private void updateJaasModules(Properties systemConfig) throws Exception {
ModelControllerClient mcc = null;
try {
mcc = ManagementService.createClient();
final SecurityDomainJBossASClient client = new SecurityDomainJBossASClient(mcc);
if (client.isSecurityDomain(RHQ_USER_SECURITY_DOMAIN)) {
LOG.info("Security domain [" + RHQ_USER_SECURITY_DOMAIN + "] already exists, it will be replaced.");
}
List<LoginModuleRequest> loginModules = new ArrayList<LoginModuleRequest>(3);
// Always register the RHQ user JDBC login module, this checks the principal against the RHQ DB
LoginModuleRequest jdbcLoginModule = new LoginModuleRequest(JDBCLoginModule.class.getName(),
AppConfigurationEntry.LoginModuleControlFlag.SUFFICIENT, getJdbcOptions(systemConfig));
loginModules.add(jdbcLoginModule);
// Optionally register two more login modules for LDAP support. The first ensures
// we don't have a DB principal (if we do then the JDBC login module is sufficient.
// The second performs the actual LDAP authorization.
String value = systemConfig.getProperty(SystemSetting.LDAP_BASED_JAAS_PROVIDER.getInternalName());
boolean isLdapAuthenticationEnabled = (value != null) ? RHQConstants.LDAPJAASProvider.equals(value) : false;
if (isLdapAuthenticationEnabled) {
// this is a "gatekeeper" that only allows us to go to LDAP if there is no principal in the DB
LoginModuleRequest jdbcPrincipalCheckLoginModule = new LoginModuleRequest(
JDBCPrincipalCheckLoginModule.class.getName(),
AppConfigurationEntry.LoginModuleControlFlag.REQUISITE, getJdbcOptions(systemConfig));
loginModules.add(jdbcPrincipalCheckLoginModule);
// this is the LDAP module that checks the LDAP for auth
Map<String, String> ldapModuleOptionProperties = getLdapOptions(systemConfig);
try {
validateLdapOptions(ldapModuleOptionProperties);
} catch (NamingException e) {
String descriptiveMessage = null;
if (e instanceof AuthenticationException) {
descriptiveMessage = "The LDAP integration cannot function because the LDAP Bind credentials"
+ " for RHQ integration are incorrect. Contact the Administrator:" + e;
} else {
descriptiveMessage = "Problems encountered when communicating with LDAP server."
+ " Contact the Administrator:" + e;
}
this.LOG.error(descriptiveMessage, e);
}
// Enable the login module even if the LDAP properties have issues
LoginModuleRequest ldapLoginModule = new LoginModuleRequest(LdapLoginModule.class.getName(),
AppConfigurationEntry.LoginModuleControlFlag.REQUISITE, ldapModuleOptionProperties);
loginModules.add(ldapLoginModule);
}
client.createNewSecurityDomain(RHQ_USER_SECURITY_DOMAIN,
loginModules.toArray(new LoginModuleRequest[loginModules.size()]));
client.flushSecurityDomainCache("RHQRESTSecurityDomain");
LOG.info("Security domain [" + RHQ_USER_SECURITY_DOMAIN + "] re-created with login modules " + loginModules);
} catch (Exception e) {
throw new Exception("Error registering RHQ JAAS modules", e);
} finally {