Custom Login Module, LM Stack ignored

Moderator's note: This is a question split from another thread:
Maybe someone with LoginModuleStack knowledge can give us a hand
Another issue (which is isolated from the other question) we have is that somehow the defined Login Module Stack for the J2EE app
doesn't get called when there exits already a MYSAPSSO2 cookie in the session.
The Login Module Stack looks like this:
Custom Login Module Position 1 Required (also tested with optional & requisite)
CreateTicketLoginModule Position 2 Sufficient (also tested with optional)
So if we call the J2EE web app with no existing MYSAPSSO2 cookie (e.g. open in new browser window), everything
works fine and the defined login module stack is run through.
If we call the app with existing MYSAPSSO2 cookie (e.g. open in same browser window after logout of previous app),
the login module stack is ignored and it seems that the EvaluateTicketLoginModule is called straight away, despite not being defined in the stack.
What could be the problem and how can this be solved?
Signed with greetings and a happy weekend on behalf of Minh-Duc Truong,
Your,
Julius
Edited by: Minh-Duc Truong on Jul 18, 2008 4:52 PM
Edited by: Julius Bussche on Jul 18, 2008 7:29 PM

Hi,
I cannot believe that the EvaluateTicketLoginModule is called if it is not defined in the stack. I guess the best way to track down the problem is to increase the severity of the following locations:
(use Visual Admin / Log Configurator / Locations TAB to do that):
com.sap.security.server.jaas
com.sap.engine.services.security
Set the Severity to ALL. After that call your application and paste the output in security.log here so I can have a look at it. It will contain a complete trace of the processing of your login modules so maybe we'll see what's going wrong.
Cheers

Similar Messages

  • Custom Login Module, SSO Ticket validity & Login Module Stack

    Hi everybody,
    we have a portal (running on jboss) which links to a J2EE web application (running on SAP WAS 6.40) which itself is protected by a custom login module and redirects to different WebDynpro applications (running on same WAS as the J2EE app) depending on some parameters.
    So when we go from the portal to the J2EE web application, the custom login module authenticates the user, creates a MYSAPSSO2 Cookie and then redirects to a webdynpro app.
    What happens is that the webdynpro app doesn't accept the cookie and redirects to the login mask.
    Looking at the request header parameter HOST we have the request coming from sub1.sub2.mycompany.com, which is the portal.
    The WAS is located on sub3.mycompany.com.
    If we manipulate the HOST parameter to sub2.mycompany.com everything works fine and the webdynpro app successfully authenticates the user.
    This does sound either like a domain relaxing issue or a multi domain issue, which we added as parameters to the CreateTicketLoginModule in the Login Module Stack for the J2EE web app.
    Unfortunately without result.
    Did anybody have a similar problem and can give some hints on how to solve this?
    Any help is appreciated
    Regards,
    md
    Edited by: Minh-Duc Truong on Jul 17, 2008 7:18 PM
    Edited by: Minh-Duc Truong on Jul 17, 2008 7:19 PM
    Edited by: Julius Bussche on Jul 18, 2008 7:25 PM

    Hi md,
    I have split your 2nd question into a seperate thread => That would make them easier to answer as well, which will help.
    You can find it here: Custom Login Module, LM Stack ignored
    Cheers,
    Julius
    Edited by: Julius Bussche on Jul 18, 2008 7:26 PM

  • Custom Login Module - all modules ignored

    Hello,
    we created a custom login module and deployed it as library to the server. We than configured the login module as described in the SAP manual:
    http://help.sap.com/saphelp_nw70/helpdata/en/46/3ce9402f3f8031e10000000a1550b0/frameset.htm
    First we had a little problem with the library path. The security log has a nice overview what login stack and what modules where called, for our module it stated u201CCannot load login module class u2026.u201D
    After reading the forum, we found that our login module path was wrong, we only added the class name as described in the tutorial. Correct was to use the library name from Visual Admin.
    But now, if we call the portal, the security log is just empty. It seems no stack and no module is called at all. If we remove our custom module from the ticket stack, everything is fine and we get an entry in the security log with the ticket stack and all remaining modules.
    If we add the custom login module to the stack again and enter username and password we get an error message that all modules are ignored.
    Does anybody know this error and maybe what to do?
    Best regards,
    Kai

    Hi Kai,
    have you solved your problem?
    Currently we are facing a similar Problem.
    We have a custom login module. I deployed everything like in the tutorial. There should be no Problem with the login module itself, as it is an exact copy of a working one. Class names are the same. The only difference is in package names, project names, library names. I adjusted the classloader to the new library and also adjusted the classname in the user store where the login module is configured.The login module is part of the "ticket" authentication stack.
    When we want to log on to the portal, we get an error like "all modules ignored".
    Maybe you have found a solution which is also suitable for our problem.
    Thanks
    Regards
    Pascal

  • SOAP Web Service +  Custom Login Module issue

    Hi Guys,
    We faced an authentication issue in our project. Could you please give any advice how the issue could be resolved.
    Environment: A simple SOAP Web Service on top of POJO class created in a Web Application. The web application deployed to the SAP NetWeaver 7.10 Application Server in the Enterprise Application Archive.
    Configuration:
          Single Service Administration Application(NetWeaver Administration -> SOA Management -> Application and Scenario Communication -> Single Service Administration)
           The web service endpoint has authentication configured to use User ID/Password HTTP Authentication.
        Authentication Application(NetWeaver Administration-> Configuration Management->Security->Authentication)
          The application(<vendorName>/<earName>*<vendor>~<webAppName>) has Authentication Stack configured to use our custom login module.
    Issue:  BasicPasswordLoginModule used by the J2EE when we are trying to execute the web service using Web Service Navigator(checked in debug mode). It seems that we missed something in configuration.
    Idea: The main Idea is to use our custom login module when we are executing a web service.
    Could you help me to resolve the issue.
    Thanks,
    Dmitry
    Edited by: Dmitry Eidin on Jul 17, 2009 3:46 PM

    > The web service endpoint has authentication configured to use User ID/Password HTTP Authentication.
    That's the point.

