Custom Login Module Break COTS J2EE Application

I'm using a custom login module to authenticate users of a COTS J2EE application. The authentication works like a charm, but the COTS app breaks because it uses request.getRemoteUser() to obtain the user name for database lookups.
When the custom login is in use, request.getRemoteUser() returns "[JAZNUserAdaptor: user=theuser]" instead of simply the user name (this differs from the standard XML provider, which returns only the user name).
I used the sample login module from the Oracle documentation almost verbatim, the method is included below.
Does anyone know why getRemoteUser() returns "[JAZNUserAdaptor: user=theuser]" and not just the user name? And how to make it stop doing that?
Thanks in advance... any input is is greatly appreciated, of course.
     public boolean login() throws LoginException {
               throw new LoginException("Error: no CallbackHandler available "
                         + "to garner authentication information from the user");
          // Setup default callback handlers.
          Callback[] callbacks = new Callback[] { new NameCallback("Username: "),
                    new PasswordCallback("Password: ", false) };
          try {
               _callbackHandler.handle(callbacks);
          } catch (Exception e) {
               _succeeded = false;
               throw new LoginException(e.getMessage());
          String username = ((NameCallback) callbacks[0]).getName();
          String password = new String(((PasswordCallback) callbacks[1]).getPassword());
          if (isValidUser(username, password)) {
               _succeeded = true;
               _password = password.toCharArray();
               _name = username;
     _authPrincipals = new CMPrincipal[2];
     authPrincipals[0] = new CMPrincipal(name);
     _authPrincipals[1] = new CMPrincipal("SecurityRole");
          ((PasswordCallback) callbacks[1]).clearPassword();
          callbacks[0] = null;
          callbacks[1] = null;
          if (!_succeeded) {
               System.out.println("login did not succeed... throwing LoginException...");
               throw new LoginException("Authentication failed: Password does not match");
          return true;
     }

I know getUserPrincipal().getName() works, but since the J2EE application is a COTS product, I can't change the source code. I'm trying to get the vendor to make that change and release a patch. I was looking for something I might be able to do on my end to get the code to work.
Thanks for the help.

Similar Messages

  • Deploying a custom login module to the J2EE engine

    I have developed a custom login module, and want to deploy it to the SAP j2ee engine. How should I go about this ? I tried packaging it as a jar and then using the deploytool, went into user management to register the module, but when the module was invoked I got an error in the log saying "Cannot load a login module".
    The way I currently deploy it is packaged with the Example Calculator, and this works. I just add my 2 java files into the web module (in com.sap.examples.calculator.beans) and it gets packaged in the war file.
    Can anyone help with the "proper" way of deploying my module ?
    Thanks in advance

    Hi Brad,
    >
    > What I'm actually trying to do is NOT deploy my
    > custom login module with an application. But rather
    > deploy the jar file as a library to the J2EE engine,
    > so that any application can use it by configuring it
    > in their login stacks. I'm still not totally clear
    > whether this is possible or not.
    Once again - It is possible to deploy the login module as a library to the J2EE Engine; furthermore, this is the PREFERRED way to use login modules!
    >
    > What I have currently done:
    >
    > 1. developed custom login module packaged as a jar in
    > NW studio (2 class files)
    >
    > 2. Using deploytool I deploy the jar as a library to
    > the j2ee engine. This works and the library shows up
    > under the libraries section.
    >
    > 3. Register the login module in the user
    > management->manage security stores section. I'm
    > unsure if this works properly. Do I just provide the
    > full path to the required class ? For example
    > "com.example.myloginmodule.LoginModule"
    > I have a suspicion that my error of "cannot load a
    > login module" stems from here.
    >
    > 4. I have then followed your step and added a
    > reference to the libray (Hard reference) and this
    > seems ok.
    >
    Sorry, Brad, I've made a mistake here. You need to set a reference from the Security Provider Service to the library that contains the login module (not from the application). To do that at runtime, you'll have to use the Configuration Adapter service on the J2EE Engine. For a description of the procedure, see this page in the documentation: http://help.sap.com/saphelp_nw04/helpdata/en/dd/1e3a3e5069eb6ce10000000a114084/frameset.htm
    You need to provide additional entry of the following type in the security-provider.xml file:
    <reference type="library" strength="weak">
            Your-library-name-here
          </reference>
    Regards,
    Ivo.
    Message was edited by: Ivaylo Ivanov

  • Login module for the J2EE application

    Hi ,
    I am trying to use the BasicPasswordLoginModule for my J2EE application which will be deployed in the SAP J2EE engine.My application will not be accessed through the portal.
    I am having a login screen in my application for which i want to use the already avaliable login module. ie.. BasicPasswordLoginModule.
    When i am trying to get the login(). i am getting the following the error.
    "javax.security.auth.login.LoginException: No LoginModules configured for BasicPasswordLoginModule".
    Please let me know what needs to be done.
    PS: The version environment is CE 7.1
    Regards
    Abu Bakar

