Authentication

eXo Platform 3.5 uses a new authentication mechanism so-called the WCI authentication mechanism. This change from GateIn into the WCI module is because:

Authentication is commonly part of Java EE and happens at the Servlet Container layer, while WCI is the layer of integration between our stack and the Servlet Container.
WCI provides an easier integration of SSO providers that allows the SSO module to depend on the WCI module instead of integrating directly with the GateIn module. Its main benefit is to improve the quality of SSO and to decouple SSO from GateIn.
The GateIn stack wants to support and leverage specifications of both Servlet 3.0 and Servlet 2.5 that are not supported by the GateIn module. Meanwhile, WCI can serve both.
The Servlet 3.0 provides a programmatic login feature which can be used to implement WCI.
WCI provides the stronger guaranty of the authentication quality, meanwhile the authentication of GateIn was not unit tested. By moving the GateIn to WCI module, the test can be made against several implementations.

If there are other new portal containers in your eXo Platform extension, you need to update the authentication mechanism in the $PLATFORM-TOMCAT-HOME/conf/jaas.conf file. For example, in case you have added a new portal container named "company" to eXo Platform, you need to configure the new authentication module for the new portal container as follows:

<!--this configuration for defaul portal container with name "portal"-->
gatein-domain {
  org.gatein.wci.security.WCILoginModule optional;
  org.exoplatform.services.security.jaas.SharedStateLoginModule required;
  org.exoplatform.services.security.j2ee.TomcatLoginModule required;
};

<!--this configuration for new portal container with name "company"-->
gatein-domain-company {
  org.gatein.wci.security.WCILoginModule optional
    portalContainerName="company"
  	realmName="gatein-domain-company";
  org.exoplatform.services.security.jaas.SharedStateLoginModule required
    portalContainerName="company"
  	realmName="gatein-domain-company";
  org.exoplatform.services.security.j2ee.TomcatLoginModule required
    portalContainerName="company"
  	realmName="gatein-domain-company";
};

For more details, see the Change the JAAS realm section.