Decl J2EE auth and auth with JAAS with custom module

Hi Frank:
I have posted another msg where I was trying the non-custom Login module with no luck. In the meantime, I tried the custom module and still having problem. When I click on dlmtest.jsp it brings up the inbuilt login module and not the custom one. My db_schema is "SECURITYTESTER" and pwd = "oracle"
Hetre is my jazn-data.xml
<?xml version = '1.0' encoding = 'UTF-8' standalone = 'yes'?>
<jazn-data xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://xmlns.oracle.com/oracleas/schema/jazn-data-10_0.xsd" filepath="" OC4J_INSTANCE_ID="">
<jazn-loginconfig>
<application>
<name>DBLMTest</name>
<login-modules>
<login-module>
<class>oracle.sample.dbloginmodule.DBProcLM.DBProcLoginModule</class>
<control-flag>required</control-flag>
<options>
<option>
<name>debug</name>
<value>true</value>
</option>
<option>
<name>jdbcDriver</name>
<value>oracle.jdbc.driver.OracleDriver</value>
</option>
<option>
<name>application_realm</name>
<value>Online Trainings</value>
</option>
<option>
<name>plsql_procedure</name>
<value>DBPROCLM.GET_USER_AUTHENTICATION</value>
</option>
<option>
<name>db_schema</name>
<value>SECURITYTESTER</value>
</option>
<option>
<name>jdbcUrl</name>
<value>jdbc:oracle:thin:@localhost:1521:xe</value>
</option>
<option>
<name>db_schema_pw</name>
<value>oracle</value>
</option>
<option>
<name>log_level</name>
<value>ALL</value>
</option>
</options>
</login-module>
</login-modules>
</application>
</jazn-loginconfig>
</jazn-data>
orien-app is here
<?xml version = '1.0' encoding = 'windows-1252'?>
<!DOCTYPE orion-application PUBLIC "-//Evermind//DTD J2EE Application runtime 1.2//EN" "http://xmlns.oracle.com/ias/dtds/orion-application.dtd">
<orion-application>
<!--
<jazn provider="XML"
default-realm="jazn.com" location="./jazn-data.xml">
<property name="role.mapping.dynamic" value="true"/>
<property name="jaas.username.simple" value ="true" />
</jazn>
-->
<jazn provider="XML" location="./jazn-data.xml">
<property name="custom.loginmodule.provider" value="true"/>
<property name="role.mapping.dynamic" value="true"/>
</jazn>
</orion-application>
My application.xml
has
<?xml version = '1.0' standalone = 'yes'?>
<orion-application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://xmlns.oracle.com/oracleas/schema/orion-application-10_0.xsd" autocreate-tables="true" default-data-source="jdbc/OracleDS" schema-major-version="10" schema-minor-version="0">
<web-module id="defaultWebApp" path="../default-web-app"/>
<library path="C:\jdevstudio10132/j2ee/home/lib/DBLoginModule.jar"/>
So, why is it not bringing up the custom login module. And, I can't authenticate in this case as well.
Thanks for your help (and on your help on the non-customized version of my post)

Hi,
most likely the reason is that the deployed application name is not the same name you provided when configuring the LoginModule (DBLMTest). Its documented in the paper that comes with the LogiNmodules i wrote
Frank

Similar Messages

  • Client Auth  and SSL with Seeburger AS2 adapter

    Hello All,
    We are using the Seeburger AS2 adapter in our landscape and I am in the process of setting the same up and have made quite some progress in all my issues.
    and I  hope that you will be able to help me out.
    1. Server SSL on Receiver AS2 adapter
    I am sending a message from XI using the Receiver AS2 adapter to my AS2 test tool using Server SSL.
    This is working perfectly fine. In my AS2 adapter I have selected HTTPS as the protocol and the message goes via SSL to the target test tool, is processed and the MDN comes back to XI perfectly.
    The issue here is :
    Irrespective of what is provided in the Server Certificate ( Keystore) , the message goes to my target test tool. I even left this field blank with no certificate entry and still the SSL connection was established and the message went to the target system.
    Is there no validation that XI does here? I am lost what is the use of this entry Server Certificate if XI blindly accepts all SSL connections.
    I am using a Decentral Adapter Engine with LoadBalancer.
    2. Client Auth on Receiver AS2 Adapter
    I tried to perform Client Authentication by proving my Server's private key in the AS2 adapter. The corresponding public key is loaded in my partner's Keystore.
    XI error's with the error "SSL handshake failed - Bad Certificate" .
    I am not sure why XI is erroring out here and I have a feeling that I have misunderstood the use of the fields in the AS2 adapter,
    Server Certificate ( Keystore) and Private Key for Client Authentication.
    Has anyone tried this? If further details are needed, I will be able to furnish the same.
    Regards,
    Bhavesh

