9.0.2 JAZN SSO doasprivileged-mode=true does not work

Question

I've been trying to deploy an application to my "fresh" 9iR2 App Server that has been installed on Solaris 8 with all the patches 9.0.2. (I also have a second Solaris 8 machine with the 9iR2 Infrastructure installed, also patched up to the latest rev of 9.0.2). I'm deploying my EAR file with the Enterprise Manager deployment tool, and it works great (except for the following problem). I want to make my servlets run in "doasprivileged-mode" as described in
http://otn.oracle.com/tech/java/oc4j/doc_library/902/servicesjun02/jaas_j2a.htm
I believe I have everything setup correctly, but when I try (in my servlet) to try to access JAAS like this:
AccessControlContext acc = AccessController.getContext()
OR, do this:
AccessController.checkPermission(new FilePermission("/tmp/test.txt", "read"));
I get the following exception in my browser and then another exception in the opmn log. I believe the root cause is this: "The system is unable to retreive the specified role(s)." But I have no idea what role it's talking about... When I run the JAZN shell commands and look around in the "llnl" realm, I see the AUTHENTICATED_USERS group and the user I'm logging into SSO as, is a member of this group.
Thanks for any info/help on this matter. Also, if someone has a working example that shows the use of the doasprivliged-mode="true" that would really help. The callerInfo and ssoInfo examples don't seem to address this additional use of the JAAS environment (past asking the HttpServletRequest for the Principal object)
--Leif
java.security.PrivilegedActionException: javax.servlet.ServletException: A JAZN internal error has occurred.
     at oracle.security.jazn.oc4j.JAZNFilter$1.run(JAZNFilter.java:256)
     at java.security.AccessController.doPrivileged(Native Method)
     at javax.security.auth.Subject.doAsPrivileged(Subject.java:558)
     at oracle.security.jazn.oc4j.JAZNFilter.doFilter(JAZNFilter.java:269)
     at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:523)
     at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:269)
     at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:735)
     at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.AJPRequestHandler.run(AJPRequestHandler.java:151)
     at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].util.ThreadPoolThread.run(ThreadPoolThread.java:64)
Root cause is; java.lang.IllegalStateException: A JAZN internal error has occurred.
     at oracle.security.jazn.spi.ldap.LDAPGranteeEntry.checkValidity(LDAPGranteeEntry.java:286)
     at oracle.security.jazn.spi.ldap.LDAPGranteeEntry.getGranteeEntry(LDAPGranteeEntry.java:297)
     at oracle.security.jazn.spi.ldap.LDAPLocalPolicy.getGrantees(LDAPLocalPolicy.java:316)
     at oracle.security.jazn.spi.ldap.LDAPLocalPolicy.getGranteeEntries(LDAPLocalPolicy.java:264)
     at oracle.security.jazn.spi.ldap.LDAPLocalPolicy.getPermissions(LDAPLocalPolicy.java:1029)
     at oracle.security.jazn.spi.ldap.LDAPJAZNPolicy.getPermissions(LDAPJAZNPolicy.java:649)
     at oracle.security.jazn.spi.ldap.LDAPJAZNPolicy.getPermissions(LDAPJAZNPolicy.java:680)
     at oracle.security.jazn.spi.PolicyProvider.getPermissions(PolicyProvider.java:218)
     at javax.security.auth.SubjectDomainCombiner$3.run(SubjectDomainCombiner.java:253)
     at java.security.AccessController.doPrivileged(Native Method)
     at javax.security.auth.SubjectDomainCombiner.combine(SubjectDomainCombiner.java:249)
     at java.security.AccessControlContext.goCombiner(AccessControlContext.java:516)
     at java.security.AccessControlContext.combineWithPrivilegedContext(AccessControlContext.java:305)
     at java.security.AccessControlContext.optimize(AccessControlContext.java:404)
     at java.security.AccessController.checkPermission(AccessController.java:398)
     at gov.llnl.ais.test.TestServlet.doPost(TestServlet.java:59)
     at gov.llnl.ais.test.TestServlet.doGet(TestServlet.java:44)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:244)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:336)
     at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.ResourceFilterChain.doFilter(ResourceFilterChain.java:59)
     at oracle.security.jazn.oc4j.JAZNFilter$1.run(JAZNFilter.java:252)
     at java.security.AccessController.doPrivileged(Native Method)
     at javax.security.auth.Subject.doAsPrivileged(Subject.java:558)
     at oracle.security.jazn.oc4j.JAZNFilter.doFilter(JAZNFilter.java:269)
     at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:523)
     at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:269)
     at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:735)
     at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.AJPRequestHandler.run(AJPRequestHandler.java:151)
     at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].util.ThreadPoolThread.run(ThreadPoolThread.java:64)
I also get this exception in $ORACLE_HOME/opmn/logs/home.default_island.1
java.lang.reflect.InvocationTargetException: oracle.security.jazn.JAZNException: The system is unable to retreive the specified role(s).
