Configuring a JAAS custom login module for the Liberty profile

You can configure a custom Java™ Authentication and Authorization Service (JAAS) login module before or after you have configured the Liberty profile server login module.

1. Enable the appSecurity-2.0 Liberty feature in the server.xml file.

   <featureManager>
       <feature> appSecurity-2.0</feature>
   </featureManager>

2. Create a class com.sample.CustomLoginModule that implements the LoginModule interface and package it into the CustomLoginModule.jar file.
3. Create a <library> element that uses a <fileset> element indicating where the CustomLoginModule.jar file is. In this example, the library id is customLoginLib.

   <library id="customLoginLib">
       <fileset dir="${server.config.dir}" includes="CustomLoginModule.jar"/>
   </library> 

4. Create a <jaasLoginModule> element. In this example, the id is custom.
   1. Configure the custom login module to require a successful authentication by setting the controlFlag attribute to REQUIRED.
   2. Set the libraryRef attribute to customLoginLib, the id of the <library> element configured in the previous step. This login module also has two options: UserRegistry is ldap and mapToUser is user1.

   <jaasLoginModule id="myCustom" 
                    className="com.sample.CustomLoginModule" 
                    controlFlag="REQUIRED" libraryRef="customLoginLib">
       <options myOption1="value1" myOption2="value2"/>
   </jaasLoginModule>

5. Create a <jaasLogincontextEntry> element with an id and name of the system-defined JAAS configuration: system.WEB_INBOUND. You can also set this JAAS configuration to system.DEFAULT, WSLogin, or your own JAAS configuration. On the loginModuleRef attribute, add custom, the id of the jaasLoginModule element created in the previous step. Putting this id first in the list means that it is the first JAAS login module to be called. You must also list the other default login modules: hashtable, userNameAndPassword, certificate, and token.

   <jaasLoginContextEntry id="system.WEB_INBOUND" name="system.WEB_INBOUND" 
                    loginModuleRef="myCustom, hashtable, userNameAndPassword, certificate, token"  />

   Note: The option name cannot start with a period (.), config., or service. Also, the property name id or ID is not allowed.

   For more information about the <jaasLoginContextEntry>, <jaasLoginModule>, <options>, and <library> elements, see Liberty profile: Configuration elements in the server.xml file.