Custom User and Group classes

Hi,
I have a login custom module which does the authentication for my application.
Till now I was using WLSUserImpl and WLSGroupIpml and everything was working fine.
Now to make the LoginModule weblogic independent , I replaced the User and Group
classes with my own classes which extend from java.security.Principal.
But for some reason this isnt working. Am I missing something obvious.??
This the exception stack trace which I get
java.lang.SecurityException: [Security:090398]Invalid Subject: principals=[com.isone.security.providers.authentication.ISOUser@1698cbe,
com.isone.security.providers.authentication.ISOGroup@9719f4, com.isone.security.providers.authentication.ISOGroup@28ebb4,
com.isone.security.providers.authentication.ISOGroup@8ab721, com.isone.security.providers.authentication.ISOGroup@fcf06c,
com.isone.security.providers.authentication.ISOGroup@c7539, com.isone.security.providers.authentication.ISOGroup@1e41830,
com.isone.security.providers.authentication.ISOGroup@1f01b29, com.isone.security.providers.authentication.ISOGroup@8721bd,
com.isone.security.providers.authentication.ISOGroup@1b81d4f, com.isone.security.providers.authentication.ISOGroup@8c6e04,
com.isone.security.providers.authentication.ISOGroup@18aeabe, com.isone.security.providers.authentication.ISOGroup@13968f1,
com.isone.security.providers.authentication.ISOGroup@18c28a, com.isone.security.providers.authentication.ISOGroup@18bff68,
com.isone.security.providers.authentication.ISOGroup@2d2da4]
     at weblogic.security.service.SecurityServiceManager.seal(SecurityServiceManager.java:682)
     at weblogic.security.service.RoleManager.getRoles(RoleManager.java:279)
     at weblogic.security.service.AuthorizationManager.isAccessAllowed(AuthorizationManager.java:694)
     at weblogic.servlet.security.internal.WebAppSecurity.hasPermission(WebAppSecurity.java:567)
     at weblogic.servlet.security.internal.SecurityModule.checkPerm(SecurityModule.java:134)
     at weblogic.servlet.security.internal.FormSecurityModule.checkUserPerm(FormSecurityModule.java:327)
     at weblogic.servlet.security.internal.SecurityModule.beginCheck(SecurityModule.java:182)
     at weblogic.servlet.security.internal.FormSecurityModule.checkA(FormSecurityModule.java:181)
     at weblogic.servlet.security.internal.ServletSecurityManager.checkAccess(ServletSecurityManager.java:145)
     at weblogic.servlet.internal.WebAppServletContext.invokeServlet(WebAppServletContext.java:3539)
     at weblogic.servlet.internal.ServletRequestImpl.execute(ServletRequestImpl.java:2585)
     at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:197)
     at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:170)