     at oracle.security.jazn.spi.ldap.LDAPRealmRole.<init>(LDAPRealmRole.java:91)
     at java.lang.reflect.Constructor.newInstance(Native Method)
     at oracle.security.jazn.spi.ldap.LDAPGranteeEntry.init(LDAPGranteeEntry.java:218)
     at oracle.security.jazn.spi.ldap.LDAPGranteeEntry.<init>(LDAPGranteeEntry.java:121)
     at oracle.security.jazn.spi.ldap.LDAPGranteeEntry.<init>(LDAPGranteeEntry.java:116)
     at oracle.security.jazn.spi.ldap.LDAPLocalPolicy.getGrantees(LDAPLocalPolicy.java:315)
     at oracle.security.jazn.spi.ldap.LDAPLocalPolicy.getGranteeEntries(LDAPLocalPolicy.java:264)
     at oracle.security.jazn.spi.ldap.LDAPLocalPolicy.getPermissions(LDAPLocalPolicy.java:1029)
     at oracle.security.jazn.spi.ldap.LDAPJAZNPolicy.getPermissions(LDAPJAZNPolicy.java:649)
     at oracle.security.jazn.spi.ldap.LDAPJAZNPolicy.getPermissions(LDAPJAZNPolicy.java:680)
     at oracle.security.jazn.spi.PolicyProvider.getPermissions(PolicyProvider.java:218)
     at javax.security.auth.SubjectDomainCombiner$3.run(SubjectDomainCombiner.java:253)
     at java.security.AccessController.doPrivileged(Native Method)
     at javax.security.auth.SubjectDomainCombiner.combine(SubjectDomainCombiner.java:249)
     at java.security.AccessControlContext.goCombiner(AccessControlContext.java:516)
     at java.security.AccessControlContext.combineWithPrivilegedContext(AccessControlContext.java:305)
     at java.security.AccessControlContext.optimize(AccessControlContext.java:404)
     at java.security.AccessController.checkPermission(AccessController.java:398)
     at gov.llnl.ais.test.TestServlet.doPost(TestServlet.java:59)
     at gov.llnl.ais.test.TestServlet.doGet(TestServlet.java:44)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:244)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:336)
     at com.evermind.server.http.ResourceFilterChain.doFilter(ResourceFilterChain.java:59)
     at oracle.security.jazn.oc4j.JAZNFilter$1.run(JAZNFilter.java:252)
     at java.security.AccessController.doPrivileged(Native Method)
     at javax.security.auth.Subject.doAsPrivileged(Subject.java:558)
     at oracle.security.jazn.oc4j.JAZNFilter.doFilter(JAZNFilter.java:269)
     at com.evermind.server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:523)
     at com.evermind.server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:269)
     at com.evermind.server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:735)
     at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:151)
     at com.evermind.util.ThreadPoolThread.run(ThreadPoolThread.java:64)
Here are my XML files:
=== application.xml start ===
<?xml version="1.0" encoding="windows-1252"?>
<!DOCTYPE application PUBLIC "-//Sun Microsystems, Inc.//DTD J2EE Application 1.2//EN" "http://java.sun.com/j2ee/dtds/application_1_2.dtd">
<application>
     <display-name>TestMe</display-name>
     <module>
          <web>
               <web-uri>test.war</web-uri>
               <context-root>/testme</context-root>
          </web>
     </module>
     <security-role>
          <role-name>users</role-name>
     </security-role>
</application>
=== application.xml end ===
=== orion-application.xml start ===
<?xml version="1.0" encoding="windows-1252"?>
<!DOCTYPE orion-application PUBLIC "-//Evermind//DTD J2EE Application runtime 1.2//EN" "http://xmlns.oracle.com/ias/dtds/orion-application.dtd">
<orion-application>
     <web-module id="test" path="test.war"/>
     <security-role-mapping name="users">
          <group name="llnl/AUTHENTICATED_USERS"/>
