Change Login Module

I think this is an old question. I’m trying to customizing the logon page. I’m using the document Customizing the Logon user Interface of SAP Enterprise Portal. I’m in the Enterprise Portal 6.0 SP 11, J2EE version 6.40.
After executing all the changes that the document indicates:
-     Like created a new project
-     I change the authschemes.xml, to my project name
When accessing the portal the Following error appears:
     Portal Runtime Error
An exception occurred while processing a request for :
iView : N/A
Component Name : N/A
The exception was logged. Inform your system administrator..
See the details for the exception ID in the log file
Those any one can Help me.
Best Regards
Thanks In advanced
Pedro Miguel Rodrigues

The problem exception is not a problem at this moment. 
Now I have 2 problems:
Frist:
I’ have made the changes and create a Logon:
User (Input Field)
Password (Input field)
Logon (Bottom).
Now when I click in the logon, it executes the logon, but it “log” on the same page and those not refresh the page (I’have 2 headers, the first header disappears after using the button refresh off the IE.
Second:
When the user places a wrong password. The system call the standard logon, but I don’t want this situation.
Those any one can help on this 2 situations

Similar Messages

  • Changing login module stack for Netweaver Portal?

    G'day,
    I want to change the login stack for Netweaver Portal (at http://<host:50100/irj).
    Currently portal is configured in Visual Administrator to use the "ticket" authentication template. I can change this authentication template and change how I authenticate to portal.
    But changing "ticket" authentication template also changes how other applications perform authentication. So I changed the login module stack for the "com.sap/irj*irj" component to not use an authentication template, and added my own login modules.
    But when I access portal again, the "ticket" authentication is still used. I restarted the cluster to be sure but no matter what login modules I configure for "com.sap/irj*irj", only changes to "ticket" have any effect.
    So: how do modify the login module stack for portal, without modifying the "ticket" authentication template?
    --Geoff

    Hi,
    If you'd like to change the authentication stack only for the EP but not for all applications that use UME authentication, then you have to modify the descriptor authschemes.xml. You have to change the scheme "default" to point to another LM stack instead of "ticket" as it is shipped.
    Kind regards,
    Tsvetomir

  • JAAS login module is calling password change page

    Hi,
    I am developing an login module on SAP Portal 7.0, but I stuck an issue. "User password change" page is appearing on the screen as soon as I call "http://<hostname>:<port>/irj/portal", after I add my custom login module under "ticket" component on "Visual Administrator". It is weird that custom login module is running properly on the portal with 1 server node. The problem is occured when I try to call it on the portal with 5 server nodes. I would like to indicate that I didn't call "User password change" page or something like a thing that can call that page, in the code. Anyone has a suggestion?
    Thank you

    I solved the problem

  • [svn:bz-trunk] 20680: Tomcat 7 Login Module work, due to the Tomcat 7 Security framework change we need to work out the security integration piece for tomcat 7 .

    Revision: 20680
    Revision: 20680
    Author:   [email protected]
    Date:     2011-03-08 08:23:30 -0800 (Tue, 08 Mar 2011)
    Log Message:
    Tomcat 7 Login Module work, due to the Tomcat 7 Security framework change we need to work out the security integration piece for tomcat 7. So far the ValveBase and tomcat Realm had API changes which will impact on the Login integration with Tomcat 7
    Modified Paths:
        blazeds/trunk/modules/opt/build.xml
    Added Paths:
        blazeds/trunk/modules/opt/lib/catalina-708.jar
        blazeds/trunk/modules/opt/src/tomcat/flex/messaging/security/TomcatValve708.java

    Revision: 20680
    Revision: 20680
    Author:   [email protected]
    Date:     2011-03-08 08:23:30 -0800 (Tue, 08 Mar 2011)
    Log Message:
    Tomcat 7 Login Module work, due to the Tomcat 7 Security framework change we need to work out the security integration piece for tomcat 7. So far the ValveBase and tomcat Realm had API changes which will impact on the Login integration with Tomcat 7
    Modified Paths:
        blazeds/trunk/modules/opt/build.xml
    Added Paths:
        blazeds/trunk/modules/opt/lib/catalina-708.jar
        blazeds/trunk/modules/opt/src/tomcat/flex/messaging/security/TomcatValve708.java

  • Assigning a login module to a Web Dynpro application

    Hi everybody,
    I would like a Web Dynpro application to use a custom login module for authentication. How can I do this?
    What I found is the Security Provider (in the Visual Administrator tool) where I can add a login module to the "form" authentication mechanism for example. But if I do this I think all applications using this mechanism have to use my custom login module, right?
    I wonder if I have to add my Web Dynpro application as a component to the Security Provider so that I can assign login modules to it. Am I on the right way? If yes, how can I do this? If I choose "Add" from the "Policy Configurations" tab a popup appears where I can enter the name for a new component. How do I specify my application there?
    Thanks in advance for all answers,
    Torben

    Hi,
    Web Dynpro applications use the ticket authentication template. U wud need to add your login module to the ticket template's login stack.
    Incase you are accessing the Web Dynpro applications thru the EP u wud need to make changes to the authschemes.xml file too.
    regards,
    Vishal