    Hello Jens,
    Thanks for your reply.
    1. The Encryption and Signature part of the Interface is working absolutely fine and I use the same concept highlighted by you - The Sender always signs the message with his private key and encrypts with message with the partner's public key in the corresponding agreement.
    2. Server SSL is also working perfectly fine, i.e, when XI initiates the connection the SSL connection is established to the partner.
    3. Mutual Auth was the issue where I was getting the bad certificate issue.
    To investigate further I moved the same setup to my Central Adapter Engine and all the issues I had described above seem to have vanished and things work exactly as I was expecting, ie.
    The field : Server Certificate (Keystore) is used to provide the Target System's Server SSL's public Certificate.
    The field : Private Key for Client Authentication is used where XI provides its own Server SSL's private key for Mutual / Client Authentication.
    The problem seems to be with my Decentral Adapter engine and not my central adapter engine and so I guess,
    1. I either have the incorrect certificates on my Decentral Adapter Engine.
    2. I also have 2 instances of a Decentral Adapter Engine with a Webdispatcher and so maybe the 2 Visual Admin's of the 2 Decentral AE are inconsistent.
    3. Maybe it was just a long day and I did something wrong
    Will investigate further for the root cause but I am glad that my concepts remain intact and things do work as I expected them to work.
    A blog on all this is on the cards sometime soon.
    Cheers,
    Bhavesh

