Chapter 6. Login Modules for EJBs and Remoting
6.1. Remoting Login Module
Short name: Remoting
Full name: org.jboss.as.security.remoting.RemotingLoginModule
Parent: AbstractServer Login Module
The Remoting login module allows remote EJB invocations, coming in over remoting, to perform a SASL-based authentication. This allows the remote user to establish their identity via SASL and have that identity be used for authentication and authorization when making that EJB invocation.
Table 6.1. Remoting Login Module Options
| Option | Type | Default | Description |
|---|---|---|---|
| useClientCert | boolean | false |
If |
6.2. Client Login Module
Short name: Client
Full name: org.jboss.security.ClientLoginModule
Client login module is an implementation of login module for use by JBoss EAP clients when establishing caller identity and credentials. This creates a new SecurityContext, assigns it a principal and a credential and sets the SecurityContext to the ThreadLocal security context. Client login module is the only supported mechanism for a client to establish the current thread’s caller. Both standalone client applications, and server environments, acting as JBoss EAP EJB clients where the security environment has not been configured to use the JBoss EAP security subsystem transparently, must use Client login module.
It is also possible to configure interceptors within an EJB and the remote client to change the identity of the caller. The ejb-security-interceptors quickstart that ships with JBoss EAP provides a complete working example.
This login module does not perform any authentication. It merely copies the login information provided to it into the server EJB invocation layer for subsequent authentication on the server. Within JBoss EAP, this is only supported for the purpose of switching a user’s identity for in-JVM calls. This is NOT supported for remote clients to establish an identity.
Table 6.2. Client Login Module Options
| Option | Type | Default | Description |
|---|---|---|---|
| multi-threaded | true or false | true | Set to true if each thread has its own principal and credential storage. Set to false to indicate that all threads in the VM share the same identity and credential. |
| password-stacking |
| false |
Set to |
| restore-login-identity | true or false | false |
Set to true if the identity and credential seen at the start of the |
Where did the comment section go?
Red Hat's documentation publication system recently went through an upgrade to enable speedier, more mobile-friendly content. We decided to re-evaluate our commenting platform to ensure that it meets your expectations and serves as an optimal feedback mechanism. During this redesign, we invite your input on providing feedback on Red Hat documentation via the discussion platform.