  • Help - using custom login module with embedded jdev oc4j to access ejb 3

    Hi All (Frank ??),
    I'm just wondering if anyone has successfully been able to leverage a custom login module in combination
    with a client that connects to a local EJB 3 stateless session bean through Jdeveloper 10.1.3.2's embedded oc4j.
    I have spent 2+ days trying to get this to work - and i think I resound now to the fact im going to
    have to deploy to oc4j standalone instead.
    I got close.. but finally was trumped with the following error from the client trying to access the ejb:-
    javax.naming.NoPermissionException: Not allowed to look up XXXXXX, check the namespace-access tag
    setting in orion-application.xml for details.
    Using the various guides available, I had no problem getting the custom login module working
    with a local servlet running from JDev's embedded oc4j.. however with ejb - no such luck.
    I have a roles table (possible values Member, Admin) - that maps to sr_Member and sr_Admin
    respectively in various config files.
    I'm using EJB 3 annotations for protecting methods .. for example
    @RolesAllowed("sr_Member")
    Steps that I had to do so far :-
    In <jdevhome>\jdev\system\oracle.jwee.10.1.3.40.66\embedded-oc4j\config\system-jazn-data.xml1) Add custom login module
        <application>
          <name>current-workspace-app</name>
          <login-modules>
            <login-module>
              <class>kr.security.KnowRushLoginModule</class>
              <control-flag>required</control-flag>
              <options>
                <option>
                  <name>dataSource</name>
                  <value>jdbc/DB_XE_KNOWRUSHDS</value>
                </option>
                <option>
                  <name>user.table</name>
                  <value>users</value>
                </option>
                <option>
                  <name>user.pk.column</name>
                  <value>id</value>
                </option>
                <option>
                  <name>user.name.column</name>
                  <value>email_address</value>
                </option>
                <option>
                  <name>user.password.column</name>
                  <value>password</value>
                </option>
                <option>
                  <name>role.table</name>
                  <value>roles</value>
                </option>
                <option>
                  <name>role.to.user.fk.column</name>
                  <value>user_id</value>
                </option>
                <option>
                  <name>role.name.column</name>
                  <value>name</value>
                </option>
              </options>
            </login-module>
          </login-modules>
        </application>2) Grant login rmi permission to roles associated with custom login module (also in system-jazn-data.xml)
      <grant>
        <grantee>
          <principals>
            <principal>
              <realm-name>jazn.com</realm-name>
              <type>role</type>
              <class>kr.security.principals.KRRolePrincipal</class>
              <name>Admin</name>
            </principal>
          </principals>
        </grantee>
        <permissions>
          <permission>
            <class>com.evermind.server.rmi.RMIPermission</class>
            <name>login</name>
          </permission>
        </permissions>
      </grant>
      <grant>
        <grantee>
          <principals>
            <principal>
              <realm-name>jazn.com</realm-name>
              <type>role</type>
              <class>kr.security.principals.KRRolePrincipal</class>
              <name>Member</name>
            </principal>
          </principals>
        </grantee>
        <permissions>
          <permission>
            <class>com.evermind.server.rmi.RMIPermission</class>
            <name>login</name>
          </permission>
        </permissions>
      </grant>3) I've tried creating various oracle and j2ee deployment descriptors (even though ejb-jar.xml and orion-ejb-jar.xml get created automatically when running the session bean in jdev).
    My ejb-jar.xml contains :-
    <?xml version="1.0" encoding="utf-8"?>
    <ejb-jar xmlns ....
      <assembly-descriptor>
        <security-role>
          <role-name>sr_Admin</role-name>
        </security-role>
        <security-role>
          <role-name>sr_Member</role-name>
        </security-role>
      </assembly-descriptor>
    </ejb-jar>Note- i'm not specifying the enterprise-beans stuff, as JDev seems to populate this automatically.
    My orion-ejb-jar.xml contains ...
    <?xml version="1.0" encoding="utf-8"?>
    <orion-ejb-jar ...
      <assembly-descriptor>
        <security-role-mapping name="sr_Admin">
          <group name="Admin"></group>
        </security-role-mapping>
        <security-role-mapping name="sr_Member">
          <group name="Member"></group>
        </security-role-mapping>
        <default-method-access>
          <security-role-mapping name="sr_Member" impliesAll="true">
          </security-role-mapping>
        </default-method-access>
      </assembly-descriptor>My orion-application.xml contains ...
    <?xml version="1.0" encoding="utf-8"?>
    <orion-application xmlns ...
      <security-role-mapping name="sr_Admin">
        <group name="Admin"></group>
      </security-role-mapping>
      <security-role-mapping name="sr_Member">
        <group name="Member"></group>
      </security-role-mapping>
      <jazn provider="XML">
        <property name="role.mapping.dynamic" value="true"></property>
        <property name="custom.loginmodule.provider" value="true"></property>
      </jazn>
      <namespace-access>
        <read-access>
          <namespace-resource root="">
            <security-role-mapping name="sr_Admin">
              <group name="Admin"/>
              <group name="Member"/>
            </security-role-mapping>
          </namespace-resource>
        </read-access>
        <write-access>
          <namespace-resource root="">
            <security-role-mapping name="sr_Admin">
              <group name="Admin"/>
              <group name="Member"/>
            </security-role-mapping>
          </namespace-resource>
        </write-access>
      </namespace-access>
    </orion-application>My essentially auto-generated EJB 3 client does the following :-
          Hashtable env = new Hashtable();
          env.put(Context.SECURITY_PRINCIPAL, "matt.shannon");
          env.put(Context.SECURITY_CREDENTIALS, "welcome1");
          final Context context = new InitialContext(env);
          KRFacade kRFacade = (KRFacade)context.lookup("KRFacade");
    ...And throws the error
    20/04/2007 00:55:37 oracle.j2ee.rmi.RMIMessages
    EXCEPTION_ORIGINATES_FROM_THE_REMOTE_SERVER
    WARNING: Exception returned by remote server: {0}
    javax.naming.NoPermissionException: Not allowed to look
    up KRFacade, check the namespace-access tag setting in
    orion-application.xml for details
         at
    com.evermind.server.rmi.RMIClientConnection.handleLookupRe
    sponse(RMIClientConnection.java:819)
         at
    com.evermind.server.rmi.RMIClientConnection.handleOrmiComm
    andResponse(RMIClientConnection.java:283)
    ....I can see from the console that the user was successfully authenticated :-
    20/04/2007 00:55:37 kr.security.KnowRushLoginModule validate
    WARNING: [KnowRushLoginModule] User matt.shannon authenticated
    And that user is granted both the Admin, and Member roles.
    The test servlet using basic authentication correctly detects the user and roles perfectly...
      public void doGet(HttpServletRequest request,
                        HttpServletResponse response)
        throws ServletException, IOException
        LOGGER.log(Level.INFO,LOGPREFIX +"doGet called");
        response.setContentType(CONTENT_TYPE);
        PrintWriter out = response.getWriter();
        out.println("<html>");
        out.println("<head><title>ExampleServlet</title></head>");
        out.println("<body>");
        out.println("<p>The servlet has received a GET. This is the reply.</p>");
        out.println("<br> getRemoteUser = " + request.getRemoteUser());
        out.println("<br> getUserPrincipal = " + request.getUserPrincipal());
        out.println("<br> isUserInRole('sr_Admin') = "+request.isUserInRole("sr_Admin"));
        out.println("<br> isUserInRole('sr_Memeber') = "+request.isUserInRole("sr_Member"));Anyone got any ideas what could be going wrong?
    cheers
    Matt.
    Message was edited by:
    mshannon

