Linux PAM module in Java

views:

answers:

Linux PAM module in Java

I do have a custom authentication mechanism which is written in Java. I was wondering what would be the best way to implement a Linux PAM module without rewriting the code in C?

I am aware of this list of available PAM modules but none of them are Java-related.

There's also JPam but it does the opposite thing: it allows to get user/group information to be used in Java app whereas I need to use existing Java code to authenticate users in Linux (e.g. via SSH).

Any suggestions are welcome.

+1 A:

You could try:

Compile your Java program using GCJ to native code
Write glue C program which embeds JVM and loads your Java code

but neither of those ideas seem ideal.

el.pescado 2010-06-29 21:16:24

Second option (glue C app) is always the "Plan B". I believe it should be rather easy to write, say a webservice client, server side of which is done in Java, shouldn't it?

mindas 2010-06-29 21:24:00

+1 A:

Write a C wrapper to interface with PAM and within the implementation, use JNI to invoke an instance of the JVM.

JVM launching wrappers were very popular when people still wanted to deliver "exe"s that really ran programs in JARs. You'll want to look into what's not normally done with JNI, calling a JVM from a binary executable; unfornately, most JNI instructions focus on calling C code from Java.

A good example of how to create a JVM from C code can be found here. Turning the C code module into a PAM shared object library will take a little work, but it's not likely to be too difficult.

Finally, don't forget that JNI uses and returns Java types for most of it's operations. This means you'll have to read the "C" data types (probably char*) and create Java strings prior to passing them into your JVM. The same is true in reverse for receiving information from Java and passing it back to the PAM libraries.

Good luck!

Edwin Buck 2010-06-29 21:19:10

Thanks. Forgot to mention that my authentication does a database lookup and involves a good bunch of other JARs. It looks like it will be a pain to handle with JNI...

mindas 2010-06-29 21:22:25

You're only going to use less than 100 lines of C to invoke a JVM. Once you have a JVM running in your C program, you can rely on class loading, etc, in a pretty normal fashion. It might not be as bad as you think!

Edwin Buck 2010-06-29 21:25:18

I remember going through great amounts of pain back in ~2003 trying to marry Java and PHP4. This was for making few simple PHP calls to Java API through "Java support in PHP". I know this is different situation here but I swore I would never go same path again. As I commented on the other answer, I'd rather code a C webservice client or something similar to achieve this. But thank you very much anyway - your suggestion and link might be useful for somebody else viewing this thread.

mindas 2010-06-29 21:35:04

Well, good luck with your library. By the way, now we have a PHP interpreter implemented in Java. I know, a solution far too late, for a different problem, but perhaps it will give you a grin.

Edwin Buck 2010-06-29 21:44:12

You can actually get Java to talk to a C stub that in-turn connects to the PAM callbacks. Read up on JNI (Java Native Interface). Mostly JNI is used to expose C to Java, but you can actually do it the other way around. You may also want to investigate GNU CNI as it's actually more convenient to use. There are a lot of resources listed at the Wikipedia JNI page

Elf King 2010-06-29 21:24:55

ansaurus

tags:

views:

answers:

Linux PAM module in Java

related questions