And this will explain you why there is no way to do this right now:
(CR125681 -- although it says 7.0SP1 it is not fixed even in 8.1 SP2 and
there is no time frame for the fix)
http://support.bea.com/application?namespace=askbea&origin=ask_bea_answer.jsp&event=link.view_answer_page_clfydoc&answerpage=solution&page=wls/S-21705.htm
We've had the same issue and even have an open support case and for now
the only way to workaround the bug is to
use the WLSUserImpl and WLSGroupImpl classes.
HTH,
Dejan
Pavel wrote:
See if this will help:
http://edocs.bea.com/wls/docs81/dvspisec/pv.html
Pavel.
"Anil" <[email protected]> wrote:
I actually extended PrincipalValidatorImpl and returned java.security.Principal
as the base class.
But still I got the same exception.
PaulF <paulf@reply_in_newsgroup.com> wrote:
On 25 Feb 2004 06:45:50 -0800, Anil <[email protected]> wrote:
Hi,
I have a login custom module which does the authentication for my
application.
Till now I was using WLSUserImpl and WLSGroupIpml and everything was
working fine.
Now to make the LoginModule weblogic independent , I replaced the
User
and Group
classes with my own classes which extend from java.security.Principal.
But for some reason this isnt working. Am I missing something obvious.??
This the exception stack trace which I get
java.lang.SecurityException: [Security:090398]Invalid Subject:
principals=[com.isone.security.providers.authentication.ISOUser@1698cbe,
com.isone.security.providers.authentication.ISOGroup@9719f4,
com.isone.security.providers.authentication.ISOGroup@28ebb4,
com.isone.security.providers.authentication.ISOGroup@8ab721,
com.isone.security.providers.authentication.ISOGroup@fcf06c,
com.isone.security.providers.authentication.ISOGroup@c7539,
com.isone.security.providers.authentication.ISOGroup@1e41830,
com.isone.security.providers.authentication.ISOGroup@1f01b29,
com.isone.security.providers.authentication.ISOGroup@8721bd,
com.isone.security.providers.authentication.ISOGroup@1b81d4f,
com.isone.security.providers.authentication.ISOGroup@8c6e04,
com.isone.security.providers.authentication.ISOGroup@18aeabe,
com.isone.security.providers.authentication.ISOGroup@13968f1,
com.isone.security.providers.authentication.ISOGroup@18c28a,
com.isone.security.providers.authentication.ISOGroup@18bff68,
com.isone.security.providers.authentication.ISOGroup@2d2da4]
     at
weblogic.security.service.SecurityServiceManager.seal(SecurityServiceManager.java:682)
     at weblogic.security.service.RoleManager.getRoles(RoleManager.java:279)
     at
weblogic.security.service.AuthorizationManager.isAccessAllowed(AuthorizationManager.java:694)
     at
weblogic.servlet.security.internal.WebAppSecurity.hasPermission(WebAppSecurity.java:567)
     at
weblogic.servlet.security.internal.SecurityModule.checkPerm(SecurityModule.java:134)
     at
weblogic.servlet.security.internal.FormSecurityModule.checkUserPerm(FormSecurityModule.java:327)
     at
weblogic.servlet.security.internal.SecurityModule.beginCheck(SecurityModule.java:182)
     at
weblogic.servlet.security.internal.FormSecurityModule.checkA(FormSecurityModule.java:181)
     at
weblogic.servlet.security.internal.ServletSecurityManager.checkAccess(ServletSecurityManager.java:145)
     at
weblogic.servlet.internal.WebAppServletContext.invokeServlet(WebAppServletContext.java:3539)
     at
weblogic.servlet.internal.ServletRequestImpl.execute(ServletRequestImpl.java:2585)
     at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:197)
     at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:170)
I think that you need to extend WLSAbstractPrincipal I think instead
of
WLSPrincipal if you aren't going to implement your own
PrincipalValidator. The default PrincipalValidator is going to expect
a
principal that extends WLSAbstractPrincipal.
PaulF
Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/

Similar Messages

Custom User and Group picker

Hi all,
I need to change the standard User picker with new business rules (filters).
This page is called from a lot of standard KM IViews like Subscription, this is possible? how?
com.sap.netweaver.kmc.people.PeopleFinder
Thanks,

Hi all,
I need to change the standard User picker with new business rules (filters).
This page is called from a lot of standard KM IViews like Subscription, this is possible? how?
com.sap.netweaver.kmc.people.PeopleFinder
Thanks,

Error encountered initializing users and groups ... Class not found.

Hi,
I am trying to set up the example provided in Frank Nimphius and Duncan Mills great article about 'Declarative J2EE authentication and authorization with JAAS' (http://www.oracle.com/technology/products/jdev/howtos/10g/jaassec/index.htm) on iAS 10g. My current problem is this : when I try to deploy my test application using an ear file, Enterprise Manager returns the following error message : 'Error encountered initializing users and groups using the specified user manager. User manager class oracle.sample.dbloginmodule.DBTableLM.DBTableLoginModule not found.'. This class is distributed in an archive, DBLoginModule.jar, that I have put in my IASHome/j2ee/home/applib and inside my test application /WEB-INF/lib directories. I have tried putting them in one place at a time, then both, with always the same 'class not found' error as result.
Am I missing something ?
Where should I put this archive for it to be seen by the server ?
Could some mistake in web.xml, jazn-data.xml, orion-web.xml or orion-application.xml cause this error ?

Hi Kapil G,
Please let us know if you still need help with this post.
Thank you.