    Thanks for the response. I checked out your blog and tried your suggestions. I'm sure it works well in standalone OC4J, but i was still unable to get it to function correctly from JDeveloper embedded.
    Did you ever get the code working directly from JDeveloper?
    Your custom code essentially seems to be the equivalent of a grant within system-jazn-data.xml.
    For example, the following grant to a custom jaas role (JAAS_ADMIN) that gets added by my custom login module gives them rmi login access :-
         <grant>
              <grantee>
                   <principals>
                        <principal>
                             <realm-name>jazn.com</realm-name>
                             <type>role</type>
                             <class>kr.security.principals.KRRolePrincipal</class>
                             <name>JAAS_Admin</name>
                        </principal>
                   </principals>
              </grantee>
              <permissions>
                   <permission>
                        <class>com.evermind.server.rmi.RMIPermission</class>
                        <name>login</name>
                   </permission>
              </permissions>
         </grant>If I add the following to orion-application.xml
      <!-- Granting login permission to users accessing this EJB. -->
      <namespace-access>
        <read-access>
          <namespace-resource root="">
            <security-role-mapping>
              <group name="JAAS_Admin"></group>
            </security-role-mapping>
          </namespace-resource>
        </read-access>Running a standalone client against the embedded jdev oc4j server gives the namespace-access error.
    I tried out your code by essentially creating a static reference to a singleton class that does the role lookup/provisioning with rmi login grant :-
    From custom login module :-
      private static KRSecurityHelper singleton = new KRSecurityHelper();
      protected Principal[] m_Principals;
        Vector v = new Vector();
          v.add(singleton.getCustomRmiConnectRole());
          // set principals in LoginModule
          m_Principals=(Principal[]) v.toArray(new Principal[v.size()]);
    Singleton class :-
    package kr.security;
    import com.evermind.server.rmi.RMIPermission;
    import java.util.logging.Level;
    import java.util.logging.Logger;
    import oracle.security.jazn.JAZNConfig;
    import oracle.security.jazn.policy.Grantee;
    import oracle.security.jazn.realm.Realm;
    import oracle.security.jazn.realm.RealmManager;
    import oracle.security.jazn.realm.RealmRole;
    import oracle.security.jazn.realm.RoleManager;
    import oracle.security.jazn.policy.JAZNPolicy;
    import oracle.security.jazn.JAZNException;
    public class KRSecurityHelper
      private static final Logger LOGGER = Logger.getLogger("kr.security");
      private static final String LOGPREFIX = "[KRSecurityHelper] ";
      public static String CUSTOM_RMI_CONNECT_ROLE = "remote_connect";
      private RealmRole m_Role = null;
      public KRSecurityHelper()
        LOGGER.log(Level.FINEST,LOGPREFIX +"calling JAZNConfig.getJAZNConfig");
        JAZNConfig jc = JAZNConfig.getJAZNConfig();
        LOGGER.log(Level.FINEST,LOGPREFIX +"calling jc.getRealmManager");
        RealmManager realmMgr = jc.getRealmManager();
        try
          // Get the default realm .. e.g. jazn.com
          LOGGER.log(Level.FINEST,LOGPREFIX +"calling jc.getGetDefaultRealm");
          Realm r = realmMgr.getRealm(jc.getDefaultRealm());
          LOGGER.log(Level.INFO,LOGPREFIX +"default realm: "+r.getName());
          // Access the role manager for the remote connection role
          LOGGER.log(Level.FINEST,
            LOGPREFIX +"calling default_realm.getRoleManager");
          RoleManager roleMgr = r.getRoleManager();
          LOGGER.log(Level.INFO,LOGPREFIX +"looking up custom role '"
            CUSTOM_RMI_CONNECT_ROLE "'");
          RealmRole rmiConnectRole = roleMgr.getRole(CUSTOM_RMI_CONNECT_ROLE);
          if (rmiConnectRole == null)
            LOGGER.log(Level.INFO,LOGPREFIX +"role does not exist, create it...");
            rmiConnectRole = roleMgr.createRole(CUSTOM_RMI_CONNECT_ROLE);
            LOGGER.log(Level.FINEST,LOGPREFIX +"constructing new grantee");
            Grantee gtee = new Grantee(rmiConnectRole);
            LOGGER.log(Level.FINEST,LOGPREFIX +"constructing login rmi permission");
            RMIPermission login = new RMIPermission("login");
            LOGGER.log(Level.FINEST,
              LOGPREFIX +"constructing subject.propagation rmi permission");
            RMIPermission subjectprop = new RMIPermission("subject.propagation");
            // make policy changes
            LOGGER.log(Level.FINEST,LOGPREFIX +"calling jc.getPolicy");
            JAZNPolicy policy = jc.getPolicy();
            if (policy != null)
              LOGGER.log(Level.INFO, LOGPREFIX
                + "add to policy grant for RMI 'login' permission to "
                + CUSTOM_RMI_CONNECT_ROLE);
              policy.grant(gtee, login);
              LOGGER.log(Level.INFO, LOGPREFIX
                + "add to policy grant for RMI 'subject.propagation' permission to "
                + CUSTOM_RMI_CONNECT_ROLE);
              policy.grant(gtee, subjectprop);
              // m_Role = rmiConnectRole;
              m_Role = roleMgr.getRole(CUSTOM_RMI_CONNECT_ROLE);
              LOGGER.log(Level.INFO, LOGPREFIX
                + m_Role.getName() + ":" + m_Role.getFullName() + ":" + m_Role.getFullName());
            else
              LOGGER.log(Level.WARNING,LOGPREFIX +"Cannot find jazn policy!");
          else
            LOGGER.log(Level.INFO,LOGPREFIX +"custom role already exists");
            m_Role = rmiConnectRole;
        catch (JAZNException e)
          LOGGER.log(Level.WARNING,
            LOGPREFIX +"Cannot configure JAZN for remote connections");
      public RealmRole getCustomRmiConnectRole()
        return m_Role;
    }Using the code approach and switching application.xml across so that namespace access is for the group remote_connect, I get the following error from my bean :-
    INFO: Login permission not granted for current-workspace-app (test.user)
    Thus, the login permission that I'm adding through the custom remote_connect role does not seem to work. Even if it did, i'm pretty sure I would still get that namespace error.
    This has been such a frustrating process. All the custom login module samples using embedded JDeveloper show simple j2ee servlet protection based on settings in web.xml.
    There are no samples showing jdeveloper embedded oc4j using ejb with custom login modules.
    Hopefully the oc4j jdev gurus like Frank can write a paper that demonstrates this.
    Matt.

