Bug in WebLogic 8.1 SP4 for IBM JDK 1.4.2?

Question

Hello,
<p>
In a previous thread i posted (http://forums.bea.com/bea/thread.jspa?threadID=600006934&tstart=0), I reported that we had problems in trying to use JAAS in connecting Acegi with WebLogic 8.1 SP4 on IBM JDK 1.4.2
<p>
We did some more research and found the following:
<br>
WebLogic uses the class <i>weblogic.security.service.ServerConfiguration</i> for reading the JAAS config file. This class extends the default <i>javax.security.auth.login.Configuration</i> class. To see what's going on we decompiled the class and it looks like this:
<p>
<i>
try {
     // code omitted.
} catch (Exception exception) {
     String s1 = System.getProperty("login.configuration.provider");
     if(s1 == null)
     s1 = "com.sun.security.auth.login.ConfigFile";
     if(!s1.equals("weblogic.security.service.ServerConfiguration"))
     try
          Configuration configuration = (Configuration)Class.forName(s1).newInstance();
          configuration.refresh();
          aappconfigurationentry = configuration.getAppConfigurationEntry(s);
     catch(Exception exception1) { }
</i>
<p>
The following happens when trying to authenticate through JAAS:
<p>
- The "omitted code" throws the Exception <i>weblogic.security.service.InvalidParameterException: [Security:090396]Security Realm sample does not exist</i>.
<p>
Why is this Exception thrown? Why does the name of my JAAS configuration in the JAAS config file needs to be the same as a Security Realm? Or this try-catch block used as some kind of control flow and is this exception expected?
<p>
- Then in the catch block the <b>System</b>.property <i>login.configuration.provider</i> is retrieved. However the JDK Specification of the class <i>javax.security.auth.login.Configuration</i> (sse the javadoc) states that:<p>
<i>The default Configuration implementation can be changed by setting the value of the "login.configuration.provider" security property (in the Java security properties file) to the fully qualified name of the desired Configuration implementation class</i>
<p>
So because the <b>System</b> property is read instead of the <b>Security</b> property (which contains the correct IBM class), <i>null</i> is returned. Is this a bug?
<p>
- Because the System property is <i>null</i> the code then tries to load the class <i>com.sun.security.auth.login.ConfigFile</i>, which of course is not present in the IBM JDK, and a ClassNotFoundException is thrown. Since
the Exception is swallowed by the nested catch block we will not see this exception and <i>null</i> is returned that eventually leads to the "No LoginModule found..." exception.
<p>
So to summarize, my questions are these:
<p>
- Does the name of the JAAS configuration in the JAAS config file need to be the same as the name of the Realm? And if so why?<br>
- Is it a bug that instead of reading the <b>Security</b> this code is reading the <b>System</b> property?
<p><p>
Regards,<br>
Lars Vonk
<p>
PS<br>
As a workaround we set the System property <i>login.configuration.provider</i> to the correct value <i>com.ibm.security.auth.login.ConfigFile</i> and then it works.

Answer 1

Sorry, i saw the forum about your problem in BEA 8.1 SP 6 about a
weblogic.security.SSL.SSLCertificate.verify(SSLCertificate.java:235)
error and you said that bea sent a path named CR295205_810sp6.jar.
I have the same problem
Do you have this patch?
Could you send it to me?
my email address is
[email protected]