  • RFC Call in a custom login module

    Hi All,
    What is the best way to call a RFC/BAPI from a Custom Login Module, part of the login stacks?
    I want to avoid using JCo Client Service, do not want to hard code the connection values in the class.
    Have anyone of you come across such a situation?
    Can the custom login module access the Portal Runtime resources, like the Connector Gateway Service/Destination Service?
    Or it just runs inside the j2EE container?
    Thanks for your help
    Aakash
    Edited by: Aakash Jain on Nov 24, 2008 11:42 PM

    Hi All,
    What is the best way to call a RFC/BAPI from a Custom Login Module, part of the login stacks?
    I want to avoid using JCo Client Service, do not want to hard code the connection values in the class.
    Have anyone of you come across such a situation?
    Can the custom login module access the Portal Runtime resources, like the Connector Gateway Service/Destination Service?
    Or it just runs inside the j2EE container?
    Thanks for your help
    Aakash
    Edited by: Aakash Jain on Nov 24, 2008 11:42 PM

  • How to call custom Login Module from JSP

    Hi,
    I am stuck with the following issue:
    1) Exactly as presented in help.sap.com (http://help.sap.com/saphelp_nw04/helpdata/en/3f/1be040e136742ae10000000a155106/content.htm) I created custom login module and deployed it as a library on J2EE server. When I configured it to be used for my applications in the Security provider but I am getting "No user name provided" exception everytime when my applications use this custom login module.
    2) I realized that I would need to call my custom module somewhere within my application (simple JSP) using LoginContext class and then use MyLoginContext.login() spec to initiate login process. But I am not able to pass CallbackHandler parameters from JSP application to my custom login module.
    So I have the following questions:
    1. Can I pass parameters using LoginContext and CallbackHandler from JSP to my custom login module (created as exact copy of HELP.SAP.COM example) or this module cannot be used this way.
    2. How to pass CallbackHandler correctly to my custom login module from JSP. When I am trying to use CallbackHandler, I am getting "Abstract Class cannot be called" error.
    I'd appreciate any little help on this matter.
    Thanks and regards,
    Mike

    You have two alternatives to do this:
    You can declare your JSP as a protected resource with the use of the deployment descriptors of the application (web.xml) and add the custom login module in the authentication stack of the application. This way, you will use container-based authentication, i.e. the Web Container will enforce the authentication and it will call the custom login module before it dispatches to the JSP. I recommend you this approach because it requires less coding and it makes the whole thing a matter of configuration. The configuration can be later on enhanced or changed runtime without the need to re-build and re-deploy the application. If you choose this approach you can go to the documentation of the server for help on how to modify the login module stack of the application.
    You can also use programmatic authentication by using JAAS API. To do this you need to create a custom security policy configuration with login module stack containing the custom login module, and then use the standard JAAS mechanism - new LoginContext(<configuration>, <callback-handler>).login(). This approach requires that you write your own callback handler and handle any LoginException.
    Let us know which approach you prefer and whether you have difficulties implementing it!

  • Custom Login Module - Commit Method return TRUE always?

    Hi,
    I am creating a custom login module for my portal authentication.
    For the login module, should the commit() method always return TRUE?
    The example code on help.sap.com indicates yes to this question.
    However, the JAVA Sun standard indicates that commit should return FALSE if the preceding login method returned FALSE.
    Does the SAP example stray from the SUN standard?  How should I code the commit() method such that it works (Always TRUE, or follow lead of login() method)?
    Regards,
    Kevin

    Hi Kevin,
    I'm actually working with this document: <a href="https://www.sdn.sap.comhttp://www.sdn.sap.comhttp://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.docs/library/events/webinars/jaas%20login%20module%20development%20on%20webas%20java%20640.pdf#search=%22classloader%20sda%20jar%20reference%22">JAAS Login Modules</a>.
    There is also example code. If it should be ignored they return false, otherwise true (page 32).
    Regards,
    Marcus
    Message was edited by: Marcus Freiheit

  • J2EE 6.40 Custom Login Module - how to config

    hello all,
    i am using WAS J2EE 6.40 Sneak Preview edition. Read all i can find about custom login module, in the forum and the online help. still confused. pls help.
    here is the background info:
    - i am writing a web app. the EAR file contains 5 ejbs, 1 war and bunch of java classes in jars.
    - access to my web app is protected through url pattern (in web.xml), i've defined the same named security role in web.xml and on j2ee engine.
    - my login module does the user name and password checking. both are stored in database through some other means.
    - login is FORM based
    following the discussion in another thread on the topic, i did the following:
    #1 develop my login module code. packaged it in a jar, then sda file. deploy the sda as a llibrary to the engine.
    #2 add my login module to the security store through the security provider service.
    #3 configure my web app to use the custom login module in web-j2ee-engine.xml
    #4 deploy my web app through the ear file
    at this point, in the visual administrator, i can see the library, the custom login module (added to the UME User Store), and also my web app has authentication set to use the custom login module (under policy configurations tab).
    now i try to login to my web app. it correctly complains when i enter non-existent user or wrong password and brings me to the login failed jsp page. but when i enter both correctly (as stored in my database), i get http 403 error code. i know it is 403 because i set that error code to a special jsp page in web.xml.
    question is why? now i create a user on the j2ee engine with the same name as in my user database. then i can login ok. i am confident that my login module is called since i see the println lines in j2ee engine server logs.
    ??? so i must be missing something obvious. is it because my web app is protected through security-role? i even tried removing all such roles, but still same problem.
    ??? or do i completely mis-understand how custom login modules are supposed to work. i thought it means i can authenticate users any way i want without having to use the j2ee engine's user mgmt. pls tell me if i am totally wrong.
    ??? or maybe my login module code is missing some key stmts. how should it tell the j2ee engine that a user is authenticated? in the login() method, it returns true if user name/passwd match. in the commit() method, it adds the principal to the subject. i don't what else is required.
    does anyone have a working scenario using custom login modules?
    thanks very much for your inputs and thoughts.
    wentao

    Hi Astrid,
    I guess I have the same understanding of JAAS as you. I want to deploy an application that internally makes use of JAAS to authenticate users. There is a LoginModule that authenticates users against some database tables containing all the user data and profile. The application was not designed to be deployed to NetWeaver. So it does not make use of UME or some other NetWeaver specific feature. Actually it handles user management and authoroization issues completely on its own. The only reason for having JAAS is to allow customers to plug in their own LoginModule to use some other kind of user store.
    When deploying the web application to a simple servlet engine like Tomcat, all I have to do is to register my LoginModule in the "jaas.conf" file that is parsed by JAAS default implementation. I also tell the JVM where my jaas.conf file is located by appending a "-Djava..." runtime parameter to the JVM startup script.
    When using other application servers like IBM WebSphere things become a bit different. Normally you use the administration GUI of that server to configure your LoginModules. WebSphere for example keeps the login configuration in an internal database rather than writing everything into a "jaas.conf" text file. But the way the application can use the LoginModule is the same as in Tomcat.
    But when it comes to Netweaver, it seems to me that it's not possible to define a LoginModule that your application can use WITHOUT having to couple it tightly to UME. Or did I get something wrong? Initially I've tried to modify the JVM's parameters (using SAP J2EE Config Tool) to include the location of my "jaas.conf" file containing the my login configuration. But that did not work. The parameter was really passed to the JVM but anyway my LoginModule was not found, I guess that NetWeaver has some own implementation of the JAAS interfaces that just ignore the plain text JAAS configuration files (like WebSphere also does).
    The documentation that I have downloaded from SDN doesn't seem to match the 6.4 sneak preview version that I just downloaded some days ago. They say you should deploy your LoginModule as a library and add a refernce to the application. I tried that out but it did not help. The login configuration that the application wants to access is still not found. Actually there seems to be no way to specify the name for a JAAS Login Configuration in NetWeaver. At least I cound not find that in the documentation.
    So basically my question is: is it possible to deploy an application that wants to use some own LoginModule (either deployed separately or together with the application, that does not matter) without making use of Netweaver specific features like UME? The application has its own user management infrastructure and just needs a way to setup a JAAS Login Configuration to access its own LoginModule.
    Thanks in advance
    Henning

