S E C U R I T Y  

The Principals table associates the user PrincipalID with the valid password and the Roles 

table associates the user PrincipalID with its role sets. The roles used for user permissions 

must be contained in rows with a RoleGroup column value of Roles. The tables are logical in 

that you can specify the SQL query that the login module uses. All that is required is that 

the java.sql.ResultSet has the same logical structure as the Principals and Roles tables 

described previously. The actual names of the tables and columns are not relevant as the 

results are accessed based on the column index. To clarify this notion, consider a database 

with two tables, Principals and Roles, as already declared. The following statements build 

the tables to contain a PrincipalID  java  with a Password of  echoman  in the Principals 

table, a PrincipalID  java  with a role named  Echo  in the  Roles  RoleGroup in the Roles 

table, and a PrincipalID  java  with a role named  caller_java  in the  CallerPrincipal  

RoleGroup in the Roles table: 

INSERT INTO Principals VALUES( java ,  echoman ) 

INSERT INTO Roles VALUES( java ,  Echo ,  Roles ) 

INSERT INTO Roles VALUES( java ,  caller_java ,  CallerPrincipal ) 

The supported login module configuration options include the following: 

dsJndiName: The JNDI name for the DataSource of the database containing the 

logical "Principals" and "Roles" tables. If not specified this defaults to 

"java:/DefaultDS". 

principalsQuery: The prepared statement query equivalent to: "select Password 

from Principals where PrincipalID=?". If not specified this is the exact prepared 

statement that will be used. 

rolesQuery: The prepared statement query equivalent to:  "select Role, RoleGroup 

from Roles where PrincipalID=?". If not specified this is the exact prepared statement 

that will be used. 

unauthenticatedIdentity=string, The principal name that should be assigned to 

requests that contain no authentication information. 

password stacking=useFirstPass, When password stacking option is set, this 

module first looks for a shared username and password under the property names 

"javax.security.auth.login.name" and "javax.security.auth.login.password" 

respectively in the login module shared state Map. If found these are used as the 

principal name and password. If not found the principal name and password are set 

by this login module and stored under the property names 

"javax.security.auth.login.name" and "javax.security.auth.login.password" 

respectively. 

71