Take the 2-minute tour ×

The Java Authentication and Authorization Service (JAAS) defines that if a login module has the flag "REQUIRED", the authentication should proceed down the login module list on success or failure, and that the module is required to succeed for the overall authentication process to succeed.

The question is: What could this flag be used for? Since the login module is required to succeed, why does the authentication process need to continue down the login module list when a REQUIRED module fails to authenticate a Subject?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

The Configuration doc has an example which explains one reason to use required over requisite:

Login {
com.sun.security.auth.module.UnixLoginModule required;
com.sun.security.auth.module.Krb5LoginModule optional

This Configuration specifies that an application named, "Login", requires users to first authenticate to the com.sun.security.auth.module.UnixLoginModule, which is required to succeed. Even if the UnixLoginModule authentication fails, the com.sun.security.auth.module.Krb5LoginModule still gets invoked. This helps hide the source of failure. Since the Krb5LoginModule is Optional, the overall authentication succeeds only if the UnixLoginModule (Required) succeeds.

As you're probably aware, using the requisite flag tells JAAS to immediately return control to the application.

Another reason it might be useful would be if a later LoginModule tracked login attempts, you would want to be sure that it was processed.

share|improve this answer
That is what I am thinking, the required control flag is useful only for tracking purposes, which means that it is useless. –  nohros May 6 '12 at 20:13
add comment

Your Answer


