Appendix B - Login Configuration Files

A login configuration file contains one or more LoginContext application names which have the following form:

Application {
    LoginModule Flag ModuleOptions;
    < more LoginModule entries >
    LoginModule Flag ModuleOptions;
};

Login configuration files are located using the login.config.url.n security property found in the java.security file. For more information about this property and the location of the java.security file, see Appendix A.

The Flag value controls the overall behavior as authentication proceeds down the stack. The following represents a description of the valid values for Flag and their respective semantics:

Required

The LoginModule is required to succeed. If it succeeds or fails, authentication still continues to proceed down the LoginModule list.

Requisite

The LoginModule is required to succeed. If it succeeds, authentication continues down the LoginModule list. If it fails, control immediately returns to the application (authentication does not proceed down the LoginModule list).

Sufficient

The LoginModule is not required to succeed. If it does succeed, control immediately returns to the application (authentication does not proceed down the LoginModule list). If it fails, authentication continues down the LoginModule list.

Optional

The LoginModule is not required to succeed. If it succeeds or fails, authentication still continues to proceed down the LoginModule list.

The overall authentication succeeds only if all Required and Requisite LoginModules succeed. If a SufficientLoginModule is configured and succeeds, then only the Required and Requisite LoginModules prior to that SufficientLoginModule need to have succeeded for the overall authentication to succeed. If no Required or Requisite LoginModulesare configured for an application, then at least one Sufficient or OptionalLoginModule must succeed.

/*  Sample Configuration File  */

Login1 {
   com.ibm.security.auth.module.SampleLoginModule required debug=true;
};

Login2 {
   com.ibm.security.auth.module.SampleLoginModule required;
   com.ibm.security.auth.module.JAASLoginModule sufficient;
   ibm.loginModules.SmartCard requisite debug=true;
   ibm.loginModules.Kerberos optional debug=true;
};