Jaas Introduction

Outline

General overview of Java security• Java 2 security model• How is security maintained by Java and JVM?• How can a programmer ensure security?

Java Authentication and Authorization Service (JAAS (pronounced jazz))• What is JAAS?• How can it be used? (with code samples)

Java-Technology based Security

Strongly typed Byte code verification Runtime type safety checks Class loaders Security managers

JDK 1.0 Security Model

The “Sandbox“ Model

JDK 1.1 Security Model

The concept of “signed“ applet

Java 2 Security Model (JDK 1.2 and higher)

Fine grained access control using security policies

Example: Java Security

package demo.jaas;import java.io.File;public class UnAuthenticatedClient{ public static void main(String[] args) { File f = new File("ProtectedFile.txt"); System.out.print( "\nProtectedFile.txt does "); if (!f.exists()) System.out.print("not "); System.out.println("exist."); }}

A very simple program (UnAuthenticatedClient.java):

grant codebase "file:C:/demo/jaas/noauth_client.jar" { permission java.io.FilePermission "ProtectedFile.txt", "read";};

The security policy for the “ProtectedFile.txt“ (noauth_java.policy):

Example: Java Security 2java –classpath C:\demo\jaas\noauth_client.jar -Djava.security.manager –Djava.security.policy==C:\demo\jaas\noauth_java.policy demo.jaas.UnAuthenticatedClient

Execute program using SecurityManager and policy file:

grant codebase "file:C:/demo/jaas/noauth_client.jar“ {};

Case 1: Change policy file to (and execute):

Exception because no permission

Case 2: Move original files from C:\demo\jaas to C:\temp and execute

Exception because code comes no longer from C:\demo\jaas\noauth_client.jar

grant codebase "file:C:/demo/jaas/noauth_client.jar" { permission java.io.FilePermission "ProtectedFile.txt", "read";}; grant signed by aheusser codebase “file:C:/demo/jaas/noauth_client.jar“ { permission java.io.FilePermission "ProtectedFile.txt", "read,write";}

Case 3: Change policy file to (and execute):

Why use JAAS?

Java Security is code-centric (permissions granted based on code characteristics)

JAAS allows• Authentication: reliably and securely determine who is currently

executing Java code• Authorization: ensure users have access control rights (permissions)

required to do the actions performed

Architecture of JAAS

Packages:javax.security.auth, javax.security.auth.callback, javax.security.auth.login, javax.security.auth.spi

Common classes: Subject, Principal, Credential

Authentication classes: LoginContext, LoginModule, Callback, CallbackHandler

Authorization classes:Policy, AuthPermission, PrivateCredentialPermission

JAAS Authentication

Authentication performed in pluggable fashion• Java applications remain independent from underlying authentication technologies

JAAS Authentication 2

To authenticate a subject (user or service) following steps are performed:

1. Application instantiates a LoginContext- LoginContext needs a string that indexes an entity in the config file- A CallbackHandler is optional (needed if user interaction is required)

2. LoginContext consults a Configuration to load all required LoginModules

3. Application calls LoginContext‘s login() method

4. Login method invokes all LoginModules- each LoginModule attemps to authenticate the subject

5. The LoginContext returns the authentication status to the app.

6. If authentication successful, application retrieves the subject

Example: JAAS AuthenticationJAASArticle { demo.jaas.LoginModuleImpl required debug=true fileName=passwords; };

File: jaas.config

java -Djava.security.auth.policy=jaas.config ...

Start of program:

...// use the configured LoginModules for the "JAASArticle" entryLoginContext lc = null;try { lc = new LoginContext( "JAASArticle", new MyCallbackHandler());} catch (LoginException le) { le.printStackTrace(); System.exit(-1);}...try { // attempt authentication lc.login(); } catch (LoginException e) { System.out.println( e.getMessage()); System.exit(-1); }...lc.logout();

File: AuthorizedClient.java:

Example: JAAS Authentication 2

class MyCallbackHandler implements CallbackHandler {

public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException { for (int i = 0; i < callbacks.length; i++) { if (callbacks[i] instanceof NameCallback) { // prompt the user for a username and store it in the NameCallback .... } else if (callbacks[i] instanceof PasswordCallback) { // prompt the user for sensitive information an store it in the // PasswordCallback .... } else { throw new UnsupportedCallbackException(callbacks[i],"Unrecognized Callback"); } } }....}

File: MyCallbackHandler.java:

LoginModuleImpl implements LoginModule interface with methods:- initialize(Subject, CallbackHandler, Map, Map), login(), logout(), commit(), abort()

login method creates the callbacks (e.g. NameCallback and PasswordCallback) and calls CallbackHandler.handle method by passing the callbacks. When handle returns, login validates the information.