Populating users and groups - design considerations/best practice

We are currently running a 4.5 Portal in production. We are doing requirements/design for the 5.0 upgrade.
We currently have a stored procedure that assigns users to the appropriate groups based on the domain info and role info from an ERP database after they are imported and synched up by the authentication source.
We need to migrate this functionality to the 5.0 portal. We are debating whether to provide this functionality by doing this process via a custom Profile Web service. It was recommended during ADC and other presentation that we should stay away from using the database security/membership tables in the database directy and use the EDK/PRC instead.
Please advise on the best way to approach(With details) this issue. We need to finalize the best approach to take asap.
Thanks.
Vanita

So the best way to do this is to write a custom Authentication Web Service. Database customizations can do much more damage and the EDK/PRC/API are designed to prevent inconsistencies and problems.
Along those lines they also make it really easy to rationalize data from multiple backend systems into an orgainzation you'd like for your portal. For example you could write a Custom Authentication Source that would connect to your NT Domain and get all the users and groups, then connect to your ERP system and do the same work your stored procedure would do. It can then present this information to the portal in the way that the portal expects and let the portal maintain its own database and information store.
Another solution is to write an External Operation that encapsulates the logic in your stored procedure but uses the PRC/Server API to manipulate users and group memberships. I suggest you use the PRC interface since the Server API may change in subtle ways from release to release and is not as well documented.
Either of these solutions would be easier in the long term to maintain than a database stored procedure.
Hope this helps,
-Akash

User and Group Recon Error with OID

On a new development installation of OID and OIM, I am getting the following error while trying to run either User or Group reconciliations:
LDAP: error code 53 - Function Not Implemented, search filter attribute modifytimestamp is not indexed/cataloged
How can I add the appropriate index to allow these tasks to run?
Kerry

Have you tried:
4.3 Using Custom Attributes in Oracle Internet Directory
You can search for an attribute in Oracle Internet Directory only if the attribute is indexed. By default, standard attributes of the user and group entries are indexed. If you use a custom attribute, you can index it by using the catalog command. For example, if you migrate automount data to be used by automount programs such as amd or autofs, index the automountKey attribute by using the catalog command, as follows:
catalog connect="connect_str" add="TRUE" attribute="automountKey"
(from http://download.oracle.com/docs/cd/B28196_01/idmanage.1014/e12023/migrate.htm)
Hope this helps
Martin

Using users and groups from LDAP in ADF application

Hi there,
I'm using WebLogic Server 10.3.5.0 and JDev 11.1.2.3.0.
I configured my WL server to use the users and groups defined in my LDAP server (they display when I select the Users or Groups tab). So this works fine (I think).
Now I want to use 1 group, let's call the group ApplicationGroup, and all it's users to give them access to my ADF Application.
But I can't find proper/up-to-date info about how to do this.
I tried 2 major things:
1) I configured ADF Security to use Authentication and Authorization. Defined an Enterprise Role with the same name as in my WL server (so ApplicationGroup) then defined a
Application Role with a custom name and added the Enterprise Role to it. That Application Role I gave access to all my TF's and Web Pages. When I deploy this, It just doesn't work (Migrate Users and Groups is not checked).
2) Used the Authentication option in the ADF Security and the rest is the same as in 1). This works +-, I can login with all users so the role mapping isn't configured right I guess?
Any help or documentation that could help me?

Since we aren't using EM I had to find an other way. And I found it.
In web.xml ADF Security (I suppose) automaticly adds 'valid-users'. In my weblogic.xml I added my enterprise role as a principal to 'valid-users' and this works for me.
Thanks for the help.

Admin Console not displaying new Users and Groups from LDAP

We created a new Realm in WebLogic, which specifies the location of the Netscape
LDAP server. Our Weblogic application, called TGSLC, is able to find the ldap
server to use for authentication. My problem is this- the Admin Console is not
displaying the new users and groups from the LDAP server. Shouldn't the WebLogic
Admin Console display any users and groups specified in the ldap server, which
is referenced in the customized Realm?

Hi Andy,
I am not sure why you are unable to see the users and groups through the
console., you should be able to. Can you post the config.xml?
thanks,
-satya
Andy Levy <[email protected]> wrote in message
news:3b700c36$[email protected]..
>
We're running WLS 6.0 Sp2 on Windows 2000 Professional.
"Satya Ghattu" <[email protected]> wrote:
Andy,
Could you please tell us what Version of Weblogic you are running?
thanks,
-satya
Andy Levy <[email protected]> wrote in message
news:[email protected]..
We created a new Realm in WebLogic, which specifies the location ofthe
Netscape
LDAP server. Our Weblogic application, called TGSLC, is able to findthe
ldap
server to use for authentication. My problem is this- the Admin
Console
is not
displaying the new users and groups from the LDAP server. Shouldn'tthe
WebLogic
Admin Console display any users and groups specified in the ldap
server,
which
is referenced in the customized Realm?