  • How to get Custom Login Module to communicate with frontendtarget

    We have created a custom login module and placed it in our login module stack.
    So we have the following 3 Login Modules in our stack:
    EvaluateTicketModule
    OurCustomLoginModule
    CreateTicketModule
    Also we are using the standard SAP login screen for our frontendtarget, see our authschemes.xml entry:
    <authscheme name="cglogon">
                <authentication-template>
                    form
                </authentication-template>
                <priority>21</priority>
                <frontendtype>2</frontendtype>
                <frontendtarget>com.sap.portal.runtime.logon.certlogon</frontendtarget>
            </authscheme>
    Question:
    There are standard screens in the SAP login PAR:
                changePasswordPage.jsp
                umLogonProblemPage.jsp
                umResetPasswordPage.jsp
    How do I trigger one of these screens from my Login() method of my
    custom login module?  I thought if I throw some specific exception, these screens would
    be called?

    A bit more info. 
    We created a new Authentication Scheme for certain iviews that are deemed more "sensitive" that required a step-up authentication. 
    I changed the Iview property "Authentication Scheme" to our custom one.
    If I navigate into one of these more sensitive Iviews, I get the standard SAP login screen: <frontendtarget>com.sap.portal.runtime.logon.certlogon</frontendtarget>
    Whis is what i expect.
    I enter a username and password and click Logon button.  I see that it successfully hits our custom login module and goes through Login(), and Commit() methods and finally displays the iview i originally requested.
    However, on a failure, i want it to return focus to the SAP login screen with an error explaining why...(i.e. wrong password, account locked, etc.)
    However, It always give iview runtime exception with Access Denied.
    #1.5 #0018FE8C6FD800690000029000004D6C00045B6E5E7D6014#1226429496628#com.sap.engine.services.security.authentication.logincontext#sap.com/irj#com.sap.engine.services.security.authentication.logincontext#JOHNDOE#182##servername_EPX_176065950#JOHNDOE#bb3365a0b02111ddabea0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_24##0#0#Debug##Java###Login module {0} from authentication stack {1} does not authenticate the caller.#2#companyname.com.CGLoginModuleClass#form#
    #1.5 #0018FE8C6FD800690000029100004D6C00045B6E5E7D6275#1226429496629#com.sap.engine.services.security.authentication.loginmodule.ticket.EvaluateTicketLoginModule#sap.com/irj#com.sap.engine.services.security.authentication.loginmodule.ticket.EvaluateTicketLoginModule.abort()#JOHNDOE#182##servername_EPX_176065950#JOHNDOE#bb3365a0b02111ddabea0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_24##0#0#Path##Plain###Entering method#
    #1.5 #0018FE8C6FD800690000029200004D6C00045B6E5E7D6308#1226429496629#com.sap.engine.services.security.authentication.loginmodule.ticket.EvaluateTicketLoginModule#sap.com/irj#com.sap.engine.services.security.authentication.loginmodule.ticket.EvaluateTicketLoginModule#JOHNDOE#182##servername_EPX_176065950#JOHNDOE#bb3365a0b02111ddabea0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_24##0#0#Debug##Plain###Internal Login Module data has been reset.#
    #1.5 #0018FE8C6FD800690000029300004D6C00045B6E5E7D6386#1226429496629#com.sap.engine.services.security.authentication.loginmodule.ticket.EvaluateTicketLoginModule#sap.com/irj#com.sap.engine.services.security.authentication.loginmodule.ticket.EvaluateTicketLoginModule#JOHNDOE#182##servername_EPX_176065950#JOHNDOE#bb3365a0b02111ddabea0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_24##0#0#Path##Java###Exiting method with {0}#1#true#
    #1.5 #0018FE8C6FD800690000029400004D6C00045B6E5E7D6438#1226429496629#com.sap.engine.services.security.authentication.loginmodule.ticket.CreateTicketLoginModule#sap.com/irj#com.sap.engine.services.security.authentication.loginmodule.ticket.CreateTicketLoginModule.abort()#JOHNDOE#182##servername_EPX_176065950#JOHNDOE#bb3365a0b02111ddabea0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_24##0#0#Path##Plain###Entering method#
    #1.5 #0018FE8C6FD800690000029500004D6C00045B6E5E7D64B2#1226429496629#com.sap.engine.services.security.authentication.loginmodule.ticket.CreateTicketLoginModule#sap.com/irj#com.sap.engine.services.security.authentication.loginmodule.ticket.CreateTicketLoginModule#JOHNDOE#182##servername_EPX_176065950#JOHNDOE#bb3365a0b02111ddabea0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_24##0#0#Path##Java###Exiting method with {0}#1#true#
    #1.5 #0018FE8C6FD800690000029700004D6C00045B6E5E7D6750#1226429496630#com.sap.engine.services.security.authentication.logincontext#sap.com/irj#com.sap.engine.services.security.authentication.logincontext#JOHNDOE#182##servername_EPX_176065950#JOHNDOE#bb3365a0b02111ddabea0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_24##0#0#Info#1#/System/Security/Authentication#Plain###LOGIN.FAILED
    User: N/A
    Authentication Stack: form
    Login Module                                                               Flag        Initialize  Login      Commit     Abort      Details
    1. com.sap.security.core.server.jaas.EvaluateTicketLoginModule             SUFFICIENT  ok          exception             true       authscheme not sufficient: uidpwdlogon<cglogon
            \#1 ume.configuration.active = true
    2. companyname.com.CGLoginModuleClass                                         REQUISITE   ok          exception             true       Authentication did not succeed.
    3. com.sap.security.core.server.jaas.CreateTicketLoginModule               OPTIONAL    ok                                true      
            \#1 ume.configuration.com = true#
    #1.5 #0018FE8C6FD800690000029900004D6C00045B6E5E7DA973#1226429496647#System.err#sap.com/irj#System.err#JOHNDOE#182##servername_EPX_176065950#JOHNDOE#bb3365a0b02111ddabea0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_24##0#0#Error##Plain###Nov 11, 2008 10:51:36...                    com.sap.portal.portal [SAPEngine_Application_Thread[impl:3]_24] Error: Exception ID:10:51_11/11/08_0002_176065950
    #1.5 #0018FE8C6FD800690000029B00004D6C00045B6E5E7DCA91#1226429496647#com.sap.portal.portal#sap.com/irj#com.sap.portal.portal#JOHNDOE#182##servername_EPX_176065950#JOHNDOE#bb3365a0b02111ddabea0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_24##0#0#Error#1#/System/Server#Java###Exception ID:10:51_11/11/08_0002_176065950
    [EXCEPTION]
    {0}#1#com.sapportals.portal.prt.runtime.PortalRuntimeException: Access is denied: pcd:portal_content/com.companyname.portal.capitalgroup/com.companyname.com.security/com.companyname.portal.cghressnaaa/com.sap.pct.ess.employee_self_service/com.companyname.pg_sensitiveWebdynpro/com.cg.ivu_saplogon_0 - user: Guest
         at com.sapportals.portal.prt.deployment.DeploymentManager.getPropertyContentProvider(DeploymentManager.java:1936)
         at com.sapportals.portal.prt.core.broker.PortalComponentContextItem.refresh(PortalComponentContextItem.java:230)
         at com.sapportals.portal.prt.core.broker.PortalComponentContextItem.getContext(PortalComponentContextItem.java:312)
         at com.sapportals.portal.prt.component.PortalComponentRequest.getComponentContext(PortalComponentRequest.java:385)
         at com.sapportals.portal.prt.connection.PortalRequest.getRootContext(PortalRequest.java:435)
         at com.sapportals.portal.prt.core.PortalRequestManager.runRequestCycle(PortalRequestManager.java:607)
         at com.sapportals.portal.prt.connection.ServletConnection.handleRequest(ServletConnection.java:240)
         at com.sapportals.portal.prt.dispatcher.Dispatcher$doService.run(Dispatcher.java:545)
    and here's my login method...
         public boolean login() throws javax.security.auth.login.LoginException
              this.succeeded = false;
              String passwordString = "";
              if (callbackHandler == null)
                   throw new LoginException("Error: no CallbackHandler available to garner authentication information from the user");
              HttpGetterCallback httpgettercallback = new HttpGetterCallback();
              NameCallback nc = new NameCallback("User:");
              PasswordCallback pc = new PasswordCallback("Password:", false);
              Callback[] callbacks = new Callback[] { nc, pc };
              try
                   callbackHandler.handle(callbacks);
              catch (IOException e)
                   throwUserLoginException(e, LoginExceptionDetails.IO_EXCEPTION);
              catch (UnsupportedCallbackException e)
                   return false;
              String userid = nc.getName();
              char[] password = pc.getPassword();
              pc.clearPassword();
              if (userid.length() == 0)
                   throwNewLoginException("USERID IS MISSING!", LoginExceptionDetails.IO_EXCEPTION);
              else
                   username = userid;
              if (password.length == 0)
                   throwNewLoginException("PASSWORD IS MISSING!", LoginExceptionDetails.NO_PASSWORD);
              else
                   passwordString = new String(password);
              String eccLoginResult = validateECCAuthentication(username, passwordString);
              if (!eccLoginResult.equals(""))
                   myLoc.infoT(this.username + " - failed ECC authentication.");
                   throwNewLoginException("Wrong UserId/Password", LoginExceptionDetails.WRONG_USERNAME_PASSWORD_COMBINATION);
              else
                   myLoc.infoT(this.username + " - failed ECC authentication.");
                   this.succeeded = true;
              if (this.succeeded)
                   try
                        refreshUserInfo(this.username);
                   catch (SecurityException e)
                        throwUserLoginException(e);
                   if (sharedState.get(AbstractLoginModule.NAME) == null)
                        sharedState.put(AbstractLoginModule.NAME, this.username);
                        this.nameSet = true;
              else
                   throwNewLoginException("Wrong UserId/Password", LoginExceptionDetails.WRONG_USERNAME_PASSWORD_COMBINATION);
              return this.succeeded;