    Hi Julius
    I am totally confused, my application is a pure J2EE application which has only one screen which just displays the details. And i want only the login screen to be implemented. I have gone through a couple of dec from sap which tells to created a custom login module if requiredl but i want to user the FORM based authentication and use the BasicPasswordLoginModule(in-built in WAS)
    All that i am doing is written a web.xml with the following information:
    <login-config>
       <auth-method>FORM</auth-method>
       <form-login-config>
       <form-login-page>/home.jsp</form-login-page>
       <form-error-page>/relogin.jsp</form-error-page>
       </form-login-config>
      </login-config>
      <security-role>
        <role-name>App_Viewer</role-name>
      </security-role>
    web-j2ee-engine with following information:
    <security-role-map>
              <role-name>App_Viewer</role-name>
               <server-role-name>Administrator</server-role-name>
         </security-role-map>
         <login-module-configuration>
         <login-module-stack>
         <!-- Contains all login modules used for authentication -->
              <login-module>
              <!-- Contains information about one login module -->
                   <login-module-name>BasicPasswordLoginModule</login-module-name>
                   <flag>SUFFICIENT</flag>
                   <options>
                        <option>
                        <!-- The option UserNamePrefix determines that the user name must start with "Admin" -->
                        <name>UserNamePrefix</name>
                        <value>Admin</value>
                        </option>
                   </options>
              </login-module>
         </login-module-stack>
         <security-policy-domain></security-policy-domain>
    </login-module-configuration>
    And I am not sure, if the above mentioned details are enough. My implementation code is as follows:
    try {
              HttpServletRequest request = (HttpServletRequest) FacesContext.getCurrentInstance().getExternalContext().getRequest();
              HttpServletResponse response = (HttpServletResponse) FacesContext.getCurrentInstance().getExternalContext().getResponse();
              request.setAttribute(ILoginConstants.LOGON_UID_ALIAS, this.getUserName());
              request.setAttribute(ILoginConstants.LOGON_PWD_ALIAS, this.getPassword());
              UMFactory.getLogonAuthenticator().logon(request, response, "BasicPasswordLoginModule");
              status = success;
         } catch (Exception e) {
              e.printStackTrace();
              status = e.toString();
    In the NWA i have just configured the UserNamePrefix with Admin, thats all . Since the form login authentication method is already configure with the BasicPasswordLoginModule, I left it untouched.
    I also implemented a custom login module and deployed it but not sure how to use it in my code.
    Please let me know if i am in the rite track. Correct me if i am wrong. At the end of the day i want to use the login screen just to get authenticated. I am also not bothered about the password changing etc.. As the users who are going to use my application are the users in the Identity Management. Few portions of my screen should be allowed to be displayed based on the roles.
    PS: My application is not configured in the portal. Its an independent application deployed on the WAS(CE 7.1).
    Please advice
    Regards
    Abu Bakar

  • J2EE 6.40 Custom Login Module - how to config

    hello all,
    i am using WAS J2EE 6.40 Sneak Preview edition. Read all i can find about custom login module, in the forum and the online help. still confused. pls help.
    here is the background info:
    - i am writing a web app. the EAR file contains 5 ejbs, 1 war and bunch of java classes in jars.
    - access to my web app is protected through url pattern (in web.xml), i've defined the same named security role in web.xml and on j2ee engine.
    - my login module does the user name and password checking. both are stored in database through some other means.
    - login is FORM based
    following the discussion in another thread on the topic, i did the following:
    #1 develop my login module code. packaged it in a jar, then sda file. deploy the sda as a llibrary to the engine.
    #2 add my login module to the security store through the security provider service.
    #3 configure my web app to use the custom login module in web-j2ee-engine.xml
    #4 deploy my web app through the ear file
    at this point, in the visual administrator, i can see the library, the custom login module (added to the UME User Store), and also my web app has authentication set to use the custom login module (under policy configurations tab).
    now i try to login to my web app. it correctly complains when i enter non-existent user or wrong password and brings me to the login failed jsp page. but when i enter both correctly (as stored in my database), i get http 403 error code. i know it is 403 because i set that error code to a special jsp page in web.xml.
    question is why? now i create a user on the j2ee engine with the same name as in my user database. then i can login ok. i am confident that my login module is called since i see the println lines in j2ee engine server logs.
    ??? so i must be missing something obvious. is it because my web app is protected through security-role? i even tried removing all such roles, but still same problem.
    ??? or do i completely mis-understand how custom login modules are supposed to work. i thought it means i can authenticate users any way i want without having to use the j2ee engine's user mgmt. pls tell me if i am totally wrong.
    ??? or maybe my login module code is missing some key stmts. how should it tell the j2ee engine that a user is authenticated? in the login() method, it returns true if user name/passwd match. in the commit() method, it adds the principal to the subject. i don't what else is required.
    does anyone have a working scenario using custom login modules?
    thanks very much for your inputs and thoughts.
    wentao

    Hi Astrid,
    I guess I have the same understanding of JAAS as you. I want to deploy an application that internally makes use of JAAS to authenticate users. There is a LoginModule that authenticates users against some database tables containing all the user data and profile. The application was not designed to be deployed to NetWeaver. So it does not make use of UME or some other NetWeaver specific feature. Actually it handles user management and authoroization issues completely on its own. The only reason for having JAAS is to allow customers to plug in their own LoginModule to use some other kind of user store.
    When deploying the web application to a simple servlet engine like Tomcat, all I have to do is to register my LoginModule in the "jaas.conf" file that is parsed by JAAS default implementation. I also tell the JVM where my jaas.conf file is located by appending a "-Djava..." runtime parameter to the JVM startup script.
    When using other application servers like IBM WebSphere things become a bit different. Normally you use the administration GUI of that server to configure your LoginModules. WebSphere for example keeps the login configuration in an internal database rather than writing everything into a "jaas.conf" text file. But the way the application can use the LoginModule is the same as in Tomcat.
    But when it comes to Netweaver, it seems to me that it's not possible to define a LoginModule that your application can use WITHOUT having to couple it tightly to UME. Or did I get something wrong? Initially I've tried to modify the JVM's parameters (using SAP J2EE Config Tool) to include the location of my "jaas.conf" file containing the my login configuration. But that did not work. The parameter was really passed to the JVM but anyway my LoginModule was not found, I guess that NetWeaver has some own implementation of the JAAS interfaces that just ignore the plain text JAAS configuration files (like WebSphere also does).
    The documentation that I have downloaded from SDN doesn't seem to match the 6.4 sneak preview version that I just downloaded some days ago. They say you should deploy your LoginModule as a library and add a refernce to the application. I tried that out but it did not help. The login configuration that the application wants to access is still not found. Actually there seems to be no way to specify the name for a JAAS Login Configuration in NetWeaver. At least I cound not find that in the documentation.
    So basically my question is: is it possible to deploy an application that wants to use some own LoginModule (either deployed separately or together with the application, that does not matter) without making use of Netweaver specific features like UME? The application has its own user management infrastructure and just needs a way to setup a JAAS Login Configuration to access its own LoginModule.
    Thanks in advance
    Henning

