[Auth jass] Additional login option with API Token ID by lsafelix75 · Pull Request #3815 · openhab/openhab-core

lsafelix75 · 2023-09-28T13:56:11Z

Refer to: #3813 This commit comprises a few changes:

Login screen - password field can be emptied but username must include generated API token with format oh.xxx.yyyyyyy
Some housekeeping to Jaas code to remove unnecessary codes.

Signed-off-by: Felix Lo lsafelix75@gmail.com

Refer to: openhab#3813 This commit comprises a few changes: 1) Login screen - password field can be emptied but username must be generated API token 2) Some housekeeping to Jaas code to remove unnecessary codes. Signed-off-by: Felix Lo <lsafelix75@gmail.com>

lsafelix75 · 2023-09-30T09:24:09Z

@davidgraeff pls take a look. thanks

openhab-bot · 2023-10-01T08:56:32Z

This pull request has been mentioned on openHAB Community. There might be relevant details there:

https://community.openhab.org/t/x-openhab-token-use-for-mainui-authentication/149548/4

splatch · 2023-10-01T10:16:54Z

David might not be active any more in community. You can try with @ghys, @J-N-K or @hmerk.

lsafelix75 · 2023-10-01T22:21:45Z

@J-N-K appreciate if you can take a look. Tq

davidgraeff · 2024-01-22T13:07:32Z

David might not be active any more in community

That's exactly the case.

Sorry for the noise.

openhab-bot · 2024-02-22T11:09:10Z

This pull request has been mentioned on openHAB Community. There might be relevant details there:

https://community.openhab.org/t/rest-sitemaps-returning-401-even-when-authenticated-with-implicit-user-role-turned-off/154074/3

Copilot

Pull Request Overview

This PR adds the ability to authenticate using API tokens as an alternative to username/password authentication in openHAB's JAAS authentication system. The implementation allows users to enter API tokens in the username field while leaving the password field empty.

Modifies login flow to support API token authentication when password field is empty
Implements new JAAS login modules specifically for API token handling
Updates HTML form to make password field optional

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
AbstractAuthPageServlet.java	Adds conditional authentication logic to handle API tokens when password is empty
authorize.html	Removes required attribute from password field to support API token login
ManagedUserLoginModule.java	Updates login module to properly set user principals with roles
JaasAuthenticationProvider.java	Implements dual authentication paths for username/password and API token credentials
ApiTokenLoginModule.java	New login module dedicated to API token authentication
ApiTokenLoginConfiguration.java	Configuration class for API token login module

Copilot · 2025-07-26T16:11:53Z

-        UsernamePasswordCredentials credentials = new UsernamePasswordCredentials(username, password);
-        Authentication auth = authProvider.authenticate(credentials);
+        Authentication auth;
+        if (!password.isEmpty()) {


The authentication logic relies solely on an empty password to determine API token authentication. This could allow unintended authentication attempts if a user accidentally submits with an empty password. Consider adding explicit validation for API token format (e.g., checking for 'oh.' prefix) to ensure the username field actually contains a valid API token.

Copilot · 2025-07-26T16:11:53Z

+                        new ApiTokenLoginConfiguration());
+                loginContext.login();
+
+                return getAuthentication("", loginContext.getSubject());


Passing an empty string as the username parameter to getAuthentication() for API token authentication could lead to incorrect authentication results. The method expects a valid username, and while it handles blank usernames by extracting from principals, this creates unnecessary complexity and potential for errors.

Suggested change

return getAuthentication("", loginContext.getSubject());

String username = extractUsernameFromSubject(loginContext.getSubject());

return getAuthentication(username, loginContext.getSubject());

Copilot · 2025-07-26T16:11:53Z

+        GenericUser user = (GenericUser) principals.iterator().next();
+        String[] roles = new String[user.getRoles().size()];
+


This code performs an unsafe cast without checking if the principal is actually a GenericUser instance. If the principals set contains other types of Principal objects, this will throw a ClassCastException at runtime.

Suggested change

GenericUser user = (GenericUser) principals.iterator().next();

String[] roles = new String[user.getRoles().size()];

GenericUser user = null;

for (Principal principal : principals) {

if (principal instanceof GenericUser) {

user = (GenericUser) principal;

break;

}

}

if (user == null) {

throw new CredentialException("No GenericUser found in principals");

}

String[] roles = new String[user.getRoles().size()];

Copilot · 2025-07-26T16:11:53Z

+    private CallbackHandler callbackHandler;
+
+    @Override
+    public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState,
+            Map<String, ?> options) {
+        this.subject = subject;
+        this.callbackHandler = callbackHandler;


The callbackHandler field is assigned in the initialize method but never used throughout the class. This unused field should be removed to improve code clarity.