User and group handling in LDAP Realm

Hi,
I'm currently using an LDAP Realm for storing users and groups, which I need to be able to add, amend and remove at runtime.
I understand that in earlier versions of Weblogic, the methods to do the add/remove/modify were not implemented but I was told that this may change in WL6. If so, is there any documentation or examples about these methods ? If not, would I need to extend ManageableRealm to create a custom realm ?
Any help much appreciated.
Dave

Hi Dave:
In our project, we use security realm (LDAP realm) for Users and Groups authentication. We turned the CacheRealm on to optimize performance. To add and amend Users and Groups, we use a stateless EJB to talk to LDAP server. This kind of partition works fine for us to separate the user authentication
logic and user management logic.
Fun
Dave Horner wrote:
Hi,
I'm currently using an LDAP Realm for storing users and groups, which I need to be able to add, amend and remove at runtime.
I understand that in earlier versions of Weblogic, the methods to do the add/remove/modify were not implemented but I was told that this may change in WL6. If so, is there any documentation or examples about these methods ? If not, would I need to extend ManageableRealm to create a custom realm ?
Any help much appreciated.
Dave

User and group management

I just installed an evaluation version of weblogic commerce and personalization server. I understand we can create users and groups and assign users to different groups. But I am wondering who has the privilege to do this, developer or end-user? In paticular, is it possible for a super user (should be end-user) in one group to manager all other users in the same group. This feature would be especially useful for B2B portal because usually we would allow a company administrator manage all users within that company. Thanks in advance.Zhe

Hi Steve,
What's the plan to provide ASP support in WLPS in the future ? Is there
any examples of WLPS that uses a 3rd party user management server (such
as LDAP)?
Thanks,
Leo
6th Dimension-
Steve Willcox wrote:
>
We only support a single administrator for a 'realm' of users. We don't have an admin permission mechanism on a group of users basis. The feature you are looking for more fits the ASP model and not an enterprise application model.
However, since WLPS/WLCS uses the WebLogic security realm to access users and groups, you can use a 3rd party user management tool that supports the permissions you are looking for in order to create users and groups. This would require the 3rd party user management tool to have an implementation of the WebLogic Security Realm class that works with this 3rd party user management server.
Zhe Liu wrote:
I just installed an evaluation version of weblogic commerce and personalization server. I understand we can create users and groups and assign users to different groups. But I am wondering who has the privilege to do this, developer or end-user? In paticular, is it possible for a super user (should be end-user) in one group to manager all other users in the same group. This feature would be especially useful for B2B portal because usually we would allow a company administrator manage all users within that company. Thanks in advance.Zhe--
Steve Willcox
BEA Systems, Inc.
ECommerce Application Components R&D
Architect
mailto:[email protected]
http://www.bea.com

Hi I do not want iTunes to open up automatically when I turn on my macbook pro. I tried going to System Preferences Users and Groups Login Items and then I took iTunes off the list but it still opens up automatically when I turn on my laptop.

Hi I do not want iTunes to open up automatically when I turn on my macbook pro. I tried going to System Preferences>Users and Groups>Login Items and then I took iTunes off the list but it still opens up automatically when I turn on my laptop. What should I do?

Hi r,
Make sure you close iTunes before shutdown. And you're quite welcome.

I am trying to stop programs from opening automatically when I turn my computer on. I tried system preferences users and groups login items...then I deleted them from the list but it did nothing.

I am trying to stop programs from opening automatically when I turn my computer on. I tried system preferences>users and groups>login items...then I deleted them itunes and emial from the list but it did nothing. They continue to open up every time I turn on my Macbook Pro.

Hi r,
It sounds like you're running Lion?
Have you tried running Verify and/or Repair Disk?
Have you tried running Repair Permissions?
Do you have at least 15% free space available on your HD?

How to change default /Users and /Groups to different Volume?