  • Custom JAAS login module configuration in Oracle application server

    I have a LDAP login module implementing javax.security.auth.spi.LoginModule. This login module works well with tomcat and weblogic, if I configure the JVM arguments -Djava.security.auth.login.config and -Djava.security.policy to point to the login.conf and access.policy files. The login.conf file has the below content
    FREEWAY_SERV
    com.wipro.freeway.security.LdapLoginModule required debug=true portal=false;
    FREEWAY_PORT
    com.wipro.freeway.security.LdapLoginModule required debug=true portal=true;
    The access.policy file has contains content like below:
    grant Principal com.wipro.freeway.security.RolePrincipal "UserAdministration" {
         permission com.wipro.freeway.security.URLPermission "/createOtherUser.frw";
         permission com.wipro.freeway.security.URLPermission "/createDealer.frw";
    The application uses these login modules by passing Name of the JAAS configuration (FREEWAY_SERV or FREEWAY_PORT).
    I would like to use the same login module and code in Oracle application sever 10.1.3 and I haven't got any success yet. I am not getting how to set these JVM properties and make my application identify this custom login module. I have tried configuring the custom login module via oc4j admin console and I couldn't give a name to my configuration. I also set the system properties for
    -Djava.security.auth.login.config and -Djava.security.policy with no success.
    Could anybody please help me to get this right?
    Thanks in advance.

    Hello,
    In OracleAS 10g R3 (10.1.3.x) you can register your login module in your application (and server) using Enterprise Manager, and config file. That is easier and more flexible that the parameter.
    I would invite you to take a look to the security how-to:
    - 10.1.3 How-tos, and How to integrate a custom login module
    You can also take a look to the 10.1.3 Documentation and the LDAP/Login Module integration.
    - Security guide: Login Modules

  • SOAP Web Service +  Custom Login Module issue

    Hi Guys,
    We faced an authentication issue in our project. Could you please give any advice how the issue could be resolved.
    Environment: A simple SOAP Web Service on top of POJO class created in a Web Application. The web application deployed to the SAP NetWeaver 7.10 Application Server in the Enterprise Application Archive.
    Configuration:
          Single Service Administration Application(NetWeaver Administration -> SOA Management -> Application and Scenario Communication -> Single Service Administration)
           The web service endpoint has authentication configured to use User ID/Password HTTP Authentication.
        Authentication Application(NetWeaver Administration-> Configuration Management->Security->Authentication)
          The application(<vendorName>/<earName>*<vendor>~<webAppName>) has Authentication Stack configured to use our custom login module.
    Issue:  BasicPasswordLoginModule used by the J2EE when we are trying to execute the web service using Web Service Navigator(checked in debug mode). It seems that we missed something in configuration.
    Idea: The main Idea is to use our custom login module when we are executing a web service.
    Could you help me to resolve the issue.
    Thanks,
    Dmitry
    Edited by: Dmitry Eidin on Jul 17, 2009 3:46 PM

    > The web service endpoint has authentication configured to use User ID/Password HTTP Authentication.
    That's the point.