Suggested change

private CallbackHandler callbackHandler;

@Override

public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState,

Map<String, ?> options) {

this.subject = subject;

this.callbackHandler = callbackHandler;

@Override

public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState,

Map<String, ?> options) {

this.subject = subject;

Copilot · 2025-07-26T16:11:54Z

+
+    @Override
+    public boolean abort() throws LoginException {
+        return false;


The abort() method should clean up any state that was set during the login process. Since this module adds principals to the subject during login(), the abort() method should remove them if login was not committed.

Suggested change

return false;

if (this.subject != null) {

this.subject.getPrincipals().removeIf(principal -> principal instanceof GenericUser);

}

return true;

Copilot · 2025-07-26T16:11:54Z

+
+    @Override
+    public boolean logout() throws LoginException {
+        return false;


The logout() method should remove the principals that were added during login from the subject. Currently returning false means the logout was not successful, but no cleanup is performed.

Suggested change

return false;

try {

// Remove all principals added by this LoginModule

this.subject.getPrincipals().removeIf(principal -> principal instanceof GenericUser);

return true;

} catch (Exception e) {

logger.error("Error during logout", e);

throw new LoginException("Logout failed: " + e.getMessage());

}

wborn · 2026-08-06T06:34:52Z

Hi @lsafelix75, Do you use jaas and how? If you use it we probably do not want to remove support for it (#5753). Perhaps you can also update this PR if you want to continue with it.

lsafelix75 requested a review from a team as a code owner September 28, 2023 13:56

lsafelix75 added 2 commits September 28, 2023 22:08

Signed-off-by: Felix Lo <lsafelix75@gmail.com>

65adfd5

Signed-off-by: Felix Lo <lsafelix75@gmail.com>

9196980

lsafelix75 changed the title ~~Additional login option with API Token ID~~ [Auth jass] Additional login option with API Token ID Sep 30, 2023

Merge branch 'openhab:main' into auth

ab0baf9

Merge branch 'openhab:main' into auth

ebc0a3c

lsafelix75 mentioned this pull request Oct 12, 2023

Login information entered in settings does not translate to OH3 login openhab/openhab-android#2339

Open

wborn requested a review from Copilot July 26, 2025 16:10

Copilot AI reviewed Jul 26, 2025

View reviewed changes

wborn mentioned this pull request Aug 6, 2026

auth.jaas.ManagedUserLoginModule - call ungetService() #5739

Open

wborn added the awaiting feedback label Aug 18, 2026

	return getAuthentication("", loginContext.getSubject());
	String username = extractUsernameFromSubject(loginContext.getSubject());
	return getAuthentication(username, loginContext.getSubject());

		GenericUser user = (GenericUser) principals.iterator().next();
		String[] roles = new String[user.getRoles().size()];

-        GenericUser user = (GenericUser) principals.iterator().next();
-        String[] roles = new String[user.getRoles().size()];
+        GenericUser user = null;
+        for (Principal principal : principals) {
+            if (principal instanceof GenericUser) {
+                user = (GenericUser) principal;
+                break;
+            }
+        }
+        if (user == null) {
+            throw new CredentialException("No GenericUser found in principals");
+        }
+        String[] roles = new String[user.getRoles().size()];

-        return false;
+        if (this.subject != null) {
+            this.subject.getPrincipals().removeIf(principal -> principal instanceof GenericUser);
+        }
+        return true;

-        return false;
+        try {
+            // Remove all principals added by this LoginModule
+            this.subject.getPrincipals().removeIf(principal -> principal instanceof GenericUser);
+            return true;
+        } catch (Exception e) {
+            logger.error("Error during logout", e);
+            throw new LoginException("Logout failed: " + e.getMessage());
+        }

Uh oh!

Uh oh!

Conversation

lsafelix75 commented Sep 28, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lsafelix75 commented Sep 30, 2023

Uh oh!

openhab-bot commented Oct 1, 2023

Uh oh!

splatch commented Oct 1, 2023

Uh oh!

lsafelix75 commented Oct 1, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

davidgraeff commented Jan 22, 2024

Uh oh!

openhab-bot commented Feb 22, 2024

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Jul 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 26, 2025

Choose a reason for hiding this comment

Uh oh!

wborn commented Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

lsafelix75 commented Sep 28, 2023 •

edited

Loading

lsafelix75 commented Oct 1, 2023 •

edited

Loading