保护JAAS配置文件

Question

I'm developing a Java application which is run in Windows domain environment. To authenticate users I'm using Krb5LoginModule available in JAAS. JAAS Login Configuration File (let's call it jaas.conf) is embedded in application jar, which is stored on network share (read-only access).

Now every user can copy the application jar to his local disk, edit jaas.conf, and set his own LoginModule which would allow him to act as different user.

Is there any way to prevent this? How to secure the application?

Answer 1

Usr e Pwd must be provided by user. You have to call your own login interface where the user can provide username and password. Why you want put the usr&pwd into the jaas.conf?

Anyway, if you want to lock the usr&pwd you can

1. use certificate
2. crypt into the file
3. write into a code