  • Help - using custom login module with embedded jdev oc4j to access ejb 3

    Hi All (Frank ??),
    I'm just wondering if anyone has successfully been able to leverage a custom login module in combination
    with a client that connects to a local EJB 3 stateless session bean through Jdeveloper 10.1.3.2's embedded oc4j.
    I have spent 2+ days trying to get this to work - and i think I resound now to the fact im going to
    have to deploy to oc4j standalone instead.
    I got close.. but finally was trumped with the following error from the client trying to access the ejb:-
    javax.naming.NoPermissionException: Not allowed to look up XXXXXX, check the namespace-access tag
    setting in orion-application.xml for details.
    Using the various guides available, I had no problem getting the custom login module working
    with a local servlet running from JDev's embedded oc4j.. however with ejb - no such luck.
    I have a roles table (possible values Member, Admin) - that maps to sr_Member and sr_Admin
    respectively in various config files.
    I'm using EJB 3 annotations for protecting methods .. for example
    @RolesAllowed("sr_Member")
    Steps that I had to do so far :-
    In <jdevhome>\jdev\system\oracle.jwee.10.1.3.40.66\embedded-oc4j\config\system-jazn-data.xml1) Add custom login module
        <application>
          <name>current-workspace-app</name>
          <login-modules>
            <login-module>
              <class>kr.security.KnowRushLoginModule</class>
              <control-flag>required</control-flag>
              <options>
                <option>
                  <name>dataSource</name>
                  <value>jdbc/DB_XE_KNOWRUSHDS</value>
                </option>
                <option>
                  <name>user.table</name>
                  <value>users</value>
                </option>
                <option>
                  <name>user.pk.column</name>
                  <value>id</value>
                </option>
                <option>
                  <name>user.name.column</name>
                  <value>email_address</value>
                </option>
                <option>
                  <name>user.password.column</name>
                  <value>password</value>
                </option>
                <option>
                  <name>role.table</name>
                  <value>roles</value>
                </option>
                <option>
                  <name>role.to.user.fk.column</name>
                  <value>user_id</value>
                </option>
                <option>
                  <name>role.name.column</name>
                  <value>name</value>
                </option>
              </options>
            </login-module>
          </login-modules>
        </application>2) Grant login rmi permission to roles associated with custom login module (also in system-jazn-data.xml)
      <grant>
        <grantee>
          <principals>
            <principal>
              <realm-name>jazn.com</realm-name>
              <type>role</type>
              <class>kr.security.principals.KRRolePrincipal</class>
              <name>Admin</name>
            </principal>
          </principals>
        </grantee>
        <permissions>
          <permission>
            <class>com.evermind.server.rmi.RMIPermission</class>
            <name>login</name>
          </permission>
        </permissions>
      </grant>
      <grant>
        <grantee>
          <principals>
            <principal>
              <realm-name>jazn.com</realm-name>
              <type>role</type>
              <class>kr.security.principals.KRRolePrincipal</class>
              <name>Member</name>
            </principal>
          </principals>
        </grantee>
        <permissions>
          <permission>
            <class>com.evermind.server.rmi.RMIPermission</class>
            <name>login</name>
          </permission>
        </permissions>
      </grant>3) I've tried creating various oracle and j2ee deployment descriptors (even though ejb-jar.xml and orion-ejb-jar.xml get created automatically when running the session bean in jdev).
    My ejb-jar.xml contains :-
    <?xml version="1.0" encoding="utf-8"?>
    <ejb-jar xmlns ....
      <assembly-descriptor>
        <security-role>
          <role-name>sr_Admin</role-name>
        </security-role>
        <security-role>
          <role-name>sr_Member</role-name>
        </security-role>
      </assembly-descriptor>
    </ejb-jar>Note- i'm not specifying the enterprise-beans stuff, as JDev seems to populate this automatically.
    My orion-ejb-jar.xml contains ...
    <?xml version="1.0" encoding="utf-8"?>
    <orion-ejb-jar ...
      <assembly-descriptor>
        <security-role-mapping name="sr_Admin">
          <group name="Admin"></group>
        </security-role-mapping>
        <security-role-mapping name="sr_Member">
          <group name="Member"></group>
        </security-role-mapping>
        <default-method-access>
          <security-role-mapping name="sr_Member" impliesAll="true">
          </security-role-mapping>
        </default-method-access>
      </assembly-descriptor>My orion-application.xml contains ...
    <?xml version="1.0" encoding="utf-8"?>
    <orion-application xmlns ...
      <security-role-mapping name="sr_Admin">
        <group name="Admin"></group>
      </security-role-mapping>
      <security-role-mapping name="sr_Member">
        <group name="Member"></group>
      </security-role-mapping>
      <jazn provider="XML">
        <property name="role.mapping.dynamic" value="true"></property>
        <property name="custom.loginmodule.provider" value="true"></property>
      </jazn>
      <namespace-access>
        <read-access>
          <namespace-resource root="">
            <security-role-mapping name="sr_Admin">
              <group name="Admin"/>
              <group name="Member"/>
            </security-role-mapping>
          </namespace-resource>
        </read-access>
        <write-access>
          <namespace-resource root="">
            <security-role-mapping name="sr_Admin">
              <group name="Admin"/>
              <group name="Member"/>
            </security-role-mapping>
          </namespace-resource>
        </write-access>
      </namespace-access>
    </orion-application>My essentially auto-generated EJB 3 client does the following :-
          Hashtable env = new Hashtable();
          env.put(Context.SECURITY_PRINCIPAL, "matt.shannon");
          env.put(Context.SECURITY_CREDENTIALS, "welcome1");
          final Context context = new InitialContext(env);
          KRFacade kRFacade = (KRFacade)context.lookup("KRFacade");
    ...And throws the error
    20/04/2007 00:55:37 oracle.j2ee.rmi.RMIMessages
    EXCEPTION_ORIGINATES_FROM_THE_REMOTE_SERVER
    WARNING: Exception returned by remote server: {0}
    javax.naming.NoPermissionException: Not allowed to look
    up KRFacade, check the namespace-access tag setting in
    orion-application.xml for details
         at
    com.evermind.server.rmi.RMIClientConnection.handleLookupRe
    sponse(RMIClientConnection.java:819)
         at
    com.evermind.server.rmi.RMIClientConnection.handleOrmiComm
    andResponse(RMIClientConnection.java:283)
    ....I can see from the console that the user was successfully authenticated :-
    20/04/2007 00:55:37 kr.security.KnowRushLoginModule validate
    WARNING: [KnowRushLoginModule] User matt.shannon authenticated
    And that user is granted both the Admin, and Member roles.
    The test servlet using basic authentication correctly detects the user and roles perfectly...
      public void doGet(HttpServletRequest request,
                        HttpServletResponse response)
        throws ServletException, IOException
        LOGGER.log(Level.INFO,LOGPREFIX +"doGet called");
        response.setContentType(CONTENT_TYPE);
        PrintWriter out = response.getWriter();
        out.println("<html>");
        out.println("<head><title>ExampleServlet</title></head>");
        out.println("<body>");
        out.println("<p>The servlet has received a GET. This is the reply.</p>");
        out.println("<br> getRemoteUser = " + request.getRemoteUser());
        out.println("<br> getUserPrincipal = " + request.getUserPrincipal());
        out.println("<br> isUserInRole('sr_Admin') = "+request.isUserInRole("sr_Admin"));
        out.println("<br> isUserInRole('sr_Memeber') = "+request.isUserInRole("sr_Member"));Anyone got any ideas what could be going wrong?
    cheers
    Matt.
    Message was edited by:
    mshannon