  • Third party SSO with a custom login module

    Hello everyone,
    I've found a few posts on the forum with questions similar to mine, but none have been answered.  I'm using a 3rd party authentication product along with a custom implementation of the AbstractLoginModule interface.
    The setup is standard: A 3rd party agent is installed on a reverse proxy web server to SAP. The agent is configured to protect SAP resources, and it handles the login screens and authentication. Once the user has been authenticated, the AbstractLoginModule implementation kicks in, decrypts and validates an SSO token, retrieves the username from it and creates an SAP Principal.   
    The login ticket template is configured as follows:
    1.  EvaluateTicketLoginModule   SUFFICIENT
                        2.  MyLoginModule                      REQUISITE
                        3.  CreateTicketLoginModule       OPTIONAL
    One of the integration's key requirements is that direct interaction with standard SAP authentication must be avoided.  More specifically, the user should never need to enter an SAP password.  I'm only seeing two problems, both of which violate this requirement.
    The first is in cases where there is no existing SAP user that matches the authenticated user.  In this case, the third party token and SAP Principal are created, the abort method is called, and the user is redirected to the SAP login page.   I need to either bring to user back to the third party login page or to a custom error page~.
    The second problem occurs when an SAP password change is required. Again in this case, an SAP form is displayed after the module has created the Principal (although once the user changes the SAP password, all's well). If I were to disable mandatory password changes, would this apply to fat client access as well? If so, then it's not a viable option.
    The general idea in both instances is that the SAP I'd appreciate any help or suggestions.  
    Thanks
    ~ Since the SSO token applies to applications outside of SAP, I may add a login module parameter to make this a configurable choice. (I.e. allow the administrator to decide whether to inform the user that SAP authentication failed while preserving the SSO token, or to destroy the token and force re-authentication). However, if there is a way to configure the "bad credentials" URL outside of the module's code/parameters, it may be better to place the choice there.

    Hi Julius,
    Thank you for the quick response - and on a Sunday, no less!
    I have considered verifying that the user existed in SAP before creating the Principal.  One might argue that that would be the common sense thing to do.  The reason I've held off is that the error should be so rare that it may not justify the overhead.  There's a requirement to have a one-to-one username mapping between SAP and the authentication application.  It would be more efficient to assume that this requirement has been met and to handle the Exception when it hasn't been.  Of course, that doesn't mean that it's the right way to go.
    +_Julius Bussche wrote:_+
    For the first concern, if they can access the logon page directly (anyway) you could disable it as you do not want any password based logons (right?) and redirect it to your external page or an error page.
    Yes, this is what I'm hoping to do, but I'm not sure how to do it.  Here are some comments and questions about this:
    1. What's involved in disabling the login page?  I would think you'd need to replace it with something else rather than just switch it off.   Could I limit this change to the login ticket template so that other templates (basic authentication, for example) are still available?
    2. Keep in mind that users will never get past the "real" login page unless they have been authenticated.  This complicates matters because we're dealing with a scenario in which the user has already been authenticated but doesn't exist in SAP.  Therefore, it wouldn't make sense to go back to either login page.   
    3. What's involved in redirecting to an external page?  Is this an explicit redirect in the module code, or can it be decoupled from the module?  It's not a big deal, but it would be nice to avoid mandatory module parameters for relative paths to error pages.   
    I think the question I'm after is: "Can I simply change an SAP login URL parameter to point to a custom error page, and allow everything to work as it does now (where SAP handles the redirect)".  If so, could I limit the scope of the change to the login ticket template?  What would be even better is if I could configure SAP's response to this error.  Somewhere, it's currently configured to display the login page.  Ideally, I'd be able to configure it to display myErrorPage, and then set myErrorPage to the appropriate URL.  
    +_Julius Bussche wrote:_+
    For the second concern, I assume that there are no valid passwords involved here which might have expired, so as long as the user does not have the option to activate a password again and anyway cannot logon via password as the option is not presented... then you should be fine here as well with a forward proxy. Not sure which Java APIs are offered here, but you could check this together with the existence check and react to both prior to accessing SAP "from the outside".
    The problem here is that the SAP passwords are needed outside of the integration.  It's true that whether an SAP password has expired is irrelevant to the integration.  However,  this is a Web-based integration; SAP passwords must still be available to users who have access to other clients.  With this in mind, could I create a user password policy that disables password expiration and automatic password change, but only apply it to Web client access?  If not, do you know how I might override SAPu2019s behavior?
    Once again, thank you for taking your time to help me out.  I am very grateful.
    - John

  • JAAS login module configuration in Oracle application server

    I have a LDAP login module implementing javax.security.auth.spi.LoginModule. This login module works well with tomcat and weblogic, if I configure the JVM arguments -Djava.security.auth.login.config and -Djava.security.policy to pont to the login.conf and access.policy files. The login.conf file has the below content
    FREEWAY_SERV
    com.wipro.freeway.security.LdapLoginModule required debug=true portal=false;
    FREEWAY_PORT
    com.wipro.freeway.security.LdapLoginModule required debug=true portal=true;
    The application uses these login modules by passing Name of the JAAS configuration (FREEWAY_SERV or FREEWAY_PORT).
    I would like to use the same login modules and code in Oracle application sever 10.1.3 and I haven't got any success yet.
    Could anybody please help me to get this right?
    Thanks in advance.
    Message was edited by:
    vinayalva

    Hi,
    in OracleAs bet is to use Enterprise Manager to configure the login module. The LoginModule needs to be configured in the system-jazn-data.xml file, which is located in teh j2ee/home/config directory of the OC4J you use. Enterprise Manager does this all for you.
    In your application deployment the orion-application.xml file needs to specify that a custom LoginModule should be used. Again ENterprise Manager does it for you.
    To use the LoginModule e.d. for J2EE authentication, just make sure that the application name of the J2EE deployment matches the name of the LoginModule configuration
    If you want to use pure JAAS you may have to change the OC4J properties file in the j2ee/home/config directory. Best suggestion to give is to get the online documentation for OC4J security
    Frank

  • How to call custom Login Module from JSP

    Hi,
    I am stuck with the following issue:
    1) Exactly as presented in help.sap.com (http://help.sap.com/saphelp_nw04/helpdata/en/3f/1be040e136742ae10000000a155106/content.htm) I created custom login module and deployed it as a library on J2EE server. When I configured it to be used for my applications in the Security provider but I am getting "No user name provided" exception everytime when my applications use this custom login module.
    2) I realized that I would need to call my custom module somewhere within my application (simple JSP) using LoginContext class and then use MyLoginContext.login() spec to initiate login process. But I am not able to pass CallbackHandler parameters from JSP application to my custom login module.
    So I have the following questions:
    1. Can I pass parameters using LoginContext and CallbackHandler from JSP to my custom login module (created as exact copy of HELP.SAP.COM example) or this module cannot be used this way.
    2. How to pass CallbackHandler correctly to my custom login module from JSP. When I am trying to use CallbackHandler, I am getting "Abstract Class cannot be called" error.
    I'd appreciate any little help on this matter.
    Thanks and regards,
    Mike

    You have two alternatives to do this:
    You can declare your JSP as a protected resource with the use of the deployment descriptors of the application (web.xml) and add the custom login module in the authentication stack of the application. This way, you will use container-based authentication, i.e. the Web Container will enforce the authentication and it will call the custom login module before it dispatches to the JSP. I recommend you this approach because it requires less coding and it makes the whole thing a matter of configuration. The configuration can be later on enhanced or changed runtime without the need to re-build and re-deploy the application. If you choose this approach you can go to the documentation of the server for help on how to modify the login module stack of the application.
    You can also use programmatic authentication by using JAAS API. To do this you need to create a custom security policy configuration with login module stack containing the custom login module, and then use the standard JAAS mechanism - new LoginContext(<configuration>, <callback-handler>).login(). This approach requires that you write your own callback handler and handle any LoginException.
    Let us know which approach you prefer and whether you have difficulties implementing it!

