Java Authentication and Authorization Service, or JAAS, pronounced "Jazz", is the Java implementation of the standard Pluggable Authentication Module (PAM) information security framework. JAAS was introduced as an extension library to the Java Platform, Standard Edition 1.3 and was integrated in version 1.4. JAAS has as its main goal the separation of concerns of user authentication so that they may be managed independently. While the former authentication mechanism contained information about where the code originated from and who signed that code, JAAS adds a marker about who runs the code. By extending the verification vectors JAAS extends the security architecture for Java applications that require authentication and authorization modules. Administration For the system administrator, JAAS consists of two kinds of configuration file: *.login.conf: specifies how to plug vendor-supplied login modules into particular applications *.policy: specifies which identities (users or programs) are granted which permissions For example, an application may have this file indicating how different authentication mechanisms are to be run to authenticate the user: PetShopApplication { com.sun.security.auth.module.LdapLoginModule sufficient; com.foo.SmartcardLoginModule requisite; com.sun.security.auth.module.UnixLoginModule required debug=true; } Application interface For the application developer, JAAS is a standard library that provides: a representation of identity (Principal) and a set of credentials (Subject) a login service that will invoke your application callbacks to ask the user things like username and password. It returns a new Subject a service that tests if a Subject was granted a permission by an administrator. Security system integration For the security system integrator, JAAS provides interfaces: to provide your identity namespace to applications to attach credentials to threads (Subject) for developing login modules. Your module invokes callbacks to query the user, checks their response and generates a Subject. Login Modules Login modules are primarily concerned with authentication rather than authorization and form a widely used component of JAAS. A login module is required to implement the javax.security.auth.spi.LoginModule interface, which specifies the following methods: Note: A Subject is the user that is attempting to log in. initialize: Code to initialize the login module, usually by storing the parameters passed into appropriate fields of the Class. login: Actually check the credentials provided via an Object that implements the javax.security.auth.Callback interface (e.g. check against a database). This method could prompt the user for their login and password or it could use details previously obtained. It is important to note here that, if invalid credentials are supplied then a javax.security.auth.login.FailedLoginException should be thrown