  • Custom login module for EP7.4 with Captcha

    Hi
    I am trying to create a custom login module which validates the captcha shown at the login screen using SAP help link:
    http://help.sap.com/saphelp_nw73/helpdata/en/48/ff4faf222b3697e10000000a42189b/content.htm?frameset=/en/48/fcea4f62944e88e10000000a421937/frameset.htm&current_toc=/en/74/8ff534d56846e2abc61fe5612927bf/plain.htm&node_id=20
    The session is being set in the Captcha servlet which is used to render the image on the login page.
    However when I am trying to compare it with input or print the session value, its throwing an exception.
    I checked in the NWA logs and it just shows the following error message:
    6. com.temp.loginModule.MyLoginModuleClass OPTIONAL ok exception true Authentication did not succeed.
    Please help me analyse the error stack. Can someone point where do i check the detailed logs to trace the issue?
    Please find below source of my login module.
    package com.temp.loginModule;
    import java.io.IOException;
    import java.util.Map;
    import javax.security.auth.login.LoginException;
    import javax.security.auth.Subject;
    import javax.security.auth.callback.CallbackHandler;
    import javax.security.auth.callback.Callback;
    import javax.security.auth.callback.NameCallback;
    import javax.security.auth.callback.UnsupportedCallbackException;
    import nl.captcha.Captcha;
    import com.sap.engine.interfaces.security.auth.AbstractLoginModule;
    import com.sap.engine.lib.security.http.HttpGetterCallback;
    import com.sap.engine.lib.security.http.HttpCallback;
    import com.sap.engine.lib.security.LoginExceptionDetails;
    import com.sap.engine.lib.security.Principal;
    public class MyLoginModuleClass extends AbstractLoginModule{
      private CallbackHandler callbackHandler = null;
      private Subject subject = null;
      private Map sharedState = null;
      private Map options = null;
      // This is the name of the user you have created on
      // the AS Java so you can test the login module
      private String userName = null;
      private boolean successful;
      private boolean nameSet;
      public void initialize(Subject subject, CallbackHandler callbackHandler,
      Map sharedState, Map options) {
      // This is the only required step for the method
      super.initialize(subject, callbackHandler, sharedState, options);
      // Initializing the values of the variables
      this.callbackHandler = callbackHandler;
      this.subject = subject;
      this.sharedState = sharedState;
      this.options = options;
      this.successful = false;
      this.nameSet = false;
      * Retrieves the user credentials and checks them. This is
      * the first part of the authentication process.
      public boolean login() throws LoginException {
    // HttpGetterCallback httpGetterCallback = new HttpGetterCallback(); 
    //       httpGetterCallback.setType(HttpCallback.REQUEST_PARAMETER); 
    //       httpGetterCallback.setName("captchaInput"); 
           String value = null; 
    //       try { 
    //       callbackHandler.handle(new Callback[] { httpGetterCallback }); 
    //           String[] arrayRequestparam = (String[]) httpGetterCallback.getValue(); 
    //           if(arrayRequestparam!=null && arrayRequestparam.length>0)
    //           value = arrayRequestparam[0]; 
    //       } catch (UnsupportedCallbackException e) { 
    //       throwNewLoginException("An error occurred while trying to validate credentials."); 
    //       } catch (IOException e) { 
    //            throwUserLoginException(e, LoginExceptionDetails.IO_EXCEPTION); 
      value = getRequestValue("captchaInput");
      userName = getRequestValue("j_username");
      HttpGetterCallback httpGetterCallbackSessionCaptcha = new HttpGetterCallback(); 
      httpGetterCallbackSessionCaptcha.setType(HttpCallback.SESSION_ATTRIBUTE); 
      httpGetterCallbackSessionCaptcha.setName("myCaptchaLogin"); 
      try { 
      callbackHandler.handle(new Callback[] { httpGetterCallbackSessionCaptcha }); 
      Captcha arraySessionParam = (Captcha) httpGetterCallbackSessionCaptcha.getValue();
    // System.out.println("****************************************************httpGetterCallbackSessionCaptcha" + (arraySessionParam==null?"null session":arraySessionParam.getAnswer())+
    // "\n captchaInput" + value+"*********************");
      if(arraySessionParam==null || !arraySessionParam.isCorrect(value)){
      throwNewLoginException("Entered code does not match with the image code.Session:"+(arraySessionParam==null?"null":arraySessionParam.getAnswer())+" Param:"+ value);
    // throwUserLoginException(new Exception("Entered code does not match with the image code."));
      httpGetterCallbackSessionCaptcha.setValue(null);
      } catch (UnsupportedCallbackException e) { 
      throwNewLoginException("An error occurred while trying to validate credentials."); 
      } catch (IOException e) { 
      throwUserLoginException(e, LoginExceptionDetails.IO_EXCEPTION); 
      // Retrieve the user credentials via the callback
      // handler.
      // In this case we get the user name from the HTTP
      // NameCallback.
    // NameCallback nameCallback = new NameCallback("User name: ");
      /* The type and the name specify which part of the HTTP request
      * should be retrieved. For Web container authentication, the
      * supported types are defined in the interface
      * com.sap.engine.lib.security.http.HttpCallback.
      * For programmatical authentication with custom callback
      * handler the supported types depend on the used callback handler.
    // try {
    // callbackHandler.handle(new Callback[] {nameCallback});
    // catch (UnsupportedCallbackException e) {
    // return false;
    // catch (IOException e) {
    // throwUserLoginException(e, LoginExceptionDetails.IO_EXCEPTION);
    // userName = nameCallback.getName();
    // if( userName == null || userName.length() == 0 ) {
    // return false;  
      /* When you know the user name, update the user information
      * using data from the persistence. The operation must
      * be done before the user credentials checks. This method also
      * checks the user name so that if a user with that name does not
      * exist in the active user store, a
      * java.lang.SecurityException is thrown.
    // try {
    // refreshUserInfo(userName);
    // } catch (SecurityException e) {
    // throwUserLoginException(e);
      /* Checks if the given user name starts with the specified
      * prefix in the login module options. If no prefix is specified,
      * then all users are trusted.
    // String prefix = (String) options.get("user_name_prefix");
    // if ((prefix != null) && !userName.startsWith(prefix)) {
    // throwNewLoginException("The user is not trusted.");
      /* This is done if the authentication of the login module is    
      * successful.
      * Only one and exactly one login module from the stack must put
      * the user name in the shared state. This user name represents
      * the authenticated user.
      * For example if the login attempt is successful, method
      * getRemoteUser() of
      * the HTTP request will retrieve exactly this name.
      if (sharedState.get(AbstractLoginModule.NAME) == null) {
      sharedState.put(AbstractLoginModule.NAME, userName);
      nameSet = true;
      successful = true;
      return true;
      * Commit the login. This is the second part of the authentication
      * process.
      * If a user name has been stored by the login() method,
      * the user name is added to the subject as a new principal.
      public boolean commit() throws LoginException {
      if (successful) {
      /* The principals that are added to the subject should
      * implement java.security.Principal.You can use the class
      * com.sap.engine.lib.security.Principal for this purpose.
      Principal principal = new Principal(userName);
      subject.getPrincipals().add(principal);
      /* If the login is successful, then the principal corresponding
      * to the <userName> (the same user name that has been added
      * to the subject) must be added in the shared state too.
      * This principal is considered to be the main principal
      * representing the user.
      * For example, this principal will be retrieved from method
      * getUserPrincipal() of the HTTP request.
      if (nameSet) {
      sharedState.put(AbstractLoginModule.PRINCIPAL, principal);
      } else {
      userName = null;
      return true;
      * Abort the authentication process.
      public boolean abort() throws LoginException {
      if (successful) {
      userName = null;
      successful = false;
      return true;
      * Log out the user. Also removes the principals and
      * destroys or removes the credentials that were associated 
      * with the user during the commit phase.
      public boolean logout() throws LoginException {
      // Remove principals and credentials from subject
      if (successful) {
      subject.getPrincipals(Principal.class).clear();
      successful = false;
      return true;
      private String getRequestValue(String parameterName) 
         throws LoginException { 
           HttpGetterCallback httpGetterCallback = new HttpGetterCallback(); 
           httpGetterCallback.setType(HttpCallback.REQUEST_PARAMETER); 
           httpGetterCallback.setName(parameterName); 
           String value = null; 
           try { 
          callbackHandler.handle(new Callback[] { httpGetterCallback }); 
               String[] arrayRequestparam = (String[]) httpGetterCallback.getValue(); 
               value = arrayRequestparam[0]; 
           } catch (UnsupportedCallbackException e) { 
                return null; 
           } catch (IOException e) { 
                throwUserLoginException(e, LoginExceptionDetails.IO_EXCEPTION); 
           return value; 
    Regards
    Ramanender Singh

    Ramanender,
    JAAS modules usually requires a restart whenever you need to change them. So be very careful with what you expect once you re-deploy your code.
    Once the library is loaded it will never reload itself until you perform a restart of the VM. 
    Connect to the debug port may help, but basic debugging will not take you too far either.
    I would recommend you to use the log tracing facility on your code. Just enter the following class attribute:
    import com.sap.tc.logging.Location;
    private static final Location trace = Location.getLocation(<your_classname_here>.class);
    trace.warningT("Some Warning Text Here..." + variable here);
    trace.debugT("Some Warning Text Here..." + variable here);
    You may need to go NWA and set the Location Severity Level to Debug according to your needs.
    Leave the trace code on your module for IT personnel to debug it if necessary. Don't forget to have the severity level of your code properly set.
    Meaning: You don't want to have every trace message your module sills out with warningT() or infoT().
    There is a excellent blog here on how this works
    Then you will be able to inspect some variable contents while the callbackhandler is being executed.
    Pay special attention with the timing - variables have a lifetime when dealing with login modules.
    Use the entering(<method_name>) and exiting(<method_name> just ot make sure where in the code the variable should be populated and when.
    BR,
    Ivan

  • Deploying a custom login module to the J2EE engine

    I have developed a custom login module, and want to deploy it to the SAP j2ee engine. How should I go about this ? I tried packaging it as a jar and then using the deploytool, went into user management to register the module, but when the module was invoked I got an error in the log saying "Cannot load a login module".
    The way I currently deploy it is packaged with the Example Calculator, and this works. I just add my 2 java files into the web module (in com.sap.examples.calculator.beans) and it gets packaged in the war file.
    Can anyone help with the "proper" way of deploying my module ?
    Thanks in advance