  • Jaas Login module does not work

    Hello,
    I am developing simple web application wich uses jaas for authentication, but something strange happens, i have written security information in my web.xml:
    <security-constraint>
              <web-resource-collection>
                   <web-resource-name>simple</web-resource-name>
                   <url-pattern>/security/*</url-pattern>
              </web-resource-collection>
              <auth-constraint>
                   <role-name>admin</role-name>
              </auth-constraint>
         </security-constraint>
         <login-config>
              <auth-method>FORM</auth-method>
              <form-login-config>
                   <form-login-page>/login.seam</form-login-page>
                   <form-error-page>/login.seam</form-error-page>
              </form-login-config>
         </login-config>
         <security-role>
              <role-name>admin</role-name>
         </security-role>my login module looks like this:
    package com.auth.security;
    public class SimpleLoginModule implements LoginModule {
         // initial state
         private Subject subject;
         private CallbackHandler callbackHandler;
         private Map sharedState;
         private Map options;
         // the authentication status
         private boolean succeeded = false;
         private boolean commitSucceeded = false;
         // login info
         private static final String[] userNames = { "admin", "guest", "user1", "user2" };
         private static final String[] passwords = { "admin", "sesame", "pass1", "pass2" };
         // current user
         private String username;
         private char[] password;
         // user's principal object
         private SimplePrincipal userPrincipal;
         public void initialize(Subject subject, CallbackHandler callbackHandler, Map sharedState, Map options) {
              System.out.println("INITIALIZE");
              this.subject = subject;
              this.callbackHandler = callbackHandler;
              this.sharedState = sharedState;
              this.options = options;
         }// end initialize()
              public boolean login() throws LoginException {
              System.out.println("LOGIN");
              // prompt for a user name and password
              if (callbackHandler == null)
                   throw new LoginException("Error: no CallbackHandler available " + "to garner authentication information from the user");
              Callback[] callbacks = new Callback[2];
              callbacks[0] = new NameCallback("\nuser name: ");
              callbacks[1] = new PasswordCallback("password: ", false);
              try {
                   callbackHandler.handle(callbacks);
                   username = ((NameCallback) callbacks[0]).getName();
                   char[] tmpPassword = ((PasswordCallback) callbacks[1]).getPassword();
                   if (tmpPassword == null) // treat a NULL password as an empty
                        // password
                        tmpPassword = new char[0];
                   password = new char[tmpPassword.length];
                   System.arraycopy(tmpPassword, 0, password, 0, tmpPassword.length);
                   ((PasswordCallback) callbacks[1]).clearPassword();
              } catch (java.io.IOException ioe) {
                   throw new LoginException(ioe.toString());
              } catch (UnsupportedCallbackException uce) {
                   throw new LoginException("Error: " + uce.getCallback().toString() + " not available to authenticate user.");
              boolean usernameCorrect = false;
              boolean passwordCorrect = false;
              String passwordString = new String(password);
              for (int x = 0; x < userNames.length; x++) {
                   if (username.equals(userNames[x]))
                        usernameCorrect = true;
                   if (usernameCorrect && passwordString.equals(passwords[x])) {
                        // authentication succeeded!!!
                        passwordCorrect = true;
                        succeeded = true;
                        break;
                   } else {
                        // authentication failed -- clean out state
                        succeeded = false;
                        usernameCorrect = false;
                   }// end if/else
              }// end for( int x = 0; x < userNames.length; x++ )
              return succeeded;
         }// end login()
         public boolean commit() throws LoginException {
              System.out.println("COMMIT");
              if (!succeeded) {
                   return false;
              } else {
                   // add a Principal (authenticated identity)
                   // to the Subject
                   // assume the user we authenticated is the SimplePrincipal
                   userPrincipal = new SimplePrincipal(username);
                   if (!subject.getPrincipals().contains(userPrincipal))
                        subject.getPrincipals().add(userPrincipal);
                   // in any case, clean out state
                   username = null;
                   password = null;
                   commitSucceeded = true;
                   return true;
              }// end if( succeeded == false )
         }// end commit()
         public boolean abort() throws LoginException {
              System.out.println("ABORT");
              if (succeeded == false) {
                   return false;
              } else if (succeeded == true && commitSucceeded == false) {
                   // login succeeded but overall authentication failed
                   succeeded = false;
                   username = null;
                   if (password != null)
                        password = null;
                   userPrincipal = null;
              } else {
                   // overall authentication succeeded and commit succeeded,
                   // but someone else's commit failed
                   logout();
              }// end if/else
              return true;
         public boolean logout() throws LoginException {
              System.out.println("LOGOUT");
              subject.getPrincipals().remove(userPrincipal);
              succeeded = false;
              succeeded = commitSucceeded;
              username = null;
              if (password != null)
                   password = null;
              userPrincipal = null;
              return true;
    }I am using Jboss-4.2.3.GA and configured login-config.xml like this:
        <application-policy name="simpleLoginModule">
         <authentication>
          <login-module code="com.security.auth.simpleLoginModule" flag="required">
          </login-module>
         </authentication>
        </application-policy>I have jboss-web.xml also correctly configured.
    The problem is that when i type correct username/password happens the error:
    HTTP Status 403 - Access to the requested resource has been denied
    So can anyone help me? What i have to change/modify in my loginmodule java code?

