This chapter presents [changes on the JAAS realm|#ADM.Security.Change_JAAS_real] with the following sub-topics:
* [Tomcat|#ADM.Security.Tomcat]
* [Common changes|#ADM.Security.Common_Changes]
h1. Change the JAAS realm {anchor:id=ADM.Security.Change_JAAS_real}

eXo Platform relies on JAAS for propagating the user identity and roles to the different applications deployed on the server.

The JAAS realm is used by all eXo Platform applications and even propagated to the JCR for [Access Control|http://docs.jboss.org/exojcr/1.12.5-GA/developer/en-US/html_single/#JCR.AccessControl].

By default, eXo Platform uses the JAAS realm named "gatein-domain". If your IT operation rules require you to use another JAAS realm, you will need to modify several files so that eXo Platform can work on your JAAS realm.

Since the security configuration is highly dependent of the app server, each application sever is represented separately.


h2. Tomcat {anchor:id=ADM.Security.Tomcat}

In the Tomcat bundle, the JAAS configuration is controled by the _{noformat}$TOMCAT_HOME/conf/jaas.conf{noformat}_:

{code}
gatein-domain {
  org.exoplatform.web.security.PortalLoginModule required;
  org.exoplatform.services.security.jaas.SharedStateLoginModule required;
  org.exoplatform.services.security.j2ee.TomcatLoginModule required; 
};
{code}

Replace gatein-domain by your own domain name.

{note}
The PortalLoginModule module was designed to support the 'Remember me' feature. The password wrapped in PasswordCallback is the cookie token key.
The PortalLoginModule module uses the token key to retrieve Credential object from CookieTokenService, then injects the correct username/password into the shared state (accessible from subsequent login modules). For the moment, to keep the authentication work properly, the PortalLoginModule module is mandatory. On the other hand, to ensure that correct password is visible to other login modules, it should be the first one in the JAAS configuration file. 
The custom login module could retrieve the real password through the shared state instead of PasswordCallback.
{note}

{tip}
To learn more about the syntax, or realms in Tomcat, refer to the [JAAS tutorial|http://download.oracle.com/javase/1.4.2/docs/guide/security/jaas/tutorials/LoginConfigFile.html] or [Tomcat Realm How-To|http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html] respectively.
{tip}

For JBoss, you need to edit the default JAAS security domain in the _02portal.war!WEB-INF/jboss-web.xml_ file.

{code:xml}
<jboss-web>
  <security-domain>java:/jaas/gatein-domain</security-domain>
</jboss-web>
{code}

Additionally, you need to edit the application-policy to match the security-domain in the _gatein.ear!META-INF/gatein-jboss-beans.xml_.

{code:xml}
<deployment xmlns="urn:jboss:bean-deployer:2.0">
  <application-policy xmlns="urn:jboss:security-beans:1.0" name="gatein-domain">
    <authentication>
      <login-module code="org.exoplatform.web.security.PortalLoginModule" flag="required">
        <module-option name="portalContainerName">portal</module-option>
        <module-option name="realmName">gatein-domain</module-option>
      </login-module>
      <login-module code="org.exoplatform.services.security.jaas.SharedStateLoginModule" flag="required">
        <module-option name="portalContainerName">portal</module-option>
        <module-option name="realmName">gatein-domain</module-option>
      </login-module>
      <login-module code="org.exoplatform.services.security.j2ee.JbossLoginModule" flag="required">
        <module-option name="portalContainerName">portal</module-option>
        <module-option name="realmName">gatein-domain</module-option>
      </login-module>
    </authentication>
  </application-policy>
</deployment> 
{code}

{tip}
To learn more about the JBoss security configuration, refer to [JBoss Web Docs|http://docs.redhat.com/docs/en-US/JBoss_Enterprise_Web_Platform/5/html-single/Getting_Started_Guide/index.html#Basic_Configuration_Issues-Security_Service].
{tip}

h2. Common changes {anchor:id=ADM.Security.Common_Changes}

Finally, you need to do some common changes on both app servers.

h3. configuration.properties
First, change the JAAS realm to match your own security constraints and then identify the entry named _exo.security.domain_ inside the _configuration.properties_ file.

{code}
# Realm name
exo.security.domain=gatein-domain
{code}

{note}
Internally, eXo Platform uses this setting to set a new variable named "portal.container.realm" that is then used in the Kernel configuration files, such as _platform-extension/WEB-INF/conf/platform/repository-configuration.xml_.
{note}


h3. portal.war {anchor:id=ADM.Security.Portal.war}

Inside _portal.war_, you should declare the Realm name in the _web.xml_ file:

{code:xml}
<login-config>
  <auth-method>FORM</auth-method> 
  <realm-name>gatein-domain</realm-name> 
  <form-login-config>
    ...
  </form-login-config>
</login-config>
{code}

h3. rest.war {anchor:id=ADM.Security.rest.war}

You also need to modify _rest.war_ to provide secured REST services properly.

{code:xml}
<login-config>
  <auth-method>BASIC</auth-method> 
  <realm-name>gatein-domain</realm-name> 		
</login-config>
{code}

{note}This change is very important, allowing you to secure the file downloads via WEBDAV.{note}