{"push_id":871062239,"size":1,"distinct_size":1,"ref":"refs/heads/features/jaas-login-module","head":"f39af0c5efee4600f9f3fafc0f1a1cfc07a07f71","before":"272cc7ca4f05dc6b85b0b2a8ab31436a19cc9771","commits":[{"sha":"f39af0c5efee4600f9f3fafc0f1a1cfc07a07f71","author":{"email":"e8126c64c3486e84081fffad6a0ab22d4267bb41@opennms.org","name":"Benjamin Reed"},"message":"create a JAAS login module to use the OpenNMS UserManager\n\nI apologize in advance to whomever reviews this pull request.\n\nSo here's the deal.  Take a look at container/jaas-login-module --\nin there is the Platonic Ideal of a simple JAAS plugin that loads\nin Karaf as a bundle and can authenticate against our Spring\nSecurity config.  It uses services, and only needs a bundle\nactivator to inject the context into the login module because\nlogin modules are classloaded and unaware of OSGi, but is\notherwise pretty clean.\n\nThe problem comes when you attempt to use the same module\n*outside* of Karaf, because of the way we load it.  When Karaf\nregisters a JAAS module, it actually wraps it in a proxy\nLoginModule that lets it lazy-initialize.  The problem is, that\nproxy LoginModule isn't in the system classpath, it comes from\nKaraf, so I couldn't share it with the outside world.\n\nConversely, I couldn't forego Karaf JAAS initialization\naltogether, because Karaf initializes a JAAS Configuration\nclass that lets it load and unload modules as bundles come and\ngo.\n\nThe wonderful design of JAAS initialization in the JVM is such\nthat the Configuration class is a singleton, so when Karaf sets\nit, it owns it.\n\nSo.\n\nThis commit does a number of horrible things to get around all\nof these architectural issues.\n\n* I implemented my *own* Configuration module, that I initialize\n  alongside the rest of Spring Security except it sits and waits\n  (up to 2 minutes) for the Karaf one to appear and then puts a\n  façadein front of it that short-circuits the Karaf one and\n  returns our own configuration if attempting to access the\n  \"opennms\" realm.\n\n  You can override the 2 minute wait time by setting\n  -Dorg.opennms.web.springframework.security.jaas-timeout=millis\n\n* I had to implement my own proxy LoginModule as well, because\n  the way login modules get statically initialized means I can't\n  rely on the classpath being what I want.  I put it in\n  opennms-bootstrap and then the bootstrap process injects a\n  clean $OPENNMS_HOME/lib-aware classpath statically into the\n  proxy module.  This proxy module then classloads the real one\n  the first time it's initialized.\n\n* I sacrificed one cow, one goat, three chickens, and 17 llamas,\n  so that should be covered.\n\nSomeday, when we finish inverting our bootstrap such that we just\nrun inside Karaf, the rest of this crap can all go away and we\ncan just leave the jaas-login-module project intact.\n\n*sigh*","distinct":true,"url":"https://api.github.com/repos/OpenNMS/opennms/commits/f39af0c5efee4600f9f3fafc0f1a1cfc07a07f71"}]}