    Hi,
    no need to change the authschemes.xml file when you don't know if your code works (you can perfectly break logon to other applications when doing so).
    Configure your application to use declarative authentication; this is done in the web.xml of the application:
    http://help.sap.com/SAPhelp_nw70/helpdata/en/08/0f0e4d1ffece4d8b9c5b84793aac50/content.htm
    http://help.sap.com/SAPhelp_nw70/helpdata/en/40/97ffdb74939747b402b0200780cab5/content.htm
    http://help.sap.com/SAPhelp_nw70/helpdata/en/b9/9482887ddb3e47bd1a738c3e900195/content.htm
    example:
         <login-config>
              <auth-method>FORM</auth-method>
              <realm-name>REALM</realm-name>
              <form-login-config>
                   <form-login-page>logon.jsp</form-login-page>
                   <form-error-page>error.jsp</form-error-page>
              </form-login-config>
         </login-config>
    With declarative authentication the AS Java will use the logon modules you confired in the VA for the application.
    br,
    Tobias

  • LMS 3.2 Windows - 10 minute timeout while using TACACS+ Login Module

    Hello,
    we have changed our login module to TACACS+ (Non-ACS). All works fine when we use users which are set up in TACACS+. Using an account which does not exist (or only exists in CiscoWorks Local login module - even as fallback user) we register a timeout of 10 minutes until the login module fails the request (turned on Debugging and watching the stdout.log of tomcat). While running the backup.pl script it seems that the user "admin" tries to access the web server, but as this user is not set up in TACACS+ we have to wait 20 or more minutes until the backup starts. So, is there a way to set a timeout value for that login module?Is it known that the admin account is needed to perform the backup?
    Thanks and kind regards
    Allessandro

    This delay is coming from your TACACS server.  Can you shorten the authentication failure there?  As for the user ID, check your System Identity User under Common Services > Server > Security > System Identity Setup.  Make sure this use exists in the TACACS databases.

  • How to create Jaas Login module !! Urgent

    <b>Hi developers</b>
                        I want to make some changes in logon messages. Right now we are getting only error <b>user authentication failed </b> on the portal even if user is locked or some other reason is there for failed authentiaction. I want proper message should be displaying based on user input. For it I hope its good to <b>create Jaas logon module</b> so that i can modify it accordingly .
    kindly if any one can give me way out , its urgent.
    how to create it step by step. it would be highly appriciable.
    any inputs are appriciated .
    Thanks in advance
    <b>Abhay</b>

    Hi Abhay,
    1.) Every question is "urgent"... Please read https://www.sdn.sap.com/irj/sdn/wiki?path=/display/home/rulesofEngagement - section "Use a Good Subject Line"
    2.) For JAAS Login Modules examples, see https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/4d65ed90-0201-0010-3aba-9209836e8242
    Hope it helps
    Detlev

  • JDEV deployment of web app with custom JAAS login module fails

    For the first time, I am trying to implement a custom JAAS login module.
    JDEV deployment to standalone OC4J only fails when my orion-application.xml is included. The deployment fails with a java.lang.InstantiationException.
    This what I have done:
    1) Wrote a custom LoginModule called com.whirlpoool.sjtc.jaas.gpa.LDAPLoginModule.
    2) Put it and its dependent classes in a jar named sjtcjaas.jar.
    3) Put the jar in $ORACLE_HOME\j2ee\home\lib
    4) Changed library_path in $ORACLE_HOME\j2ee\home\config\application.xml to
    <library path="../../home/lib/scheduler.jar;../../home/lib/sjtcjaas.jar" />
    5) Added an orion-application.xml to the JDEV project. (I used an Oracle How-to as a pattern, see below.)
    I think I'm close but no cigar, yet. Any help would be appreciated.
    Regards,
    Al Malin
    =============== orion-application.xml ========================================
    <?xml version="1.0"?>
    <orion-application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://xmlns.oracle.com/oracleas/schema/orion-application-10_0.xsd" deployment-version="10.1.3.0.0" default-data-source="jdbc/OracleDS" schema-major-version="10" schema-minor-version="0" >
    <security-role-mapping name="sr_manager">
    <group name="managers" />
    </security-role-mapping>
    <security-role-mapping name="sr_developer">
    <group name="developers" />
    </security-role-mapping>
    <log>
    <file path="application.log" />
    </log>
    <!-- Configuring a Login Module in an Application EAR file. -->
    <jazn-loginconfig>
    <application>
    <name>customjaas</name>
    <login-modules>
    <login-module>
    <class>com.whirlpoool.sjtc.jaas.gpa.LDAPLoginModule</class>
    <control-flag>required</control-flag>
    <options>
    <option>
    <name>debug</name>
    <value>true</value>
    </option>
    </options>
    </login-module>
    </login-modules>
    </application>
    </jazn-loginconfig>
    </orion-application>

