Shibboleth Developers

[Brent Putman <>]

On 4/15/11 5:21 AM, Etienne Dysli wrote:
>
> I still have no idea why the UsernamePassword LoginHandler loads another
> module's configuration.
>

This is discussed more extensively in the archives, but briefly:  The
jaasConfigurationLocation attribute on the login handler just sets the
value of the JVM-wide system property  java.security.auth.login.config,
which is the JVM-wide config for the JAAS framework.  In can only point
to one place, so you can't have different login handlers setting it to
different values.  The last one that gets processed at configuration
wiring time wins.

This is obviously sub-optimal. Ideally each JAAS-based component would
have the possibility of its own JAAS config file.  The reason we are
forced to do it this way in the 2.x IdP is that we only require Java 5.
Unfortunately there was not a portable way to parse and instantiate the
necessary JAAS configuration instance introduced in the Java API until
Java 6 (where there is a service type exposed by a provider within the
Security framework for this purpose).