Where to place security configuration file in WAR?

Question

I'm trying to use JAAS for authentication in my WAR. I understand that my configuration file (another link) should be placed somewhere (as explained here). Unfortunately, I can't understand where exactly, if we're talking about WAR? And how to name the file?

// JAAS has to find the file and retrieve "foo" from it
LoginContext ctx = new LoginContext("foo", this);

Answer 1

I had the same problem and I wanted to see if I couldn't dynamically set this property based on the current classpath (which would be located inside the war itself).

public class SecurityListener implements ServletContextListener {
    public SecurityListener() {
    }

    @Override
    public void contextDestroyed(ServletContextEvent arg0) {
    }

    @Override
    public void contextInitialized(ServletContextEvent arg0) {
        if(System.getProperty("java.security.auth.login.config") == null) {
            String jaasConfigFile = null;
            URL jaasConfigURL = this.getClass().getClassLoader().getResource("login.conf");
            if(jaasConfigURL != null) {
                jaasConfigFile = jaasConfigURL.getFile();
            }
            System.setProperty("java.security.auth.login.config", jaasConfigFile);
        }
    }
}

Obviously, you need to add the listener to your web.xml:

<listener>
    <listener-class>example.SecurityListener</listener-class>
</listener>

What this does is set the property java.security.auth.login.config upon instantiation of the web application if it has not yet been defined. This means you could throw it in your source folder and load it automatically if not otherwise redefined elsewhere. I have tested this and it works on Tomcat 6.

So, for example if your tomcat installation was in "C:\program files\tomcat6\" with your war deployed in "C:\program files\tomcat6\webapps\mywar", the path it would find would be "C:\program files\tomcat6\webapp\mywar\WEB-INF\classes" which is always accurate. Not sure if this solution also works with other web applications, but I would imagine so since login.conf is going to be where the classpath root is.

Hope that helps!