The Java Authentication and Authorization Service (JAAS) defines that if a login module has the flag "REQUIRED", the authentication should proceed down the login module list on success or failure, and that the module is required to succeed for the overall authentication process to succeed.

The question is: What could this flag be used for? Since the login module is required to succeed, why does the authentication process need to continue down the login module list when a REQUIRED module fails to authenticate a Subject?


The Configuration doc has an example which explains one reason to use required over requisite:

Login {
com.sun.security.auth.module.UnixLoginModule required;
com.sun.security.auth.module.Krb5LoginModule optional

This Configuration specifies that an application named, "Login", requires users to first authenticate to the com.sun.security.auth.module.UnixLoginModule, which is required to succeed. Even if the UnixLoginModule authentication fails, the com.sun.security.auth.module.Krb5LoginModule still gets invoked. This helps hide the source of failure. Since the Krb5LoginModule is Optional, the overall authentication succeeds only if the UnixLoginModule (Required) succeeds.

As you're probably aware, using the requisite flag tells JAAS to immediately return control to the application.

Another reason it might be useful would be if a later LoginModule tracked login attempts, you would want to be sure that it was processed.

  • That is what I am thinking, the required control flag is useful only for tracking purposes, which means that it is useless. – nohros May 6 '12 at 20:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.