The jaas-login-service is provided as an OSGi bundle, which may be activated by
obr:addurl http://maven.clazzes.org/repository.xml
obr:deploy sql-login-service
The maven artifact is:
<groupId>org.clazzes.login</groupId>
<artifactId>sql-login-service</artifactId>
Functionality
The SQL login service authenticates against users in a SQL database, using configurable SQL queries.
There are no plans to support authentication domains, because typical standalone login systems do not care for domains.
Configuration
The SQL login service may be configured using the OSGi configuration PID org.clazzes.login.sql
using the configuration values shown in the table below.
Beginning with the upcoming 1.1.0 release, all query strings default to the database structure used by the upcoming SDS (SQL Directory Service) bundle. When using another database structure that does not allow some of the queries, it is important set those configuration values to empty strings; deleting them will not help because default values would kick in right away.
1.1.0 will also start to "naturally" order resulting lists, so there is no need to use ORDER BY clauses which often provoke temporary tables and filesort.
Key | Description |
---|---|
deactivateUserStatement | Required non-empty for deactivateUser feature. SQL template for a prepared statement to deactivate a user. Default, appropriate for SDS' tables: |
defaultDomain | Optional. Defaults to an empty string. If set to an empty string, the domain parameter of request queries does not get checked but is filled in in returned principals. If set to a non-empty string, requests for other domains are refused. Support for databases maintaining multiple authentication domains might be added in the future, but I do not believe multi-domain setups even exist outside the LDAP/ADS world. |
groupsByUserIdQuery | Required non-empty for getGroups feature. SQL template for a prepared statement to query the group IDs and group names of the groups of which the user specified by a userId is a member. Default, appropriate for SDS' tables: |
defaultPasswordAlgorithm | Optional. Defaults to Values supported so far: Password fields may contain:
|
setUserPasswordStatement | Required non-empty for changePassword feature. SQL template for a prepared statement to set a new password for the user. Default, appropriate for SDS' tables: |
userByUserIdQuery | SQL template for a prepared statement to query userId, encrypted password, pretty name and e-mail address of a user specified by a userId. Example: |
usersByGroupIdQuery | Required non-empty for getGroupMembers feature. SQL template for a prepared statement to query the user IDs, user names and e-mail-addresses of the members of the group specified by a groupId. Example: |