    Hi Brad,
    >
    > What I'm actually trying to do is NOT deploy my
    > custom login module with an application. But rather
    > deploy the jar file as a library to the J2EE engine,
    > so that any application can use it by configuring it
    > in their login stacks. I'm still not totally clear
    > whether this is possible or not.
    Once again - It is possible to deploy the login module as a library to the J2EE Engine; furthermore, this is the PREFERRED way to use login modules!
    >
    > What I have currently done:
    >
    > 1. developed custom login module packaged as a jar in
    > NW studio (2 class files)
    >
    > 2. Using deploytool I deploy the jar as a library to
    > the j2ee engine. This works and the library shows up
    > under the libraries section.
    >
    > 3. Register the login module in the user
    > management->manage security stores section. I'm
    > unsure if this works properly. Do I just provide the
    > full path to the required class ? For example
    > "com.example.myloginmodule.LoginModule"
    > I have a suspicion that my error of "cannot load a
    > login module" stems from here.
    >
    > 4. I have then followed your step and added a
    > reference to the libray (Hard reference) and this
    > seems ok.
    >
    Sorry, Brad, I've made a mistake here. You need to set a reference from the Security Provider Service to the library that contains the login module (not from the application). To do that at runtime, you'll have to use the Configuration Adapter service on the J2EE Engine. For a description of the procedure, see this page in the documentation: http://help.sap.com/saphelp_nw04/helpdata/en/dd/1e3a3e5069eb6ce10000000a114084/frameset.htm
    You need to provide additional entry of the following type in the security-provider.xml file:
    <reference type="library" strength="weak">
            Your-library-name-here
          </reference>
    Regards,
    Ivo.
    Message was edited by: Ivaylo Ivanov

  • Custom Login Module Behavior (JAAS)...Help!