JAAS Authorization

JAAS authorization extends the existing Java security architecture (policy files)

Authorization is now user-centric by handling Principal-based queries

• default policy implementation supports Principal-based grant entries

• access control can now be based not just on what code is running, but also who is running it

In order to be able to do something a user must now first be authenticated

Example: JAAS Authorization

...//get the LoginContext and log in

// now try to execute the AuthorizedAction as the authenticated Subject Subject.doAs(lc.getSubject(), new AuthorizedAction());...lc.logout();

File: AuthorizedClient.java:

package demo.jaas;import java.io.File;import java.security.PrivilegedAction;

public class AuthorizedAction implements PrivilegedAction {

public Object run() { File f = new File("ProtectedFile.txt"); System.out.print("\nProtectedFile.txt does "); if (!f.exists()) System.out.print("not "); System.out.println("exist."); return null; }}

File: AuthorizedAction.java:

Example: JAAS Authorization 2grant codebase "file:C:/demo/jaas/client_action.jar", Principal demo.jaas.PrincipalImpl "aheusser" { permission java.io.FilePermission "ProtectedFile.txt", "read";};

File: jaas.policy

/* grant the JAAS core library AllPermission */grant codebase "file:C:/jdk1.3/jre/lib/ext/jaas.jar" { permission java.security.AllPermission;};

/* grant the LoginModule AllPermission */grant codebase "file:C:/demo/jaas/loginmodule.jar" { permission java.security.AllPermission;};

grant codebase "file:C:/demo/jaas/client.jar" { permission javax.security.auth.AuthPermission "createLoginContext"; permission javax.security.auth.AuthPermission "doAs"; permission java.io.FilePermission "ProtectedFile.txt", "read"; };

File: java.policy

Features and Goals of JAAS

Simple and pluggable authentication• Implements the standard PAM framework (Pluggable Authentication Module)

• Apps need not to be changed if authentication mechanisms are changed

Policy-based authentication• Apps need not concern with exact authentication mechanisms used

• Default login config mechanism is a configuration file

Fine-grained access control capabilities Authenticate and enforce access controls upon users Support for user-based, group-based and role-based access

controls

Java Security Packages

JAAS (Java Authentication and Authorization Service)

JCE (Java Cryptography Extension)

JSSE (Java Secure Sockets Extension)

GSS API (Generic Security Service)• Securely exchanging messages using Kerberos V5

Certification Path API• Allows to build and validate certification paths

Features of JCE

Extends the JCA (Java Cryptography Architecture)

Defines standard encryption APIs Pluggable framework architecture

• Enables qualified providers (CSPs) to be plugged in

Jurisdiction policy files• Allow strong but limited cryptography to be used

Features of JSSE

Standard socket APIs for SSL and TLS• SSL v3 and TLS 1.0 support

Transport level Authentication, Integrity, and Privacy Utilities for key and certificate management Cipher suite negotiation

• SSL “handshaking“ to initiate or verify secure communications

Includes https URL handler Cryptographic suites including:

• RSA, RC4, DES, DSA, etc.

Resources for Java Security

Java Security http://java.sun.com/security/ http://java.sun.com/j2se/1.4/docs/guide/security/index.html

JAAS http://java.sun.com/products/jaas/ http://java.sun.com/j2se/1.4/docs/guide/security/jaas/JAASLMDevGuide.html http://service2.boulder.ibm.com/devtools/news0300/artpag28.htm http://www.devx.com/premier/mgznarch/Javapro/2001/09sep01/tm0109/tm0109-1.

asp http://www.javaworld.com/javaworld/jw-05-2001/jw-0525-security.html