that this component is
currently in"
- type="java.lang.String"
- writeable="false"/>
-
- <attribute name="userClassNames"
- description="Comma-delimited list of javax.security.Principal
classes that represent individual users"
- type="java.lang.String"/>
-
- <attribute name="useContextClassLoader"
- description="Sets whether to use the context or default ClassLoader."
- is="true"
- type="boolean"/>
-
- <attribute name="validate"
- description="Should we validate client certificate chains when they
are presented?"
- type="boolean"/>
-
-
- <operation name="start" description="Start" impact="ACTION"
returnType="void" />
- <operation name="stop" description="Stop" impact="ACTION"
returnType="void" />
- <operation name="init" description="Init" impact="ACTION"
returnType="void" />
- <operation name="destroy" description="Destroy" impact="ACTION"
returnType="void" />
- </mbean>
-
-
<mbean name="JNDIRealm"
description="Implementation of Realm that works with a directory
server accessed via the Java Naming and Directory Interface (JNDI) APIs"
domain="Catalina"
diff --git a/webapps/docs/config/manager.xml b/webapps/docs/config/manager.xml
index ce5a7c4891..c60e67f307 100644
--- a/webapps/docs/config/manager.xml
+++ b/webapps/docs/config/manager.xml
@@ -585,8 +585,8 @@
to make authentication persistence work properly. The actual type of that
<code>Principal</code> class is determined by the <a href="realm.html">
Realm</a> implementation used with the application. Tomcat's standard
- <code>Principal</code> class instantiated by most of the Realms (except
- <code>JAASRealm</code>) implements <code>java.io.Serializable</code>.</p>
+ <code>Principal</code> class instantiated by most of the Realms
+ implements <code>java.io.Serializable</code>.</p>
<p>The persistence across restarts provided by the
<strong>StandardManager</strong> is a simpler implementation than that
diff --git a/webapps/docs/config/realm.xml b/webapps/docs/config/realm.xml
index 69654395fb..78d593868b 100644
--- a/webapps/docs/config/realm.xml
+++ b/webapps/docs/config/realm.xml
@@ -797,115 +797,6 @@
</subsection>
-
- <subsection name="JAAS Realm - org.apache.catalina.realm.JAASRealm">
-
- <p><strong>JAASRealm</strong> is an implementation of the Tomcat
- <code>Realm</code> interface that authenticates users through the Java
- Authentication & Authorization Service (JAAS) framework which is now
- provided as part of the standard J2SE API.</p>
-
- <p>Using JAASRealm gives the developer the ability to combine practically
- any conceivable security realm with Tomcat's CMA.</p>
-
- <p>JAASRealm is prototype for Tomcat of the JAAS-based J2EE authentication
- framework for J2EE v1.4, based on the <a
- href="https://www.jcp.org/en/jsr/detail?id=196";>JCP Specification Request
- 196</a> to enhance container-managed security and promote 'pluggable'
- authentication mechanisms whose implementations would be
- container-independent.</p>
-
- <p>Based on the JAAS login module and principal
- (see <code>javax.security.auth.spi.LoginModule</code> and
- <code>javax.security.Principal</code>), you can develop your own security
- mechanism or wrap another third-party mechanism for integration with the
CMA
- as implemented by Tomcat.</p>
-
- <p>The JAAS Realm implementation supports the following additional
- attributes:</p>
-
- <attributes>
-
- <attribute name="allRolesMode" required="false">
- <p>This attribute controls how the special role name <code>*</code> is
- handled when processing authorization constraints in web.xml. By
- default, the specification compliant value of <code>strict</code> is
- used which means that the user must be assigned one of the roles
defined
- in web.xml. The alternative values are <code>authOnly</code> which
means
- that the user must be authenticated but no check is made for assigned
- roles and <code>strictAuthOnly</code> which means that the user must be
- authenticated and no check will be made for assigned roles unless roles
- are defined in web.xml in which case the user must be assigned at least
- one of those roles.</p>
- </attribute>
-
- <attribute name="appName" required="false">
- <p>The name of the application as configured in your login configuration
- file (<a
-
href="https://docs.oracle.com/javase/8/docs/technotes/guides/security/jaas/tutorials/LoginConfigFile.html";>JAAS
- LoginConfig</a>).</p>
- <p>If not specified <code>appName</code> is derived from the Container's
- name it is placed in, for example <code>Catalina</code> or
<code>ROOT</code>.