    Problem: After successful authentication through a custom login module, the screen stays on the login screen and does not go to the iview you clicked on...
    I have created a login module as documented [here|http://help.sap.com/saphelp_nw04s/helpdata/en/46/3ce9402f3f8031e10000000a1550b0/frameset.htm]. 
    I have added a new entry in the authschemes.xml file:
    <authscheme name="cglogon">
                <authentication-template>
                    form
                </authentication-template>
                <priority>21</priority>
                <frontendtype>2</frontendtype>
                <frontendtarget>com.sap.portal.runtime.logon.certlogon</frontendtarget>
            </authscheme>
    As you can see above, i wanted to try to use the standard sap screen: com.sap.portal.runtime.logon.certlogon
    Also, the logon module stack called "form" contains one and only one login module:  mycompany.com.CGLoginModuleClass    (REQUISITE)
    Here is also the code to my Login() method of my module:
         public boolean login() throws LoginException
              Exception exception_on_the_way = null;
              String passwordString = "";
              NameCallback nc = new NameCallback("User:");
              PasswordCallback pc = new PasswordCallback("Password:", false);
              Callback[] callbacks = new Callback[] { nc, pc };
              try
                   callbackHandler.handle(callbacks);
              catch (IOException e)
                   exception_on_the_way = e;
              catch (UnsupportedCallbackException e)
                   exception_on_the_way = e;
              String userid = nc.getName();
              char[] password = pc.getPassword();
              pc.clearPassword();
              if (userid.length() == 0)
                   throw new LoginException(MISSING_UID);
              else
                   userName = userid;
              if (password.length == 0)
                   throw new LoginException(MISSING_PASSWORD);
              else
                   passwordString = new String(password);
              try
                   refreshUserInfo(userName);
              catch (SecurityException e)
                   exception_on_the_way = e;
              if (exception_on_the_way != null)
                   //             A productive application should write an entry
                   //             into the trace here
                   exception_on_the_way.printStackTrace();
                   throw new LoginException("Could not handle callbacks");
              String eccLoginResult = "";
              //eccLoginResult = validateECCAuthentication(userName, passwordString);
              if (!eccLoginResult.equals(""))
                   //throwNewLoginException(eccLoginResult);
                   //throw new LoginException(USER_AUTH_FAILED);
                   throwNewLoginException("Wrong UserId/Password", LoginExceptionDetails.WRONG_USERNAME_PASSWORD_COMBINATION);
              else
                   successful = true;
              if (sharedState.get(AbstractLoginModule.NAME) == null)
                   sharedState.put(AbstractLoginModule.NAME, userName);
                   nameSet = true;
              return true;
    I set up a random iview in the portal to use our new authentication scheme: cglogon by changing the iview property Authentication Scheme.
    After clicking the logon button, My login() method gets called and sucessful is set to true.  Also the commit() method gets called. 
    Problem: However, the screen gets redirected to the logon screen again...
    Here is the trace in the logs:
    Used Passport Type: 3
    #[Security Context : [Security Session (3929) for kcf created at Thu Nov 06 08:40:44 PST 2008]]#
    #1.5 #0018FE8C6FD8007200003781000041C100045B07FD434AB8#1225989778316#com.sap.engine.services.security.sessionmanagement##com.sap.engine.services.security.sessionmanagement#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Debug##Java###Persistent listeners of {0} notified#1#[Security Context : [Security Session (3929) for kcf created at Thu Nov 06 08:40:44 PST 2008]]#
    #1.5 #0018FE8C6FD8007200003782000041C100045B07FD4353D2#1225989778319#com.sap.engine.services.security.authentication.programmatic#sap.com/irj#com.sap.engine.services.security.authentication.programmatic.logon#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Path##Java###Entering method with ({0})#1#com.sap.engine.services.servlets_jsp.server.runtime.client.HttpServletRequestFacade@2cbd9a10, com.sap.engine.services.servlets_jsp.server.runtime.client.HttpServletResponseFacade@5db3e73e, cglogon#
    #1.5 #0018FE8C6FD8007200003783000041C100045B07FD435510#1225989778319#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Debug##Java###Security context [{0}] successfully loaded from cache.#1#form#
    #1.5 #0018FE8C6FD8007200003784000041C100045B07FD43559B#1225989778319#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Path##Plain###Entering PolicyConfigurationSecurityContext.getAuthenticationContext()#
    #1.5 #0018FE8C6FD8007200003785000041C100045B07FD43560F#1225989778319#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Path##Plain###Exiting PolicyConfigurationSecurityContext.getAuthenticationContext()#
    #1.5 #0018FE8C6FD8007200003786000041C100045B07FD435864#1225989778320#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Debug##Java###New policy configuration modification context successfully created for configuration with path [{0}].#1#security/configurations/form#
    #1.5 #0018FE8C6FD8007200003787000041C100045B07FD4358F8#1225989778320#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Path##Plain###Entering Storage.getStorage(Configuration config)#
    #1.5 #0018FE8C6FD8007200003788000041C100045B07FD435983#1225989778320#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Debug##Java###New storage [{0}] created.#1#com.sap.engine.services.security.server.storage.AtomicStorage@3091c97c#
    #1.5 #0018FE8C6FD8007200003789000041C100045B07FD435A00#1225989778320#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Path##Plain###Exiting Storage.getStorage(Configuration config)#
    #1.5 #0018FE8C6FD800720000378A000041C100045B07FD435A7B#1225989778320#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Path##Plain###Entering Storage.begin()#
    #1.5 #0018FE8C6FD800720000378B000041C100045B07FD435B31#1225989778321#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Debug##Java###New configuration handler [{0}] created.#1#com.sap.engine.core.configuration.impl.ConfigurationHandlerImpl@334304cd#
    #1.5 #0018FE8C6FD800720000378C000041C100045B07FD435BC8#1225989778321#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Path##Plain###Exiting Storage.begin()#
    #1.5 #0018FE8C6FD800720000378D000041C100045B07FD435C3A#1225989778321#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Debug##Plain###New modification bundle started for the current thread.#
    #1.5 #0018FE8C6FD800720000378E000041C100045B07FD435CC6#1225989778321#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Debug##Java###Trying to get configuration [{0}] from storage; write access [{1}]; create if missing [{2}]#3#security/configurations/form/security/authentication#false#false#
