title: JAAS LoginModule flags
body: <p>I'm trying to work out how the Login module flags work in JAAS (using JBoss 5.1 EAP) and I've come across a puzzling situation that I'm hoping someone can clarify for me. </p>
  
  <p>For background, my login-config.xml looks like this:</p>
  
  <pre><code>&lt;authentication-policy&gt;
    &lt;authentication&gt;
      &lt;login-module code="...loginModule1" flag="sufficient"&gt;
        ...
      &lt;/login-module&gt;
      &lt;login-module code="...loginModule2" flag="optional"&gt;
        ...
      &lt;/login-module&gt;
      &lt;login-module code="...loginModule3" flag="optional"&gt;
        ...
      &lt;/login-module&gt;
    &lt;/authentication&gt;
  &lt;/authentication-policy&gt;
  </code></pre>
  
  <p>In this case, loginModule1 is standalone, but loginModule2 depends on loginModule3.  The problem I've got is that if loginModule1 fails and loginModule2 and loginModule3 both succeed I still get a failed login.  If I change loginModule1 to be optional then when loginModule1 fails and 2 and 3 succeed I get a successful login.</p>
  
  <p>From the JBoss security documentation (http://docs.jboss.org/jbossas/admindevel326/html/ch8.chapter.html):</p>
  
  <pre><code>sufficient: the LoginModule is not required to succeed. If it does succeed, 
  control immediately returns to the application (authentication does not proceed 
  down the LoginModule list). If it fails, authentication continues down the 
  LoginModule list.
  </code></pre>
  
  <p>I would have thought based on on this that when LoginModule with a sufficient flag fails, but a following LoginModule passes then I would get a successful login, anyone know why this isn't the case?</p>