- </p>
- </attribute>
-
- <attribute name="userClassNames" required="true">
- <p>A comma-separated list of the names of the classes that you have
made
- for your user <code>Principals</code>.</p>
- </attribute>
-
- <attribute name="configFile" required="false">
- <p>The name of a JAAS configuration file to use with this Realm. It
will
- be searched for using <code>ClassLoader#getResource(String)</code> so
it
- is possible for the configuration to be bundled within a web
- application. If not specified, the default JVM global JAAS
configuration
- will be used.</p>
- </attribute>
-
- <attribute name="roleClassNames" required="false">
- <p>A comma-separated list of the names of the classes that you have
made
- for your role <code>Principals</code>.</p>
- </attribute>
-
- <attribute name="stripRealmForGss" required="false">
- <p>When processing users authenticated via the GSS-API, this attribute
- controls if any "@..." is removed from the end of the user
- name. If not specified, the default is <code>true</code>.</p>
- </attribute>
-
- <attribute name="transportGuaranteeRedirectStatus" required="false">
- <p>The HTTP status code to use when the container needs to issue an
HTTP
- redirect to meet the requirements of a configured transport
- guarantee. The provided status code is not validated. If not
- specified, the default value of <code>302</code> is used.</p>
- </attribute>
-
- <attribute name="useContextClassLoader" required="false">
- <p>Instructs JAASRealm to use the context class loader for loading the
- user-specified <code>LoginModule</code> class and associated
- <code>Principal</code> classes. The default value is <code>true</code>,
- which is backwards-compatible with the way Tomcat 5 works. To load
- classes using the container's classloader, specify
- <code>false</code>.</p>
- </attribute>
-
- <attribute name="X509UsernameRetrieverClassName" required="false">
- <p>When using X509 client certificates, this specifies the class name
- that will be used to retrieve the user name from the certificate.
- The class must implement the
- <code>org.apache.catalina.realm.X509UsernameRetriever</code>
- interface. The default is to use the certificate's SubjectDN
- as the username.</p>
- </attribute>
- </attributes>
-
- <p>See the <a href="../realm-howto.html">Container-Managed Security
- Guide</a> for more information on setting up container managed security
- using the JAAS Realm component.</p>
-
- </subsection>
-
-
<subsection name="Combined Realm - org.apache.catalina.realm.CombinedRealm">
<p><strong>CombinedRealm</strong> is an implementation of the Tomcat
diff --git a/webapps/docs/realm-howto.xml b/webapps/docs/realm-howto.xml
index 8a73db5870..d74ca6864b 100644
--- a/webapps/docs/realm-howto.xml
+++ b/webapps/docs/realm-howto.xml
@@ -93,9 +93,6 @@ sources of authentication information:</p>
<li><a href="#MemoryRealm">MemoryRealm</a> - Accesses authentication
information stored in an in-memory object collection, which is initialized
from an XML document (<code>conf/tomcat-users.xml</code>).</li>
-<li><a href="#JAASRealm">JAASRealm</a> - Accesses authentication information
- through the Java Authentication & Authorization Service (JAAS)
- framework.</li>
</ul>
<p>It is also possible to write your own <code>Realm</code> implementation,
@@ -917,120 +914,6 @@ valid user, consisting of the following attributes:</p>
</subsection>
-<subsection name="JAASRealm">
-
-<h5>Introduction</h5>
-
- <p><strong>JAASRealm</strong> is an implementation of the Tomcat
-<code>Realm</code> interface that authenticates users through the Java
-Authentication & Authorization Service (JAAS) framework which is now
-provided as part of the standard Java SE API.</p>
- <p>Using JAASRealm gives the developer the ability to combine
-practically any conceivable security realm with Tomcat's CMA. </p>
- <p>JAASRealm is prototype for Tomcat of the JAAS-based
-J2EE authentication framework for J2EE v1.4, based on the <a
- href="https://www.jcp.org/en/jsr/detail?id=196";>JCP Specification
-Request 196</a> to enhance container-managed security and promote
-'pluggable' authentication mechanisms whose implementations would be
-container-independent.
- </p>
- <p>Based on the JAAS login module and principal (see
<code>javax.security.auth.spi.LoginModule</code>
-and <code>javax.security.Principal</code>), you can develop your own
-security mechanism or wrap another third-party mechanism for
-integration with the CMA as implemented by Tomcat.
- </p>
-
- <h5>Quick Start</h5>
- <p>To set up Tomcat to use JAASRealm with your own JAAS login module,
- you will need to follow these steps:</p>
- <ol>
- <li>Write your own LoginModule, User and Role classes based
-on JAAS (see
-<a
href="http://docs.oracle.com/javase/7/docs/technotes/guides/security/jaas/tutorials/GeneralAcnOnly.html";>
-the JAAS Authentication Tutorial</a> and
-<a
href="http://docs.oracle.com/javase/7/docs/technotes/guides/security/jaas/JAASLMDevGuide.html";>
-the JAAS Login Module Developer's Guide</a>) to be managed by the JAAS Login
-Context (<code>javax.security.auth.login.LoginContext</code>)
-When developing your LoginModule, note that JAASRealm's built-in
<code>CallbackHandler</code>
-only recognizes the <code>NameCallback</code> and
<code>PasswordCallback</code> at present.