    Thanks for the response. I checked out your blog and tried your suggestions. I'm sure it works well in standalone OC4J, but i was still unable to get it to function correctly from JDeveloper embedded.
    Did you ever get the code working directly from JDeveloper?
    Your custom code essentially seems to be the equivalent of a grant within system-jazn-data.xml.
    For example, the following grant to a custom jaas role (JAAS_ADMIN) that gets added by my custom login module gives them rmi login access :-
         <grant>
              <grantee>
                   <principals>
                        <principal>
                             <realm-name>jazn.com</realm-name>
                             <type>role</type>
                             <class>kr.security.principals.KRRolePrincipal</class>
                             <name>JAAS_Admin</name>
                        </principal>
                   </principals>
              </grantee>
              <permissions>
                   <permission>
                        <class>com.evermind.server.rmi.RMIPermission</class>
                        <name>login</name>
                   </permission>
              </permissions>
         </grant>If I add the following to orion-application.xml
      <!-- Granting login permission to users accessing this EJB. -->
      <namespace-access>
        <read-access>
          <namespace-resource root="">
            <security-role-mapping>
              <group name="JAAS_Admin"></group>
            </security-role-mapping>
          </namespace-resource>
        </read-access>Running a standalone client against the embedded jdev oc4j server gives the namespace-access error.
    I tried out your code by essentially creating a static reference to a singleton class that does the role lookup/provisioning with rmi login grant :-
    From custom login module :-
      private static KRSecurityHelper singleton = new KRSecurityHelper();
      protected Principal[] m_Principals;
        Vector v = new Vector();
          v.add(singleton.getCustomRmiConnectRole());
          // set principals in LoginModule
          m_Principals=(Principal[]) v.toArray(new Principal[v.size()]);
    Singleton class :-
    package kr.security;
    import com.evermind.server.rmi.RMIPermission;
    import java.util.logging.Level;
    import java.util.logging.Logger;
    import oracle.security.jazn.JAZNConfig;
    import oracle.security.jazn.policy.Grantee;
    import oracle.security.jazn.realm.Realm;
    import oracle.security.jazn.realm.RealmManager;
    import oracle.security.jazn.realm.RealmRole;
    import oracle.security.jazn.realm.RoleManager;
    import oracle.security.jazn.policy.JAZNPolicy;
    import oracle.security.jazn.JAZNException;
    public class KRSecurityHelper
      private static final Logger LOGGER = Logger.getLogger("kr.security");
      private static final String LOGPREFIX = "[KRSecurityHelper] ";
      public static String CUSTOM_RMI_CONNECT_ROLE = "remote_connect";
      private RealmRole m_Role = null;
      public KRSecurityHelper()
        LOGGER.log(Level.FINEST,LOGPREFIX +"calling JAZNConfig.getJAZNConfig");
        JAZNConfig jc = JAZNConfig.getJAZNConfig();
        LOGGER.log(Level.FINEST,LOGPREFIX +"calling jc.getRealmManager");
        RealmManager realmMgr = jc.getRealmManager();
        try
          // Get the default realm .. e.g. jazn.com
          LOGGER.log(Level.FINEST,LOGPREFIX +"calling jc.getGetDefaultRealm");
          Realm r = realmMgr.getRealm(jc.getDefaultRealm());
          LOGGER.log(Level.INFO,LOGPREFIX +"default realm: "+r.getName());
          // Access the role manager for the remote connection role
          LOGGER.log(Level.FINEST,
            LOGPREFIX +"calling default_realm.getRoleManager");
          RoleManager roleMgr = r.getRoleManager();
          LOGGER.log(Level.INFO,LOGPREFIX +"looking up custom role '"
            CUSTOM_RMI_CONNECT_ROLE "'");
          RealmRole rmiConnectRole = roleMgr.getRole(CUSTOM_RMI_CONNECT_ROLE);
          if (rmiConnectRole == null)
            LOGGER.log(Level.INFO,LOGPREFIX +"role does not exist, create it...");
            rmiConnectRole = roleMgr.createRole(CUSTOM_RMI_CONNECT_ROLE);
            LOGGER.log(Level.FINEST,LOGPREFIX +"constructing new grantee");
            Grantee gtee = new Grantee(rmiConnectRole);
            LOGGER.log(Level.FINEST,LOGPREFIX +"constructing login rmi permission");
            RMIPermission login = new RMIPermission("login");
            LOGGER.log(Level.FINEST,
              LOGPREFIX +"constructing subject.propagation rmi permission");
            RMIPermission subjectprop = new RMIPermission("subject.propagation");
            // make policy changes
            LOGGER.log(Level.FINEST,LOGPREFIX +"calling jc.getPolicy");
            JAZNPolicy policy = jc.getPolicy();
            if (policy != null)
              LOGGER.log(Level.INFO, LOGPREFIX
                + "add to policy grant for RMI 'login' permission to "
                + CUSTOM_RMI_CONNECT_ROLE);
              policy.grant(gtee, login);
              LOGGER.log(Level.INFO, LOGPREFIX
                + "add to policy grant for RMI 'subject.propagation' permission to "
                + CUSTOM_RMI_CONNECT_ROLE);
              policy.grant(gtee, subjectprop);
              // m_Role = rmiConnectRole;
              m_Role = roleMgr.getRole(CUSTOM_RMI_CONNECT_ROLE);
              LOGGER.log(Level.INFO, LOGPREFIX
                + m_Role.getName() + ":" + m_Role.getFullName() + ":" + m_Role.getFullName());
            else
              LOGGER.log(Level.WARNING,LOGPREFIX +"Cannot find jazn policy!");
          else
            LOGGER.log(Level.INFO,LOGPREFIX +"custom role already exists");
            m_Role = rmiConnectRole;
        catch (JAZNException e)
          LOGGER.log(Level.WARNING,
            LOGPREFIX +"Cannot configure JAZN for remote connections");
      public RealmRole getCustomRmiConnectRole()
        return m_Role;
    }Using the code approach and switching application.xml across so that namespace access is for the group remote_connect, I get the following error from my bean :-
    INFO: Login permission not granted for current-workspace-app (test.user)
    Thus, the login permission that I'm adding through the custom remote_connect role does not seem to work. Even if it did, i'm pretty sure I would still get that namespace error.
    This has been such a frustrating process. All the custom login module samples using embedded JDeveloper show simple j2ee servlet protection based on settings in web.xml.
    There are no samples showing jdeveloper embedded oc4j using ejb with custom login modules.
    Hopefully the oc4j jdev gurus like Frank can write a paper that demonstrates this.
    Matt.

  • How to call custom Login Module from JSP

    Hi,
    I am stuck with the following issue:
    1) Exactly as presented in help.sap.com (http://help.sap.com/saphelp_nw04/helpdata/en/3f/1be040e136742ae10000000a155106/content.htm) I created custom login module and deployed it as a library on J2EE server. When I configured it to be used for my applications in the Security provider but I am getting "No user name provided" exception everytime when my applications use this custom login module.
    2) I realized that I would need to call my custom module somewhere within my application (simple JSP) using LoginContext class and then use MyLoginContext.login() spec to initiate login process. But I am not able to pass CallbackHandler parameters from JSP application to my custom login module.
    So I have the following questions:
    1. Can I pass parameters using LoginContext and CallbackHandler from JSP to my custom login module (created as exact copy of HELP.SAP.COM example) or this module cannot be used this way.
    2. How to pass CallbackHandler correctly to my custom login module from JSP. When I am trying to use CallbackHandler, I am getting "Abstract Class cannot be called" error.
    I'd appreciate any little help on this matter.
    Thanks and regards,
    Mike