    #1.5 #0018FE8C6FD800720000378F000041C100045B07FD435DC0#1225989778321#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Debug##Java###Configuration returned from storage successfully [{0}].#1#security/configurations/form/security/authentication#
    #1.5 #0018FE8C6FD8007200003790000041C100045B07FD436148#1225989778322#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Path##Plain###Entering Storage.forget()#
    #1.5 #0018FE8C6FD8007200003791000041C100045B07FD436225#1225989778322#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Path##Plain###Exiting Storage.forget()#
    #1.5 #0018FE8C6FD8007200003792000041C100045B07FD43629D#1225989778322#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Debug##Plain###Successful forget of modification bundle for the current thread.#
    #1.5 #0018FE8C6FD8007200003793000041C100045B07FD4363B9#1225989778323#com.sap.engine.services.security.authentication.logincontext#sap.com/irj#com.sap.engine.services.security.authentication.logincontext#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Info##Plain###Re-authentication requested.#
    #1.5 #0018FE8C6FD8007200003794000041C100045B07FD4364BA#1225989778323#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Debug##Java###Security context [{0}] successfully loaded from cache.#1#form#
    #1.5 #0018FE8C6FD8007200003795000041C100045B07FD436534#1225989778323#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Path##Plain###Entering PolicyConfigurationSecurityContext.getAuthenticationContext()#
    #1.5 #0018FE8C6FD8007200003796000041C100045B07FD4365A6#1225989778323#com.sap.engine.services.security.policyconfiguration#sap.com/irj#com.sap.engine.services.security.policyconfiguration#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Path##Plain###Exiting PolicyConfigurationSecurityContext.getAuthenticationContext()#
    #1.5 #0018FE8C6FD8007200003797000041C100045B07FD439765#1225989778336#com.sap.engine.services.security.authentication.logincontext#sap.com/irj#com.sap.engine.services.security.authentication.logincontext#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Info##Java###User [{0}] attempt to re-authenticate.#1#kcf#
    #1.5 #0018FE8C6FD8007200003798000041C100045B07FD439CA1#1225989778337#com.sap.engine.services.security.sessionmanagement#sap.com/irj#com.sap.engine.services.security.sessionmanagement#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Info##Java###Principal {0} assigned to {1}#2#kcf#[Security Session (3929) for kcf created at Thu Nov 06 08:40:44 PST 2008]#
    #1.5 #0018FE8C6FD8007200003799000041C100045B07FD439D6C#1225989778338#com.sap.engine.services.security.sessionmanagement#sap.com/irj#com.sap.engine.services.security.sessionmanagement#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Info##Java###Subject {0} assigned to {1}#2#Subject:
         Principal: kcf
    #[Security Session (3929) for kcf created at Thu Nov 06 08:40:44 PST 2008]#
    #1.5 #0018FE8C6FD800720000379A000041C100045B07FD439DF3#1225989778338#com.sap.engine.services.security.authentication.logincontext#sap.com/irj#com.sap.engine.services.security.authentication.logincontext#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Info##Java###Re-authentication for user [{0}] successfull.#1#kcf#
    #1.5 #0018FE8C6FD800720000379C000041C100045B07FD439F9B#1225989778338#com.sap.engine.services.security.authentication.logincontext#sap.com/irj#com.sap.engine.services.security.authentication.logincontext#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Info#1#/System/Security/Authentication#Plain###LOGIN.OK
    User: kcf
    Authentication Stack: form
    Login Module                                                               Flag        Initialize  Login      Commit     Abort      Details
    1. mycompany.com.CGLoginModuleClass                                         REQUISITE   ok          true       true                 
    Central Checks                                                                                true                  #
    #1.5 #0018FE8C6FD800720000379D000041C100045B07FD43A10D#1225989778338#com.sap.engine.services.security.authentication.programmatic#sap.com/irj#com.sap.engine.services.security.authentication.programmatic.logon#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Debug##Plain###Security session assigned successfully to the http session.#
    #1.5 #0018FE8C6FD800720000379F000041C100045B07FD43CC17#1225989778349#com.sap.engine.services.security.authentication.programmatic#sap.com/irj#com.sap.engine.services.security.authentication.programmatic#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Path##Plain###Exiting logon with authenticated subject.#
    #1.5 #0018FE8C6FD80072000037A0000041C100045B07FD43D9FE#1225989778353#com.sap.engine.services.security.authentication.programmatic#sap.com/irj#com.sap.engine.services.security.authentication.programmatic.isAuthenticated#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Path##Java###Entering method with ({0})#1#KCF#
    #1.5 #0018FE8C6FD80072000037A1000041C100045B07FD43DAC6#1225989778353#com.sap.engine.services.security.authentication.programmatic#sap.com/irj#com.sap.engine.services.security.authentication.programmatic.isAuthenticated#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Path##Java###Exiting method with {0}#1#false#
    #1.5 #0018FE8C6FD80072000037A2000041C100045B07FD440358#1225989778364#com.sap.engine.services.security.authentication.logonapplication#sap.com/irj#com.sap.engine.services.security.authentication.logonapplication.initBeans#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Info##Plain###LanguagesBean created#
    #1.5 #0018FE8C6FD80072000037A3000041C100045B07FD44045E#1225989778364#com.sap.engine.services.security.authentication.logonapplication#sap.com/irj#com.sap.engine.services.security.authentication.logonapplication.executeRequest#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Info##Plain###No command found, forwarding to umLogonPage#
    #1.5 #0018FE8C6FD80072000037A4000041C100045B07FD4429BF#1225989778373#com.sap.engine.services.security.sessionmanagement##com.sap.engine.services.security.sessionmanagement#kcf#3929##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Path##Java###Entering SecurityContext.empty() on {0}#1#[Security Context : [Security Session (3929) for kcf created at Thu Nov 06 08:40:44 PST 2008]]#
    #1.5 #0018FE8C6FD80072000037A5000041C100045B07FD442AC1#1225989778374#com.sap.engine.services.security.sessionmanagement##com.sap.engine.services.security.sessionmanagement#Guest#0##castoldi_EPX_176065950#KCF#a839a030ac2111ddb3dd0018fe8c6fd8#SAPEngine_Application_Thread[impl:3]_35##0#0#Debug##Java###Notifying persistent listener {0} of {1}#2#
    User ID           : kcf
    Service Type      : Web Request
    Action Name       : Appl.: irj:com.cg.ivu_saplogon_0
    Action Type       : http
    Additional Info   : null
    CPU Time [us]     : 0
    Queue Time [us]   : 4295152
    No of ext. calls  : 0
    Edited by: K Ferguson on Nov 6, 2008 6:07 PM

    I am facing the same problem.
    And how was is solved ?
    Thanks

  • Custom login module - Not invoked...