     </security-role-mapping>
     <persistence path="persistence"/>
     <log>
          <file path="application.log"/>
     </log>
     <!-- use JAZN-XML by default
     <jazn provider="XML" location="./jazn-data.xml"/> -->
     <!-- use JAZN-LDAP instead -->
     <jazn provider="LDAP" default-realm="llnl" location="my-ldap-server-is-here"/>
     <namespace-access>
          <read-access>
               <namespace-resource root="">
                    <security-role-mapping impliesAll="true" name="&lt;jndi-user-role&gt;">
                         <group name="administrators"/>
                    </security-role-mapping>
               </namespace-resource>
          </read-access>
          <write-access>
               <namespace-resource root="">
                    <security-role-mapping impliesAll="true" name="&lt;jndi-user-role&gt;">
                         <group name="administrators"/>
                    </security-role-mapping>
               </namespace-resource>
          </write-access>
     </namespace-access>
</orion-application>
=== orion-application.xml end ===
=== orion-web.xml start ===
<?xml version="1.0"?>
<!DOCTYPE orion-web-app PUBLIC "-//Evermind//DTD Orion Web Application 2.3//EN" "http://xmlns.oracle.com/ias/dtds/orion-web.dtd">
<orion-web-app>
     <jazn-web-app auth-method="SSO" runas-mode="true" doasprivileged-mode="true"/>
</orion-web-app>
=== orion-web.xml end -===
=== web.xml start ===
<?xml version="1.0"?>
<!DOCTYPE web-app SYSTEM "http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
     <servlet>
          <servlet-name>TestServlet</servlet-name>
          <servlet-class>gov.llnl.ais.test.TestServlet</servlet-class>
          <security-role-ref>
               <role-name>users</role-name>
               <role-link>users</role-link>
          </security-role-ref>
          <!--          <run-as>
          <role-name>users</role-name>
          </run-as> -->
     </servlet>
     <servlet-mapping>
          <servlet-name>TestServlet</servlet-name>
          <url-pattern>/test</url-pattern>
     </servlet-mapping>
     <welcome-file-list>
          <welcome-file>index.jsp</welcome-file>
     </welcome-file-list>
     <error-page>
          <error-code>404</error-code>
          <location>/error.jsp</location>
     </error-page>
     <security-constraint>
          <web-resource-collection>
               <web-resource-name>authenticated</web-resource-name>
               <url-pattern>/test</url-pattern>
          </web-resource-collection>
          <auth-constraint>
               <role-name>users</role-name>
          </auth-constraint>
     </security-constraint>
     <login-config>
          <auth-method>BASIC</auth-method>
     </login-config>
     <security-role>
          <role-name>users</role-name>
     </security-role>
</web-app>
=== web.xml end ===
=== TestServlet.java start ===
package gov.llnl.ais.test;
import java.io.FilePermission;
import java.io.IOException;
import java.io.PrintWriter;
import javax.security.auth.Subject;
import javax.security.auth.SubjectDomainCombiner;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import javax.servlet.http.HttpServlet;
import java.security.AccessControlContext;
import java.security.AccessController;
import java.security.DomainCombiner;
import java.security.Principal;
import java.util.Iterator;
import java.util.Set;
import oracle.security.jazn.oc4j.JAZNUserAdaptor;
public class TestServlet extends HttpServlet {
     * Constructor for TestServlet.
