is there any documentation how to create custom security realm

[sysmat]

Environment Details

• GlassFish Version (and build number): 6.0.0
• JDK version: 8
• OS:
• Database:

---

Problem Description

• dose it need osgi Activator, which felix version?
• should be maven packaging bundle?
• a custom realm which class to extend?
• a custom LoginModule which class to extend?
• to defined in login.conf
• where to put custom jar in modules folder

[dmatej]

At this moment we just refreshed the old documentation for GF7. To realms and login modules are related these parts:
https://glassfish.org/docs/SNAPSHOT/security-guide.html#gkbiy
https://glassfish.org/docs/SNAPSHOT/reference-manual.html#create-auth-realm-2

The implementation is quite obsoleted, but there is yet the authorization specification, so I believe this should work too (probably with some updates in package names):
https://developer.ibm.com/tutorials/j-javaee8-security-api-2/

[arjantijms]

so I believe this should work too (probably with some updates in package names):

Indeed, jakarta.* packages now, otherwise unchanged. That would be the default way to go. Custom realms (which are a GlassFish specific way to add what has been standardised as an IdentityStore in Java EE/Jakarta EE) are slightly painful to add. Exactly because of what is already mentioned in the openings post, you need the LoginModule/Realm combination (LoginModule delegates to Realm) and the registration in login.conf. From the top of my head, the jar packaging them has to go in /lib and you need to add them to domain.xml as well.

The reason for the split btw was the idea that the LoginModule is purely the IdentityStore (doing only the credentials in -> username/groups out function), while the Real is the underlying IdentityDAO (having a huge amount extra methods to add, delete, update, etc identities). However in GlassFish it all got mixed up at some point, and often the Realm is leading instead of being purely underlying. To make matters worse, AFAIK, almost no Realm actually implements all the DAO features except for the build-in FileRealm.

We once had a TODO to clean this up a little, but with the Jakarta Security API the need had been greatly diminished.

[github-actions]

This issue has been marked as inactive and old and will be closed in 7 days if there is no further activity. If you want the issue to remain open please add a comment

[github-actions]

This issue has been marked as inactive and old and will be closed in 7 days if there is no further activity. If you want the issue to remain open please add a comment