Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

The Java Authentication and Authorization Service (JAAS) defines that if a login module has the flag "REQUIRED", the authentication should proceed down the login module list on success or failure, and that the module is required to succeed for the overall authentication process to succeed.

The question is: What could this flag be used for? Since the login module is required to succeed, why does the authentication process need to continue down the login module list when a REQUIRED module fails to authenticate a Subject?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

The Configuration doc has an example which explains one reason to use required over requisite:

Login {
com.sun.security.auth.module.UnixLoginModule required;
com.sun.security.auth.module.Krb5LoginModule optional
               useTicketCache="true"
               ticketCache="${user.home}${/}tickets";
};

This Configuration specifies that an application named, "Login", requires users to first authenticate to the com.sun.security.auth.module.UnixLoginModule, which is required to succeed. Even if the UnixLoginModule authentication fails, the com.sun.security.auth.module.Krb5LoginModule still gets invoked. This helps hide the source of failure. Since the Krb5LoginModule is Optional, the overall authentication succeeds only if the UnixLoginModule (Required) succeeds.

As you're probably aware, using the requisite flag tells JAAS to immediately return control to the application.

Another reason it might be useful would be if a later LoginModule tracked login attempts, you would want to be sure that it was processed.

share|improve this answer
    
That is what I am thinking, the required control flag is useful only for tracking purposes, which means that it is useless. –  nohros May 6 '12 at 20:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.