    You have two alternatives to do this:
    You can declare your JSP as a protected resource with the use of the deployment descriptors of the application (web.xml) and add the custom login module in the authentication stack of the application. This way, you will use container-based authentication, i.e. the Web Container will enforce the authentication and it will call the custom login module before it dispatches to the JSP. I recommend you this approach because it requires less coding and it makes the whole thing a matter of configuration. The configuration can be later on enhanced or changed runtime without the need to re-build and re-deploy the application. If you choose this approach you can go to the documentation of the server for help on how to modify the login module stack of the application.
    You can also use programmatic authentication by using JAAS API. To do this you need to create a custom security policy configuration with login module stack containing the custom login module, and then use the standard JAAS mechanism - new LoginContext(<configuration>, <callback-handler>).login(). This approach requires that you write your own callback handler and handle any LoginException.
    Let us know which approach you prefer and whether you have difficulties implementing it!

  • Custom pluggable idm with custom login module

    Hello All. I've developed a custom implementation of the pluggable identity management framework as explained in chapter 13 of the book "Oracle® Containers for J2EE Security Guide10g (10.1.3.1.0)". I have OAS 10.1.3.1.0.
    Everything works fine except when the identity is validated with in the tokenAsserter. The process is supposed to continue with the login method implemented in my custom login module but instead the default oracle implementation (RealmLoginModule) is being executed.
    The application is a servlet and is configured to use a custom loginModule. If I don't use de custom auth method (auth-method="CUSTOM_AUTH" in orion-application) my loginModule is called but when I plug it to my custom idm implementation it doesn't.
    The custom idm is packed in to a jar containing the idm and the login module. The jar is deployed to the <ORACLE_HOME>/ext/lib directory.
    Any suggestions? Thanks

    Thanks for your answer, it really helps. I had already cheeked all that stuff and it was correct, but knowing that another person had made it worked the same way I was doing it, made me think I was doing it right and the problem may simpler. It really was. OC4J was really calling my login module all the time but it was getting a runtime exception, a very simple one, that was making OC4J to propagate the authentication to the default login module (RealmLoginModule), and that was the error I was watching in the logs that had me all confused.
    I will start another thread though about stolen cookie in a SSO solution that I’m developing with this implementation.
    Thank you.

  • Custom Login Module, SSO Ticket validity & Login Module Stack

    Hi everybody,
    we have a portal (running on jboss) which links to a J2EE web application (running on SAP WAS 6.40) which itself is protected by a custom login module and redirects to different WebDynpro applications (running on same WAS as the J2EE app) depending on some parameters.
    So when we go from the portal to the J2EE web application, the custom login module authenticates the user, creates a MYSAPSSO2 Cookie and then redirects to a webdynpro app.
    What happens is that the webdynpro app doesn't accept the cookie and redirects to the login mask.
    Looking at the request header parameter HOST we have the request coming from sub1.sub2.mycompany.com, which is the portal.
    The WAS is located on sub3.mycompany.com.
    If we manipulate the HOST parameter to sub2.mycompany.com everything works fine and the webdynpro app successfully authenticates the user.
    This does sound either like a domain relaxing issue or a multi domain issue, which we added as parameters to the CreateTicketLoginModule in the Login Module Stack for the J2EE web app.
    Unfortunately without result.
    Did anybody have a similar problem and can give some hints on how to solve this?
    Any help is appreciated
    Regards,
    md
    Edited by: Minh-Duc Truong on Jul 17, 2008 7:18 PM
    Edited by: Minh-Duc Truong on Jul 17, 2008 7:19 PM
    Edited by: Julius Bussche on Jul 18, 2008 7:25 PM

    Hi md,
    I have split your 2nd question into a seperate thread => That would make them easier to answer as well, which will help.
    You can find it here: Custom Login Module, LM Stack ignored
    Cheers,
    Julius
    Edited by: Julius Bussche on Jul 18, 2008 7:26 PM

  • Custom login module with 10.1.3

    Hello all,
    I've been trying out Frank N's custom login module (http://www.oracle.com/technology/products/jdev/howtos/10g/jaassec/index.htm) with JDev 10.1.3/OC4J 10.1.3 and am not having much luck.
    Whenever I add <property name="role.mapping.dynamic" value="true"/> to orion-application.xml, the application fails to deploy with java.lang.InstantiationException. I even get this error when I try to set up a custom login module using the enterprise manager for OC4J 10.1.3. Is this a bug, or does the doc need to be updated? Without this item configured, I do get the basic login prompt, but no logging or anything - which indicates to me that the custom login module is not even being called. Nothing on metalink either.
    Thanks,
    John

    hmm i dont know... custom login module (db authentication) definitely works with standalone 10.1.3.0.0 and jdevloper standalone, but it doesnt work with jdev embeded oc4j (jdevstudio1013\jdev\system\oracle.j2ee.10.1.3.36.73\embedded-oc4j)
    i have the code, and it works.. however the application is entirerly made in jdev 10.1.3.04 production, it is not migrated from previous jdev.. make sure to deploy from war file (i have prob to deploy from ear)
    the only big problem i got is to setup ssl in separate oc4j standalone (ssl works with jdev standalone) and make client athentication to work
    because it wont run as it should.. (i did not have this prob in 10.1.2.1)

  • Custom Login Module, LM Stack ignored

    Moderator's note: This is a question split from another thread:
    Maybe someone with LoginModuleStack knowledge can give us a hand
    Another issue (which is isolated from the other question) we have is that somehow the defined Login Module Stack for the J2EE app
    doesn't get called when there exits already a MYSAPSSO2 cookie in the session.
    The Login Module Stack looks like this:
    Custom Login Module Position 1 Required (also tested with optional & requisite)
    CreateTicketLoginModule Position 2 Sufficient (also tested with optional)
    So if we call the J2EE web app with no existing MYSAPSSO2 cookie (e.g. open in new browser window), everything
    works fine and the defined login module stack is run through.
    If we call the app with existing MYSAPSSO2 cookie (e.g. open in same browser window after logout of previous app),
    the login module stack is ignored and it seems that the EvaluateTicketLoginModule is called straight away, despite not being defined in the stack.
    What could be the problem and how can this be solved?
    Signed with greetings and a happy weekend on behalf of Minh-Duc Truong,
    Your,
    Julius
    Edited by: Minh-Duc Truong on Jul 18, 2008 4:52 PM
    Edited by: Julius Bussche on Jul 18, 2008 7:29 PM