  • RDP with 802.1x, machine and user auth and dynamic VLAN

    Hi,
    we have 802.1x implemented with machine and user auth. We also use dynamic VLAN assignment. Our client is AnyConnect 3.1. Operating system is Windows 7. With Windows XP, it works just fine.
    When we try to connect to the 802.1x auth desktop with RDP (desktop is machine authenticated, no user is logged in), we are able to authenticate but as soon as VLAN and IP address changes according to user authentication profile, RDP session is terminated. It is not just disconnected but remote user is logged out and AnyConnect reverts 802.1x session back to machine VLAN. We cannot login with RDP and just loop between machine-user-machine authentication.
    With this behavior the TermDD message (ID 56) can be seen in system log. Following the response 
    http://social.technet.microsoft.com/Forums/windows/en-US/b7814ec3-6a49-469c-8773-909c50415942/the-rdp-protocol-component-x224-detected-an-error-in-the-protocol-stream-and-has-disconnected-the
    , I was able to get rid of TermDD message but I still loop in machine-user-machine authentication.
    The following is TermDD message:
    +
    System
    Provider
    [  Name]
    TermDD
    EventID
    56
    [  Qualifiers]
    49162
    Level
    2
    Task
    0
    Keywords
    0x80000000000000
    TimeCreated
    [  SystemTime]
    2013-06-10T09:25:28.515308700Z
    EventRecordID
    26643
    Channel
    System
    Computer
    XTCSSPWA03.cen.csint.cz
    Security
    EventData
    \Device\Termdd
    10.190.64.208
    0000040002002C000000000038000AC00000000038000AC000000000000000000000000000000000410200D0
    Binary data:
    In Words
    0000: 00040000 002C0002 00000000 C00A0038 
    0008: 00000000 C00A0038 00000000 00000000
    0010: 00000000 00000000  D0000241
    In Bytes
    0000: 00 00 04 00 02 00 2C 00    ......,.
    0008: 00 00 00 00 38 00 0A C0   ....8..À
    0010: 00 00 00 00 38 00  0A C0   ....8..À
    0018: 00 00 00 00 00 00 00 00   ........
    0020: 00 00 00  00 00 00 00 00   ........
    0028: 41 02 00 D0               A..Ð
    Also AnyConnect shows that upon successful authentication and DHCP operation, it catches some exception and reverts back from user to machine VLAN:
    3876: XTCSSPWA03: 6 10 2013 11:24:44.259 -0100: %NAM-6-INFO_MSG: %[tid=1436][mac=1,6,d4:85:64:b8:43:61]: {94B69AD2-E98C-4C94-BBC8-A94DC3894FE2}: Authentication Success
    3877: XTCSSPWA03: 6 10 2013 11:24:44.259 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: {94B69AD2-E98C-4C94-BBC8-A94DC3894FE2} canceling existing DHCP work
    3878: XTCSSPWA03: 6 10 2013 11:24:44.259 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: ipv4: {94B69AD2-E98C-4C94-BBC8-A94DC3894FE2} stop
    3879: XTCSSPWA03: 6 10 2013 11:24:44.259 -0100: %NAM-7-DEBUG_MSG: %[tid=1436][comp=SAE]: NET (3) cdiOsIoctlSet: CDI_8023_FRAME_IO_ECHO, ifIndex(1), pData(0x0103FA38), dataLen(0) (cimdIo.cpp 2156)
    3880: XTCSSPWA03: 6 10 2013 11:24:44.259 -0100: %NAM-7-DEBUG_MSG: %[tid=1436][comp=SAE]: NET (3) cdiOsIoctlSet: echo (cimdIo.cpp 2270)
    3881: XTCSSPWA03: 6 10 2013 11:24:44.259 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: {94B69AD2-E98C-4C94-BBC8-A94DC3894FE2} creating a new DHCP work
    3882: XTCSSPWA03: 6 10 2013 11:24:44.259 -0100: %NAM-7-DEBUG_MSG: %[tid=1448]: Ipv4 {94B69AD2-E98C-4C94-BBC8-A94DC3894FE2}: executing: CancelCmd [state: COMPLETE]
    3883: XTCSSPWA03: 6 10 2013 11:24:44.259 -0100: %NAM-6-INFO_MSG: %[tid=1436][mac=1,6,d4:85:64:b8:43:61]: {94B69AD2-E98C-4C94-BBC8-A94DC3894FE2}: DHCP: Sending DHCP request
    3884: XTCSSPWA03: 6 10 2013 11:24:44.259 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: queueing DHCP work
    3885: XTCSSPWA03: 6 10 2013 11:24:44.259 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: ipv4: {94B69AD2-E98C-4C94-BBC8-A94DC3894FE2} start
    3886: XTCSSPWA03: 6 10 2013 11:24:44.259 -0100: %NAM-7-DEBUG_MSG: %[tid=1436][comp=SAE]: NET (3) cdiOsIoctlSet: CDI_8023_FRAME_IO_ECHO, ifIndex(1), pData(0x0103FA3C), dataLen(2) (cimdIo.cpp 2156)
    3887: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436][comp=SAE]: NET (3)  data follows ... (cimdIo.cpp 2159)
    3888: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436][comp=SAE]: NET (3)      08 06                                                .. (cimdIo.cpp 2159)
    3889: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436][comp=SAE]: NET (3) cdiOsIoctlSet: echo (cimdIo.cpp 2270)
    3890: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436][comp=SAE]: NET (3)  pEthTypes data follows ... (cimdIo.cpp 2273)