    Starting OC4J from c:\oc4j\j2ee\home ...
    2006-09-07 13:45:28.484 NOTIFICATION JMS Router is initiating ...
    06/09/07 13:45:29 Oracle Containers for J2EE 10g (10.1.3.0.0) initialized
    2006-09-07 13:45:58.609 NOTIFICATION Application Deployer for aam STARTS.
    2006-09-07 13:45:58.640 NOTIFICATION Copy the archive to C:\oc4j\j2ee\home\applications\aam.ear
    2006-09-07 13:45:58.656 NOTIFICATION Initialize C:\oc4j\j2ee\home\applications\aam.ear begins...
    2006-09-07 13:45:58.656 NOTIFICATION Auto-unpacking C:\oc4j\j2ee\home\applications\aam.ear...
    2006-09-07 13:45:58.687 NOTIFICATION Unpacking aam.ear
    2006-09-07 13:45:58.687 NOTIFICATION Unjar C:\oc4j\j2ee\home\applications\aam.ear in C:\oc4j\j2ee\home\applications\aam
    2006-09-07 13:45:58.750 NOTIFICATION Done unpacking aam.ear
    2006-09-07 13:45:58.750 NOTIFICATION Finished auto-unpacking C:\oc4j\j2ee\home\applications\aam.ear
    2006-09-07 13:45:58.750 NOTIFICATION Auto-unpacking C:\oc4j\j2ee\home\applications\aam\aam.war...
    2006-09-07 13:45:58.750 NOTIFICATION Unpacking aam.war
    2006-09-07 13:45:58.765 NOTIFICATION Unjar C:\oc4j\j2ee\home\applications\aam\aam.war in C:\oc4j\j2ee\home\applications\aam\aam
    2006-09-07 13:45:58.765 NOTIFICATION Done unpacking aam.war
    2006-09-07 13:45:58.765 NOTIFICATION Finished auto-unpacking C:\oc4j\j2ee\home\applications\aam\aam.war
    2006-09-07 13:45:58.812 NOTIFICATION Initialize C:\oc4j\j2ee\home\applications\aam.ear ends...
    2006-09-07 13:45:58.828 NOTIFICATION Starting application : aam
    2006-09-07 13:45:58.828 NOTIFICATION Initializing ClassLoader(s)
    2006-09-07 13:45:58.828 NOTIFICATION Initializing EJB container
    2006-09-07 13:45:58.828 NOTIFICATION Loading connector(s)
    2006-09-07 13:45:58.843 NOTIFICATION application : aam is in failed state
    06/09/07 13:45:58 WARNING: Application.setConfig Application: aam is in failed state as initialization failedjava.lang.InstantiationException
    Sep 7, 2006 1:45:58 PM com.evermind.server.Application setConfig
    WARNING: Application: aam is in failed state as initialization failedjava.lang.InstantiationException
    06/09/07 13:45:58 oracle.oc4j.admin.internal.DeployerException: java.lang.InstantiationException
    06/09/07 13:45:58 at oracle.oc4j.admin.internal.ApplicationDeployer.addApplication(ApplicationDeployer.java:510)
    06/09/07 13:45:58 at oracle.oc4j.admin.internal.ApplicationDeployer.doDeploy(ApplicationDeployer.java:191)
    06/09/07 13:45:58 at oracle.oc4j.admin.internal.DeployerBase.execute(DeployerBase.java:93)
    06/09/07 13:45:58 at oracle.oc4j.admin.jmx.server.mbeans.deploy.OC4JDeployerRunnable.doRun(OC4JDeployerRunnable.java:52)
    06/09/07 13:45:58 at oracle.oc4j.admin.jmx.server.mbeans.deploy.DeployerRunnable.run(DeployerRunnable.java:81)
    06/09/07 13:45:58 at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:814)
    06/09/07 13:45:58 at java.lang.Thread.run(Thread.java:595)
    06/09/07 13:45:58 Caused by: java.lang.InstantiationException
    06/09/07 13:45:58 at com.evermind.server.ApplicationStateRunning.initDataSources(ApplicationStateRunning.java:1424)
    06/09/07 13:45:58 at com.evermind.server.ApplicationStateRunning.initializeApplication(ApplicationStateRunning.java:195)
    06/09/07 13:45:58 at com.evermind.server.Application.setConfig(Application.java:391)
    06/09/07 13:45:58 at com.evermind.server.Application.setConfig(Application.java:308)
    06/09/07 13:45:58 at com.evermind.server.ApplicationServer.addApplication(ApplicationServer.java:1771)
    06/09/07 13:45:58 at oracle.oc4j.admin.internal.ApplicationDeployer.addApplication(ApplicationDeployer.java:507)
    06/09/07 13:45:58 ... 6 more
    2006-09-07 13:45:58.890 NOTIFICATION Application Deployer for aam FAILED.
    2006-09-07 13:45:58.890 NOTIFICATION Application UnDeployer for aam STARTS.
    2006-09-07 13:45:58.906 NOTIFICATION Removing all web binding(s) for application aam from all web site(s)
    2006-09-07 13:45:59.015 NOTIFICATION Application UnDeployer for aam COMPLETES.
    06/09/07 13:45:59 WARNING: DeployerRunnable.run java.lang.InstantiationExceptionoracle.oc4j.admin.internal.DeployerException: java.lang.InstantiationException
    at oracle.oc4j.admin.internal.DeployerBase.execute(DeployerBase.java:126)
    at oracle.oc4j.admin.jmx.server.mbeans.deploy.OC4JDeployerRunnable.doRun(OC4JDeployerRunnable.java:52)
    at oracle.oc4j.admin.jmx.server.mbeans.deploy.DeployerRunnable.run(DeployerRunnable.java:81)
    at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:814)
    at java.lang.Thread.run(Thread.java:595)
    Caused by: java.lang.InstantiationException
    at com.evermind.server.ApplicationStateRunning.initDataSources(ApplicationStateRunning.java:1424)
    at com.evermind.server.ApplicationStateRunning.initializeApplication(ApplicationStateRunning.java:195)
    at com.evermind.server.Application.setConfig(Application.java:391)
    at com.evermind.server.Application.setConfig(Application.java:308)
    at com.evermind.server.ApplicationServer.addApplication(ApplicationServer.java:1771)
    at oracle.oc4j.admin.internal.ApplicationDeployer.addApplication(ApplicationDeployer.java:507)
    at oracle.oc4j.admin.internal.ApplicationDeployer.doDeploy(ApplicationDeployer.java:191)
    at oracle.oc4j.admin.internal.DeployerBase.execute(DeployerBase.java:93)
    ... 4 more
    2006-09-07 13:45:59.031 WARNING java.lang.InstantiationException

  • Portal authentication using two login module stacks?

    G'day,
    I am noticing something odd when I authenticate to the portal: there are two login module stacks used.
    Background: I have created a custom logon page, which is basically a form with username/password input as per [this guide|http://help.sap.com/saphelp_nw04/helpdata/en/62/601e1eebf54ca6a97e2873c8c63517/content.htm|Changing the logon screen]. I then modified the authschemes.xml file by defining a new authscheme "mylogon" that uses my own login module stack ("mystack") and uses the new logon page ("mylogonform"). This new authscheme is then made the default reference:
    <authscheme name="mylogon">
      <authentication-template>mystack</authentication-template>
      <priority>21</priority>
      <frontendtype>2</frontendtype>
      <frontendtarget>com.foo.bar.mylogonpage</frontendtarget>
    </authscheme>
    <authscheme-refs>
      <authscheme-ref name="default"><authscheme>mylogon</authscheme></authscheme-ref>
      <authscheme-ref name="UserAdminScheme"><authscheme>mylogon</authscheme></authscheme-ref>
    </authscheme-refs>
    When I want to access the portal, up pops the "mylogonform" page, and on clicking the "submit" button the portal page for the user is shown.
    Now here is the interesting thing: when the "ticket" login module stack is unchanged (ie. it uses the BasicpasswordLoginModule), then the log shows that authentication to the portal uses just my login module.
    This can be seen as follows, where I navigate to the portal, logon as one user, then logoff and logon as another user:
    Message : LOGIN.OK
    User: tu-1
    Authentication Stack: mystack
    Message : LOGOUT.OK
    User: tu-1
    Authentication Stack: mystack
    Message : LOGIN.OK
    User: Administrator
    Authentication Stack: mystack
    The "mylogonform" page is shown when logon is required in both cases.
    However, if I modify the "ticket" login module stack by replacing the BasicPasswordLogonModule with a custom logon module that does automatic authentication, then the following is observed when the "mylogonform" page is displayed:
    Message : LOGIN.FAILED
    User: N/A
    Authentication Stack: ticket
    Message : LOGIN.OK
    User: tu-1
    Authentication Stack: ticket
    For some reason, the modified "ticket" login module stack is now being executed, which was not the case when this login module stack was unmodified.
    This stack automatically authenticates the current user (the initial failure is because the new login module asks the browser to send authentication data), and this "failure" causes the logon form to be displayed.
    I can logon to the portal as the same user, and the logs show that "mystack" login module stack is used:
    Message : LOGIN.OK
    User: tu-1
    Authentication Stack: mystack
    Logoff shows that "mystack" is used for the actual logoff, but "ticket" is called again automatically and succeeds:
    Message : LOGOUT.OK
    User: tu-1
    Authentication Stack: mystack
    Message : LOGIN.FAILED
    User: N/A
    Authentication Stack: ticket
    Message : LOGIN.OK
    User: tu-1
    Authentication Stack: ticket
    (Again, the initial logon failure is the new login module requesting that the browser send authentication data in the next request).
    This brings up the "mylogonform" page, even though it appears that a user has already been authenticated. If I try to logon as another user, the following is shown:
    Message : LOGIN.FAILED
    User: Administrator
    Authentication Stack: mystack
    Login Module                                                            Flag        Initialize  Login      Commit     Abort      Details
    com.sap.security.core.server.jaas.EvaluateTicketLoginModule             SUFFICIENT  ok          exception  false      true       authscheme not sufficient: basicauthentication<mylogonform
    Central Checks                                                                                exception             Call logout before login.
    I guess one cannot authenticate as a new user until the current user has been logged out.
    So ... why does the "ticket" login module get called in the second case, but not in the first case (or only shows logging in the second case) ?
    What is the logic behind portal authentication and showing a logon page?
    If I want to use custom authentication and a custom logon page, why is the "ticket" stack called at all?