    Hi,
    I cannot believe that the EvaluateTicketLoginModule is called if it is not defined in the stack. I guess the best way to track down the problem is to increase the severity of the following locations:
    (use Visual Admin / Log Configurator / Locations TAB to do that):
    com.sap.security.server.jaas
    com.sap.engine.services.security
    Set the Severity to ALL. After that call your application and paste the output in security.log here so I can have a look at it. It will contain a complete trace of the processing of your login modules so maybe we'll see what's going wrong.
    Cheers

  • Custom login module error: Login permission not granted for myapp (myuser)

    I have developed a custom login module for my application. I have followed the steps outlined in security guide and other postings. I could not log into the application when I access EJBs from an RMI client. I get the following error.
    Login permission not granted for myapp (myuser)
    I did grant the login permission to myuser.
    I am using OC4J 10.1.3.1.0
    Here are the steps I followed and the configuration files. Can anybody help me out?
    1. Created a custom login module and packaged it in EAR along with other classes. In the commit method, I added my user into principals of subject. Here is the code,
    ==================================================================
    public boolean commit() throws LoginException {
    try {
    if (!loginOk) {
    return false;
    Set<Principal> principals = subject.getPrincipals();
    principals.add(user);
    loginOk = true;
    } finally {
    // Some audit logs are written here.
    return loginOk;
    ===============================================================
    2. Added custom login module in orion-application.xml. Here are the relevant portions of orion-application.xml
    ===============================================================
    <jazn provider="XML">
    <property name="role.mapping.dynamic" value="true" />
    <property name="custom.loginmodule.provider" value="true" />
    <property name="role.compare.ignorecase" value="true" />
    </jazn>
    <jazn-loginconfig>
    <application>
    <name>myApp</name>
    <login-modules>
    <login-module>
    <class>com.test.myServerLoginModule</class>
    <control-flag>required</control-flag>
    <options>
    <option>
    <name>maxRetries</name>
    <value>3</value>
    </option>
    <option>
    <name>debug</name>
    <value>true</value>
    </option>
    </options>
    </login-module>
    </login-modules>
    </application>
    </jazn-loginconfig>
    <namespace-access>
    <read-access>
    <namespace-resource root="">
    <security-role-mapping name="myUser">
    <group name="users"/>
    <group name="oc4j-app-administrators"/>
    </security-role-mapping>
    <security-role-mapping name="esp_operator">
    <group name="users"/>
    <group name="oc4j-app-administrators"/>
    </security-role-mapping>
    </namespace-resource>
    </read-access>
    </namespace-access>
    ===============================================================
    3. After the application is deployed on the EAR, I can see the custom login module in system-jazn-data.xml. The command line jazn admin tool lists my custom login module for my application.
    4. I have an RMI client, the client JNDI properties are
    ==============================================================
    java.naming.factory.initial=oracle.j2ee.naming.ApplicationClientInitialContextFactory
    java.naming.factory.url.pkgs=oracle.j2ee.naming
    ==============================================================
    The value for java.naming.provider.url is constructed dynamically and it is ormi://myserver:23791/myapp
    java.naming.security.principal is set to the user who is trying to login, myuser, in this case.
    java.naming.security.credentials is set to the password entered by myuser, password in this case.
    5. I used jazn admin tool to grant login permission to my user.
    ===============================================================
    a. Added user
    java -jar jazn.jar -user oc4jadmin -password welcome -adduser jazn.com myuser password
    b. Grant roles
    java -jar jazn.jar -user oc4jadmin -password welcome -grantrole users ja
    zn.com myuser
    java -jar jazn.jar -user oc4jadmin -password welcome -grantrole oc4j-app
    -administrators jazn.com myuser
    c. Grant RMI permission
    java -jar jazn.jar -user oc4jadmin -password welcome -grantperm jazn.com
    -user myuser com.evermind.server.rmi.RMIPermission login
    ===============================================================
    After the permission is granted, the folowing piece of XML is added to system-jazn-data.xml.
    ===============================================================
         <grant>
              <grantee>
                   <principals>
                        <principal>
                             <realm-name>jazn.com</realm-name>
                             <type>user</type>
                             <class>oracle.security.jazn.spi.xml.XMLRealmUser</class>
                             <name>jazn.com/esp_administrator</name>
                        </principal>
                   </principals>
              </grantee>
              <permissions>
                   <permission>
                        <class>com.evermind.server.rmi.RMIPermission</class>
                        <name>login</name>
                   </permission>
              </permissions>
         </grant>
    ==============================================================
    My principal class is not of type, oracle.security.jazn.spi.xml.XMLRealmUser. Hence, I changed system-jazn-data.xml to include com.test.MyUser instead of oracle.security.jazn.spi.xml.XMLRealmUser. Either way, I get Not Authorized and Login permission not granted for myapp (myuser).
    Can anybody help me out, please?
    Thank you,
    Sri
    Message was edited by:
    user532586

    I finally got it to work. But I have a problem granting RMI Permission "login", if the depth of my Principal class within the inheritance hierarachy is more than one. My hierarachy of my principal class is
    Object --> ObjectA --> ObjectB --> ObjectC --> ObjectD
    ObjectD is my principal class. ObjectB implements java.security.Principal. ObjectA has implementations for methods equals, hashcode and toString. ObjectB has implementations for getName.
    When I try to grant RMI permission for ObjectD, I get an error that says null.
    If I override the methods, equals, hashcode, toString, and getName in ObjectD and provide implementations, I still could not grant permission using jazn tool. I get error that says null. If I update the system-jazn-data.xml with the following grant tag, I could get into the application without any errors.
         <grant>
              <grantee>
                   <principals>
                        <principal>
                             <class>com.test.ObjectD</class>
                             <name>developers</name>
                        </principal>
                   </principals>
              </grantee>
              <permissions>
                   <permission>
                        <class>com.evermind.server.rmi.RMIPermission</class>
                        <name>login</name>
                   </permission>
              </permissions>
         </grant>
    If I create a new class, myPrincipal that implements java.security.Principal, I donot have any problems. I can grant permission and access application.
    Any ideas why I could not use ObjectD as my principal class for granting RMI permission?
    Message was edited by:
    user532586

  • JAAS Custom Login Modules does not run on JDev/OC4J 10.1.3, pls help...