- </li>
- <li>Although not specified in JAAS, you should create
-separate classes to distinguish between users and roles, extending
<code>javax.security.Principal</code>,
-so that Tomcat can tell which Principals returned from your login
-module are users and which are roles (see
<code>org.apache.catalina.realm.JAASRealm</code>).
-Regardless, the first Principal returned is <em>always</em> treated as the
user Principal.
- </li>
- <li>Place the compiled classes on Tomcat's classpath
- </li>
- <li>Set up a login.config file for Java (see <a
-
href="http://docs.oracle.com/javase/7/docs/technotes/guides/security/jaas/tutorials/LoginConfigFile.html";>
-JAAS LoginConfig file</a>) and tell Tomcat where to find it by specifying
-its location to the JVM, for instance by setting the environment
-variable: <code>JAVA_OPTS=$JAVA_OPTS
-Djava.security.auth.login.config==$CATALINA_BASE/conf/jaas.config</code></li>
-
- <li>Configure your security-constraints in your web.xml for
-the resources you want to protect</li>
- <li>Configure the JAASRealm module in your server.xml </li>
- <li>Restart Tomcat if it is already running.</li>
- </ol>
- <h5>Realm Element Attributes</h5>
- <p>To configure JAASRealm as for step 6 above, you create
-a <code><Realm></code> element and nest it in your
-<code>$CATALINA_BASE/conf/server.xml</code>
-file within your <code><Engine></code> node. The attributes for the
-JAASRealm are defined in the <a href="config/realm.html">Realm</a>
-configuration documentation.</p>
-
-<h5>Example</h5>
-
-<p>Here is an example of how your server.xml snippet should look.</p>
-
-<source><![CDATA[<Realm className="org.apache.catalina.realm.JAASRealm"
- appName="MyFooRealm"
- userClassNames="org.foobar.realm.FooUser"
- roleClassNames="org.foobar.realm.FooRole"/>]]></source>
-
-<p>It is the responsibility of your login module to create and save User and
-Role objects representing Principals for the user
-(<code>javax.security.auth.Subject</code>). If your login module doesn't
-create a user object but also doesn't throw a login exception, then the
-Tomcat CMA will break and you will be left at the
-http://localhost:8080/myapp/j_security_check URI or at some other
-unspecified location.</p>
-
- <p>The flexibility of the JAAS approach is two-fold: </p>
- <ul>
- <li>you can carry out whatever processing you require behind
-the scenes in your own login module.</li>
- <li>you can plug in a completely different LoginModule by changing
the configuration
-and restarting the server, without any code changes to your application.</li>
- </ul>
-
- <h5>Additional Notes</h5>
- <ul>
- <li>When a user attempts to access a protected resource for
- the first time, Tomcat will call the <code>authenticate()</code>
- method of this <code>Realm</code>. Thus, any changes you have
made in
- the security mechanism directly (new users, changed passwords or
- roles, etc.) will be immediately reflected.</li>
- <li>Once a user has been authenticated, the user (and their
- associated roles) are cached within Tomcat for the duration of
- the user's login. For FORM-based authentication, that means
until
- the session times out or is invalidated; for BASIC
authentication,
- that means until the user closes their browser. Any changes to
the
- security information for an already authenticated user will
<strong>not</strong>
- be reflected until the next time that user logs on again.</li>
- <li>As with other <code>Realm</code> implementations, digested
passwords
- are supported via the configured <code>CredentialHandler</code>.
- JAASRealm's <code>CallbackHandler</code> passes the password or
- client digest to the <code>LoginModule</code> unchanged; any
digest
- comparison is expected to be performed by the
<code>LoginModule</code>
- when it calls back into the <code>Realm</code></li>
- </ul>
-
-</subsection>
-
-
<subsection name="CombinedRealm">
<h5>Introduction</h5>
diff --git a/webapps/docs/security-howto.xml b/webapps/docs/security-howto.xml
index 51a2bd38dc..4b4d0bbe29 100644
--- a/webapps/docs/security-howto.xml
+++ b/webapps/docs/security-howto.xml
@@ -477,10 +477,6 @@
<p>The UserDatabaseRealm is not intended for large-scale installations.
It
is intended for small-scale, relatively static environments.</p>
- <p>The JAASRealm is not widely used and therefore the code is not as
- mature as the other realms. Additional testing is recommended before
using
- this realm.</p>
-
<p>By default, the realms do not implement any form of account lock-out.
This means that brute force attacks can be successful. To prevent a brute
force attack, the chosen realm should be wrapped in a LockOutRealm.</p>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
