From: Rainer Langbehn <###@###.###>
To: "'###@###.###'" <###@###.###>
Subject: Need for own java.net.Authenticator implementation
MIME-Version: 1.0

Hello,

we're planning to use Java Web Start for an intranet project at the Bayer
AG. One essential requirement is to integrate with the present single sign
on (SSO) solution. Currently we're doing this with our own implementation of
the java.net.Authenticator class. Unfortunately Java Web Start sets his own
Authenticator subclass to be the default one, so no other Authenticator
subclass can be installed. This makes it impossible to use Java Web Start
for the above mentioned project (and similar ones). Maybe an
AuthenticatorService could be the solution?
What do you think about this. Anything planned?

With regards
Rainer Langbehn


From: Rainer Langbehn <###@###.###>
To: "'###@###.###'" <###@###.###>
Subject: AW: Need for own java.net.Authenticator implementation
MIME-Version: 1.0

Hi Steve,

thanks for your quick response.

There is nothing special how I set our authenticator class. At system
startup before trying to make any network connections our authenticator
class is setup as the following code shows:

private void initSystem() {
  try {
    java.net.Authenticator.setDefault(new ProperViewAuthenticator());
    <doing further processing, especially network connections...>
  } catch (Throwable t) {
    <handle exceptions...>
  }
}

According to the docs the ProperViewAuthenticator class overrides the
getPasswordAuthentication method. Here is the pseudocode:

public class ProperViewAuthenticator extends java.net.Authenticator
{
  ...

  protected java.net.PasswordAuthentication getPasswordAuthentication() {
    java.net.PasswordAuthentication pa = null;

    try {
      if (isSingleSignOnUsed()) {
        <get the user credentials from SSO agent...>
      } else {
        <prompt the user for credentials...>
      }
    } catch (Throwable t) {
      <handle exceptions...>
    }
    return pa;
  }
}

Without Java Web Start this works as expected. With Java Web Start our
authenticator class is never called 'cause attempting to set our
authenticator class as the default one is silently ignored. (From the docs
of the setDefault method: "...If an Authenticator has already been
established as the current authenticator, no action will be taken...")

Bye
Rainer Langbehn