    Hi all,
    I trying to use Custom Login Modules as described on :
    http://www.oracle.com/technology/products/jdev/howtos/10g/jaassec/index.htm
    I open the DBLMTest.jws in JDeveloper 10.1.3.1, after completing the required steps, I try deploy it into OC4J Stand alone 10.1.3.
    I get ERROR :
    application : foo is in failed state
    Operation failed with error:
    java.lang.InstantiationException
    The cause of the error is the two lines below that I add into orion-application.xml :
    <property name="role.mapping.dynamic" value="true"/>
    <property name="jaas.username.simple" value ="true" />
    If I remove the two lines, it deploys succesfully.
    Please helpp... I have to implement security in our apps very soon....
    Thank you very much,
    xtanto
    The complete trace of deployment error :
    ---- Deployment started. ---- Apr 4, 2007 5:25:19 PM
    Target platform is Standalone OC4J 10g 10.1.3 (oc4j_oracle).
    Wrote WAR file to D:\_JDEV1013.APPs\jaasdatabaseloginmodule\JDeveloper1012Workspaces\DBLMTest\Project\deploy\DBLMTest.war
    Wrote EAR file to D:\_JDEV1013.APPs\jaasdatabaseloginmodule\JDeveloper1012Workspaces\DBLMTest\Project\deploy\DBLMTest.ear
    Uploading file foo.ear ...
    Uploading file foo.ear ...
    Application Deployer for foo STARTS.
    Copy the archive to C:\OC4J\j2ee\home\applications\foo.ear
    Initialize C:\OC4J\j2ee\home\applications\foo.ear begins...
    Unpacking foo.ear
    Done unpacking foo.ear
    Unpacking DBLMTest.war
    Done unpacking DBLMTest.war
    Initialize C:\OC4J\j2ee\home\applications\foo.ear ends...
    Starting application : foo
    Initializing ClassLoader(s)
    Initializing EJB container
    Loading connector(s)
    application : foo is in failed state
    Operation failed with error:
    java.lang.InstantiationException
    Deployment failed
    Elapsed time for deployment: 4 seconds

    Hello there again xtanto,
    I blogged about this last year - perhaps you could run over to http://stegemanoracle.blogspot.com and have a look. I'd send you the exact link, but I cannot access blogspot from work.
    John

  • Help with custom login module

    i've been following franks' tutorial on how to use a custom login module. but no matter what i do, i cant get the jsp to authenticate my valid database account.
    jazn-data.xml file
    <!-- JAZN Realm Data -->
    <name>scott</name>
    <credentials>!tiger</credentials>
    <jazn-loginconfig>
    <application>
    <name>foo</name>
    <login-modules>
    <login-module>
    <class>oracle.sample.dbloginmodule.DBTableLM.DBSystemLoginModule</class>
    <control-flag>required</control-flag>
    <options>
    <option>
    <name>debug</name>
    <value>true</value>
    </option>
    <option>
    <name>jdbcUrl</name>
    <value>jdbc:oracle:thin:@localhost:1521:orcl</value>
    </option>
    <option>
    <name>log_level</name>
    <value>ALL</value>
    </option>
    </options>
    </login-module>
    </login-modules>
    </application>
    </jazn-loginconfig>
    </jazn-data>
    orion-application.xml
    <jazn provider="XML" location="jazn-data.xml"      
    default-realm="jazn.com">
    <property name="role.mapping.dynamic" value="true"/>
    <property name="jaas.username.simple" value ="true" />
    </jazn>
    is there anything wrong with the settings?I've followed the tutorial to the last step. yet i cant get anything. Please help!

    Sorry about the incomplete previous post:
    I am trying to do the authentication using a customized login module in a stand alone OC4J server. I put some debug statements and found out that the authentication works but fails to authorize. I get the following error:
    NOTIFICATION J2EE RMI-00005 Login permission not granted for myApp (testUser)
    The only way I have been able to get this to work is to add the user 'testUser' in system-jazn-data.xml and specify that 'testUser' has the role 'USERS'. It's not practically possible to specify all the users in system-jazn-data.xml. Is there a workaround this? I have pasted below snippets of orion-application.xml and system-jazn-data.xml. Any help is greatly appreciated. Thanks in advance
    I have specified the following in orion-application.xml
    <namespace-access>
    <read-access>
    <namespace-resource root="">
    <security-role-mapping>
    <group name="USERS"/>
    </security-role-mapping>
    </namespace-resource>
    </read-access>
    <write-access>
    <namespace-resource root="">
    <security-role-mapping>
    <group name="USERS"/>
    </security-role-mapping>
    </namespace-resource>
    </write-access>
    </namespace-access>
    </orion-application>
    In system-jazn-data.xml I have given permission for the role 'USERS' to login.
    <grant>
    <grantee>
    <principals>
    <principal>
    <realm-name>jazn.com</realm-name>
    <type>role</type>
    <class>oracle.security.jazn.spi.xml.XMLRealmRole</class>
    <name>jazn.com/USERS</name>
    </principal>
    </principals>
    </grantee>
    <permissions>
    <permission>
    <class>com.evermind.server.rmi.RMIPermission</class>
    <name>login</name>
    </permission>
    </permissions>
    </grant>

Maybe you are looking for