     public TestServlet() {
          super();
     * @param request
     * @param response
     public void doGet(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) throws IOException {
          doPost(request, response);
     public void doPost(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) throws IOException {
          PrintWriter pw = response.getWriter();
          pw.println("<html><head><title>Hi</title><body>Hi there dude<br>You are:");
          pw.println(request.getRemoteUser());
          Principal p = request.getUserPrincipal();
          if (p instanceof JAZNUserAdaptor) {
               JAZNUserAdaptor jaznuser = (JAZNUserAdaptor) p;
               pw.println("<br>SSO user DN [RealmPrincipal.getFullName] = " + jaznuser.getFullName() + "<br>");
               pw.println("Subscriber name [Realm.getName] = " + jaznuser.getRealm().getName() + "<br>");
               pw.println("Subscriber DN [Realm.getFullName] = " + jaznuser.getRealm().getFullName() + "<p>");
          AccessController.checkPermission(new FilePermission("/tmp/test.txt", "read"));
          Subject subject = null;
          AccessControlContext acc = AccessController.getContext();
          subject = Subject.getSubject(acc);
          if (subject == null) {
               pw.println("Subject via AccessControlContext is null.<br>");
               DomainCombiner dc = acc.getDomainCombiner();
               if (dc instanceof SubjectDomainCombiner) {
                    subject = ((SubjectDomainCombiner) dc).getSubject();
          if (subject == null) {
               pw.println("Subject via DomainCombiner is null.<br>");
          if (subject != null) {
               Set principals = subject.getPrincipals();
               Iterator principalsIterator = principals.iterator();
               while (principalsIterator.hasNext()) {
                    Principal principal = (Principal) principalsIterator.next();
                    pw.println("Principal: " + principal.toString() + "<br>");
          pw.println("</body></html>");
=== TestServlet.java end ===

Answer 1

More info...
When I go into the JAZN tool via:
java -jar jazn.jar -shell
Then do this:
JAZN:> cd realms/llnl/roles/AUTHENTICATED_USERS
JAZN:llnl> ls permissions
java.lang.reflect.InvocationTargetException: oracle.security.jazn.JAZNException: The system is unable to retreive the specified role(s).
at oracle.security.jazn.spi.ldap.LDAPRealmRole.<init>(LDAPRealmRole.java:91)
at java.lang.reflect.Constructor.newInstance(Native Method)
at oracle.security.jazn.spi.ldap.LDAPGranteeEntry.init(LDAPGranteeEntry.java:218)
at oracle.security.jazn.spi.ldap.LDAPGranteeEntry.<init>(LDAPGranteeEntry.java:121)
at oracle.security.jazn.spi.ldap.LDAPGranteeEntry.<init>(LDAPGranteeEntry.java:116)
at oracle.security.jazn.spi.ldap.LDAPLocalPolicy.getGrantees(LDAPLocalPolicy.java:315)
at oracle.security.jazn.spi.ldap.LDAPLocalPolicy.getGranteeEntries(LDAPLocalPolicy.java:264)
at oracle.security.jazn.spi.ldap.LDAPLocalPolicy.getPermissions(LDAPLocalPolicy.java:1029)
at oracle.security.jazn.spi.ldap.LDAPJAZNPolicy.getPermissions(LDAPJAZNPolicy.java:649)
at oracle.security.jazn.spi.ldap.LDAPJAZNPolicy.getPermissions(LDAPJAZNPolicy.java:680)
at oracle.security.jazn.tools.Admintool.listRolePerms(Admintool.java:1140)
at oracle.security.jazn.tools.Admintool.processArgs(Admintool.java:404)
at oracle.security.jazn.tools.Admintool.lsCommand(Admintool.java:2782)
at oracle.security.jazn.tools.Admintool.shell(Admintool.java:2399)
at oracle.security.jazn.tools.Admintool.processArgs(Admintool.java:230)
at oracle.security.jazn.tools.Admintool.main(Admintool.java:123)
A JAZN internal error has occurred.
What could be causing this problem? It seems to be the same error that I'm getting in the OPMN log.
Thanks!
--Leif