Why does a LoginContext producer work in a Java EE/Servlet container?

Question

The opensource Java EE 6 Petstore project implements a LoginContext producer to carry out custom user authentication. Below is the source code.
Why does that work? Is it application server specific or a standard behaviour (for example, enforced by some JSR)?

 package org.agoncal.application.petstore.security;

import org.agoncal.application.petstore.util.ConfigProperty;

import javax.enterprise.inject.Produces;
import javax.inject.Inject;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import java.io.File;
import java.net.URISyntaxException;

/**
 * @author blep
 *         Date: 16/02/12
 *         Time: 07:28
 */
public class LoginContextProducer {

    // ======================================
    // =             Attributes             =
    // ======================================

    @Inject
    private SimpleCallbackHandler callbackHandler;

    // ======================================
    // =          Business methods          =
    // ======================================

    @Produces
    public LoginContext produceLoginContext(@ConfigProperty("loginConfigFile") String loginConfigFileName,
                                            @ConfigProperty("loginModuleName") String loginModuleName) throws LoginException, URISyntaxException {

        System.setProperty("java.security.auth.login.config", new File(LoginContextProducer.class.getResource(loginConfigFileName).toURI()).getPath());

        try {
            return new LoginContext(loginModuleName, callbackHandler);
        } catch (Exception e) {
            System.out.println("ouch!!!");
            return null;
        }
    }

}

Answer 1

LoginContext is part of the Java Authentication and Authorization Service (JAAS) .

LoginContextProducer is a CDI "producer" that handles the concern of producing a LoginContext so other classes can inject it. The custom login module is implemented in SimpleLoginModule and it's use is specified in a config file (config.properties).

If you are happy to use the default implementations of JAAS provided by your application server, you don't need to write the custom login module or producer.

Answer 2

Taking a look at the project Here the POM Maven , if not let anything escape, these main technologies are being used in this project in question:

• EJB (Enterprise JavaBeans)
• JPA (Java Persistence API)
• JSF (Java Server Faces)
• Angular (Framework) and AJAX
• Arquillian (for integral tests)
• Junit (for unit test)

Running on the GlassFish server.

The j2ee specification 6 here says you can use dependencies, then code is in the standard. If your question was if this project could work with original / native dependencies of J2ee, then I would answer no, you would have the dependencies for this project to be compiled.