    Hi All
    I have developed a custom login module and the necessary configuration steps in VA are performed. However, the custom login module is not called...
    1. Developed a Java DC as a Child DC in a Library DC.
    2. Added all the relevant jars needed as Used DC and Public Parts as required. Also updated the provider.xml with relevant references.
    3. Build and Deployed. (No errors found here..)
    4. In VA - Created a new Login Module.... updated the property LoginModuleClassLoaders to library:xyz where xyz is the name of the folder for deployed sda as found in cluster\j2ee\serverx\bin\ext...next updated the config tool for the same.... next modified the sap.com/irj*irj authentication as:
    Basic - Requisite
    CustomModule - Optional.
    Then performed server restart. Yet, login module not called. Any ideas as to where I am going wrong..?? (In my login module, just trying to retrieve the user name and change their attributes like lastname etc... )
    Thanks
    Deepak

    Issue solved....
    Had forgot to add the module to the ticket stack...

  • Custom Login Module - ClassNotFound

    Hello all
    I developed a custom login module following the instructions I found here: http://help.sap.com/saphelp_nw04/helpdata/en/46/3ce9402f3f8031e10000000a1550b0/frameset.htm
    The general purpose of my module is to "filter" the username and look for (using the UMFactory) the corresponding uniqueUserID.
    The problem is that my LoginModule cannot be loaded due to "ClassNotFound" Error which I see in the defaultTrace.
    My steps were:
    1. Create my LoginModuleImplementation
    2. Create a Library as stated in the tutorial. Additionally I added some more references to the Library (Logging, webservices_lib) and successfully deplyed it to the J2EE-Server. I can see the file in one folder (...../j2ee/cluster/server0/bin/ext/MyModuleLib/MyModule.jar) so I think it's been correctly deployed.
    3. I configured its usage in the securtiy provider-UserManagementPolicies and with security provider-policy-ticket.
    4. I also ran the configtool to added it to the ClassLoader property there
    I double- no, fourth-checked everything and it's spelled correctly and exactly (case-sensitive) as in NWDS.
    So, do you have any idea please?
    By the way: Do you know where I can set the Severity-Level for the LoginModul-Stack, so I get more informational messages?
    Regards
    Michael

    Hi,
    The problem was solved by using the name customer.com~com.customer.portal.login.IPRuleLibrary for the library (so basically look at the name of your library folder under cluster\j2ee\serverx\bin\ext , not the name reported by visual admin).
    Also I was able to modify the properties of the login module runtime, which made me very happy
    Dagfinn

  • Custom Login Module Called by WebLogic

    I have managed to write and deploy a custom login module that works just fine with
    other app servers (except WebLogic). I am using WebLogic 6.1 with sp2. When WebLogic
    starts up, it seems to be calling my custom login module with a user of "system".
    I then get the following exception:
    Authentication Failed: Unexpected Exception, weblogic.security.acl.DefaultUserInfoImpl
    java.lang.ClassCastException: weblogic.security.acl.DefaultUserInfoImpl
    <<no stack trace available>>
    I have updated the Server.policy file to only point to my custom login module, WebLogic's
    system path points to the JAR with my login module and I can see the module get called.
    Any advice as to what WebLogic is doing here. This behavior does not seem to be
    compliant with the JAAS spec. Here is a snippet of my login method:
    public boolean login() throws LoginException {
    if (callbackHandler == null)
    throw new LoginException("Error: blah blah");
    Callback[] callbacks = new Callback[2];
    callbacks[0] = new NameCallback(USER);
    callbacks[1] = new PasswordCallback(PWD, false);
    try {
    callbackHandler.handle(callbacks);
    username = ((NameCallback)callbacks[USERCALLBACK]).getName();
    char[] tmpPassword = ((PasswordCallback)callbacks[PWDCALLBACK]).getPassword();
    if (tmpPassword == null) {
    tmpPassword = new char[0];
    password = new String(tmpPassword);
    Environment env = new Environment();
    env.setProviderUrl(url);
    env.setSecurityPrincipal(username);
    env.setSecurityCredentials(password);
    Authenticate.authenticate(env, subject);
    return verifyCredentials();
    } catch (java.io.IOException ioe) {
    throw new LoginException(ioe.toString());
    } catch (UnsupportedCallbackException uce) {
    throw new LoginException("Error: " + uce.getCallback().toString()
    + " not available");

    Weblogic 6.x does not support replaceable server side login modules and only
    supports login modules on the client.
    <[email protected]> wrote in message
    news:3cf36c98$[email protected]..
    >
    I have managed to write and deploy a custom login module that works justfine with
    other app servers (except WebLogic). I am using WebLogic 6.1 with sp2.When WebLogic
    starts up, it seems to be calling my custom login module with a user of"system".
    I then get the following exception:
    Authentication Failed: Unexpected Exception,weblogic.security.acl.DefaultUserInfoImpl
    java.lang.ClassCastException: weblogic.security.acl.DefaultUserInfoImpl
    <<no stack trace available>>
    I have updated the Server.policy file to only point to my custom loginmodule, WebLogic's
    system path points to the JAR with my login module and I can see themodule get called.
    Any advice as to what WebLogic is doing here. This behavior does notseem to be
    compliant with the JAAS spec. Here is a snippet of my login method:
    public boolean login() throws LoginException {
    if (callbackHandler == null)
    throw new LoginException("Error: blah blah");
    Callback[] callbacks = new Callback[2];
    callbacks[0] = new NameCallback(USER);
    callbacks[1] = new PasswordCallback(PWD, false);
    try {
    callbackHandler.handle(callbacks);
    username = ((NameCallback)callbacks[USERCALLBACK]).getName();
    char[] tmpPassword =((PasswordCallback)callbacks[PWDCALLBACK]).getPassword();
    >
    if (tmpPassword == null) {
    tmpPassword = new char[0];
    password = new String(tmpPassword);
    Environment env = new Environment();
    env.setProviderUrl(url);
    env.setSecurityPrincipal(username);
    env.setSecurityCredentials(password);
    Authenticate.authenticate(env, subject);
    return verifyCredentials();
    } catch (java.io.IOException ioe) {
    throw new LoginException(ioe.toString());
    } catch (UnsupportedCallbackException uce) {
    throw new LoginException("Error: " +uce.getCallback().toString()
    + " not available");

Maybe you are looking for