JAAS - What is the required control flag used for?

Question

The Java Authentication and Authorization Service (JAAS) defines that if a login module has the flag "REQUIRED", the authentication should proceed down the login module list on success or failure, and that the module is required to succeed for the overall authentication process to succeed.

The question is: What could this flag be used for? Since the login module is required to succeed, why does the authentication process need to continue down the login module list when a REQUIRED module fails to authenticate a Subject?

Answer 1

The Configuration doc has an example which explains one reason to use required over requisite:

Login {
com.sun.security.auth.module.UnixLoginModule required;
com.sun.security.auth.module.Krb5LoginModule optional
               useTicketCache="true"
               ticketCache="${user.home}${/}tickets";
};

This Configuration specifies that an application named, "Login", requires users to first authenticate to the com.sun.security.auth.module.UnixLoginModule, which is required to succeed. Even if the UnixLoginModule authentication fails, the com.sun.security.auth.module.Krb5LoginModule still gets invoked. This helps hide the source of failure. Since the Krb5LoginModule is Optional, the overall authentication succeeds only if the UnixLoginModule (Required) succeeds.

As you're probably aware, using the requisite flag tells JAAS to immediately return control to the application.

Another reason it might be useful would be if a later LoginModule tracked login attempts, you would want to be sure that it was processed.