Users are created in /Volumes/<boot>/Users and groups in /Volumes/<boot>/Groups.
We need these to be created on a different volume, eg., /Volumes/External/Users, and /Volumes/External/Groups.
Setup Assistant correctly put user Backups into */Volumes/External/Shared Items/Backups* and also correctly put web services on /Volumes/External/ServiceData -- we want to do the same for Groups and Users.
Groups are the most critical, as the group needs bulk storage. Users we could leave as is if it can't be done.
How can this be configured? We've read File Server Admin, Open Directory Admin, and Advanced Server admin from http://www.apple.com/server/macosx/resources/documentation.html without finding an answer.
Thanks in advance.

1. Create new folders on the external volume to hold users and groups, but to prevent confusion name them something other than "Users" and "Groups". /Volumes/External/NetUsers and /Volumes/External/NetGroups would be reasonable choices.
2. Share both of these folders (in Server Admin -> server name in sidebar -> File Sharing -> Volumes & Browse modes -> select each folder -> click Share near the top right).
3. Enable both folders for automounting on clients (Server Admin -> server name in sidebar -> File Sharing -> Share Points-> select each folder -> Share Point tab under that -> Enable Automount option) with the default options (Directory: /LDAPv3/127.0.0.1, Protocol: AFP, Use for: User home folders and group folders). Be sure to click Save (not just OK in the dialog).
4. To migrate users, run Workgroup Manager, and change the home location for the users you want to move (select Accounts in the toolbar -> /LDAPv3/127.0.0.1 from the hidden pop-up menu under that -> User icon tab at the left -> select the user(s) you want to change -> Home tab on the right -> select the NetUsers option from the "Where" list). Then, for each user, run this command on the server: "sudo cp -Rp /Users/username /Volumes/External/NetUsers".
5. Similarly, move Group folders in WGM (Accounts -> /LDAP... -> Groups icon on left -> select groups to move -> Group Folder tab on right -> NetGroups in the list). Then, for each group, run "sudo cp -Rp /Groups/groupname /Volumes/External/NetGroups".
6. Test to make sure all is working before deleting the old user and group folders from /Users and /Groups (do NOT delete /Users and /Groups themselves, just the individual folders from under them).

Generate report to show all users and groups in Shared Services in EPM 11x

Hi,
Is there any way to generate a report (like a migration report or job status report) which can be generated through workspace/shared services 11.1.1.3 so that my admin can look at all the users and groups created. Something that I can view and probably print out? Any suggestions?
~Adeeba

Yes, I knew this one. This basically shows me the users and groups assigned specific provision access. Is there any way to view a report that shows which users and groups have access to dimensions of an individual planning application?
~Adeeba

Assigning Roles to Users and Groups

Hi,
We have installed EP 5.0 SP4...with Content Management...we configured the LDAP to Portal......all the users are maintained through LDAP only...the problem is assigning the Role's to user..here in portal how to assign the roles to the users...we are not getting the Role assignment option under Portal Admin TAB..is there any way to configure the roles to User's are Group's.....
it is an urgent assignment for me..help can be appreciated...
sudhir

Sudhir,
You can assign the roles to users and groups as below.
1. Select the System Administration in the top level navigtion
2. Select user administration
3. You can search for a specific user or a group from this iView.
4. Use the edit button to edit the profie of the user or group.
5. Search for the role in the search iView.
6. Add the role to the user of group and save.

Upgraded to 3.1 and lost all users and groups. How do we get them back?

We ran the update to Server 3.1 (from 3.0) on our Mavericks Mac-Mini Server.
Everything had been fine before the update, but now all users and groups have completely disappeared.
The only user we have is the main administrator log-in.
Since we verified that all of our data, wikis, and other items are still in place, it might be easier to just re-create the groups and users (and permission therein).
But, we cannot log into Workgroup Manager, nor can we add users/groups in the Server app (because it is "grayed-out").
Can somebody please provide a suggestion??
We are a small engineering firm with only 5 users, so it's not like this would take all day.
Thanks, Mike

Have you tried
sudo sso_util configure -r REALM_NAME -a diradmin afp
(cf. Lion Server: AFP users unable to authenticate with Kerberos after upgrading)in Apple Support ?
p.

Custom User and Group classes

Similar Messages

Maybe you are looking for