    Jayesh,
    there is no such thing like "login module stacks". The <b>do</b> exist on the other hand:
    - login module
    - logon stacks
    Login module and logon stacks are part of the JAAS concept for defining a complex pluggable authentication scheme, original by SUN (see: java.sun.com/products/jaas)
    A logon process is defined by a logon stack which itself consists of several login modules. Each login module performs an authentication step. Example:
    login module 1: check if valid sap logon ticket provided
    if module 1 fails: then login module 2: request user id/password
    if module 2 succeeds: then login module 3: create new sap logon ticket for user
    You can define multiple logon stacks and configure individual applications to use the one stack or the other.
    The logon stack configuration is done using visual administrator. Here select the security provider service for configuring logon stacks.
    btw: As logon stacks are "java-only", there are no transaction names (which only exist on Web AS ABAP).
    Regards,
    Dominik

  • JAAS Login Module Redirect to Iview

    I am having some difficulty getting a redirect to an Iview to work in our custom JAAS Login Module.  This code works in our current production environment, using Portal version EP6.0 SP2 Patch 35:
    callbacks[0] = new com.sap.security.api.logon.WebCallback();
    HttpServletResponse rsp = ((WebCallback) callbacks[0]).getResponse();
    rsp.sendRedirect(this.changepasswordurl + this.username);  //get url from property
    But this nearly identical code is not working in our development environment, running NetWeaver:
    WebCallback wcb = new WebCallback ();
    this.callbackHandler.handle(new Callback [] {wcb});
    HttpServletResponse rsp = wcb.getResponse();
    myLoc.infoT("URL: " + this.changepasswordurl + this.username);
    rsp.sendRedirect(this.changepasswordurl + this.username); //get url from property
    When the rsp.sendRedirect statement is executed, I get a stack dump:
    #1.5#00306EF4D7AD0048000000550000576000040C5F45EBE199#1139503241315#com.nike.portal.auth.PortalLoginModule#sap.com/irj#com.nike.portal.auth.PortalLoginModule#Guest#192####cd56b800998a11da8f7300306ef4d7ad#SAPEngine_Application_Thread[impl:3]_9##0#0#Info##Plain###URL: https://dev.XXXXX.com/irj/servlet/prt/portal/prtroot/pcd!3aportal_content!2fnikeconnect!2fiviews!2fcommon!2fMyInfo!2f1-com-nike-iv_b2s-change-password?userid=ncportal02@yahoo.com#on!2fMyInfo!2f1-com-nike-iv_b2s-change-password?userid=ncportal02@yahoo.com#
    #1.5#00306EF4D7AD0048000000570000576000040C5F45EC2971#1139503241326#com.sap.engine.services.security#sap.com/irj#com.sap.engine.services.security#Guest#192####cd56b800998a11da8f7300306ef4d7ad#SAPEngine_Application_Thread[impl:3]_9##0#0#Error##Java###Error in some of the login modules.
    [EXCEPTION]
    #1#com.sap.engine.services.security.exceptions.BaseLoginException: Error in some of the login modules.
            at com.sap.engine.services.security.login.ModulesProcessAction.run(ModulesProcessAction.java:149)
            at java.security.AccessController.doPrivileged(Native Method)
            at com.sap.engine.services.security.login.FastLoginContext.login(FastLoginContext.java:153)
            at com.sap.engine.system.SystemLoginModule.login(SystemLoginModule.java:90)
            at sun.reflect.GeneratedMethodAccessor260.invoke(Unknown Source)
            at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
            at java.lang.reflect.Method.invoke(Method.java:324)
    When I cut the exact URL being redirected to from the trace log and paste it into a browser, it goes to the page just fine.
    Can anyone suggest a different method of performing a redirect from withing my JAAS Login Module in NetWeaver?  I'm thinking maybe I'm not getting the response object properly - any ideas?
    Thank you...
    Dave

    Thanks for the pointers.  We were able to get an SAP developer to take a look at this and he coded up this solution, which takes what you suggested and filled in all the blanks.  I am baffled as to how I would have figured this out on my own (like the RESPONSE_CODE value of 302), given the limited documentation around the HttpCallback.  We haven't had the opportunity to try this yet - I'll respond with a new post either way to let you know.  Anyway, here's the code snippet for how to perform a redirect:
    In the custom JAAS Login Module:
    setRedirect(callbackHandler, this.changepasswordurl);
    This is the setRedirect method:
    private void setRedirect(CallbackHandler ch, String redirectURL)
          throws IOException, UnsupportedCallbackException
        HttpSetterCallback setRCodeCB = new HttpSetterCallback();
        setRCodeCB.setType(HttpCallback.RESPONSE_CODE);
        setRCodeCB.setName("Moved Temporarily");
        setRCodeCB.setValue("302");
        HttpSetterCallback setRedirCB = new HttpSetterCallback();
        setRedirCB.setType(HttpCallback.HEADER);
        setRedirCB.setName("Location");
        setRedirCB.setValue(redirectURL);
        Callback[] cbSetter = new Callback[2];
        cbSetter[0] = setRCodeCB;
        cbSetter[1] = setRedirCB;
        ch.handle(cbSetter);

Maybe you are looking for