    3891: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436][comp=SAE]: NET (3)      06 08                                                .. (cimdIo.cpp 2273)
    3892: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: Ipv6 Connect {94B69AD2-E98C-4C94-BBC8-A94DC3894FE2} starting
    3893: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1448]: Ipv4 {94B69AD2-E98C-4C94-BBC8-A94DC3894FE2}: executing: StartCmd [state: COMPLETE]
    3894: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436][comp=SAE]: NET (0) S_ndisIoControl: returning cached xmitLinkSpeed: 100000000 bps (cimdIo.cpp 3558)
    3895: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436][comp=SAE]: NET (0) NDIS OID: ifIndex=1 GET OID_GEN_LINK_SPEED(0x10107) datalen=4, cbRW=4 cbNeeded=0 acErr=0 winErr=0 (cimdIo.cpp 3686)
    3898: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: Network CS-wired-pass: AccessStateMachine current state = ACCESS_CONNECTED, received adapterState = authenticated
    3899: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: Network CS-wired-pass: port authentication succeeded
    3900: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: Network CS-wired-pass: AccessStateMachine new state = ACCESS_CONNECTED
    3901: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: Ipv4 {94B69AD2-E98C-4C94-BBC8-A94DC3894FE2}: received Cancel event [state: COMPLETE]
    3902: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: Ipv4 {94B69AD2-E98C-4C94-BBC8-A94DC3894FE2}: state: COMPLETE -> INIT
    3903: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: Ipv4 {94B69AD2-E98C-4C94-BBC8-A94DC3894FE2}: received Get-Connectivity event [state: INIT]
    3904: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: Ipv4 {94B69AD2-E98C-4C94-BBC8-A94DC3894FE2}: state: INIT -> WAIT_FOR_CONNECTIVITY
    3905: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: Ipv4 Connectivity Result: IN_PROGRESS
    3906: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1448]: Ipv4 {94B69AD2-E98C-4C94-BBC8-A94DC3894FE2}: executing: GetConnectiviyCmd [state: WAIT_FOR_CONNECTIVITY]
    3907: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: Ipv6 Connectivity Result: FAILURE
    3908: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: Ipv4 {94B69AD2-E98C-4C94-BBC8-A94DC3894FE2}: received Check-Connectivity event [state: WAIT_FOR_CONNECTIVITY]
    3909: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: Ipv4 {94B69AD2-E98C-4C94-BBC8-A94DC3894FE2}: (initial) ipCfg: IP:10.190.95.74(255.255.255.248) GW:10.190.64.1
    3910: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1448]: Ipv4 {94B69AD2-E98C-4C94-BBC8-A94DC3894FE2}: executing: TestConnectivityCmd [state: WAIT_FOR_CONNECTIVITY]
    3911: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1468][comp=SAE]: API (3) event: complete (portWorkList.c 130)
    80: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAMSSO-7-DEBUG_MSG: %[tid=1524]: Tx CP Msg: <?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ssc="http://www.cisco.com/ssc" encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body>  <networkStateEvent>   <sequenceNumber>19</sequenceNumber>   <groupName>Local networks</groupName>   <networkName>CS-wired-pass</networkName>   <networkState>AcquiringIpAddress</networkState>   <adapterName>Broadcom NetXtreme Gigabit Ethernet</adapterName>   <serverVerifiedName>ise-2.csint.cz</serverVerifiedName>  </networkStateEvent> </SOAP-ENV:Body></SOAP-ENV:Envelope>
    3912: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1468][comp=SAE]: PORT (3) port: ARP_REQ (portMsg.c 731)
    3913: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1468][comp=SAE]: NET (3) cdiOsIoctlSet: CDI_8023_FRAME_IO_SEND, ifIndex(1), pData(0x024EEB40), dataLen(64) (cimdIo.cpp 2156)
    3914: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1468][comp=SAE]: NET (3)  data follows ... (cimdIo.cpp 2159)
    3915: XTCSSPWA03: 6 10 2013 11:24:44.275 -0100: %NAM-7-DEBUG_MSG: %[tid=1468][comp=SAE]: NET (3)      00 00 00 00 FF FF FF FF  FF FF D4 85 64 B8 43 61     ........ ....d.Ca      08 06 00 01 08 00 06 04  00 01 D4 85 64 B8 43 61     ........ ....d.Ca      0A BE 5F 4A 00 00 00 00  00 00 0A BE 40 01 00 00     .._J.... ....@...      00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00     ........ ........ (cimdIo.cpp 2159)
    3941: XTCSSPWA03: 6 10 2013 11:24:44.290 -0100: %NAM-7-DEBUG_MSG: %[tid=1436][comp=SAE]: NET (3) cdiOsIoctlSet: echo (cimdIo.cpp 2270)
    3942: XTCSSPWA03: 6 10 2013 11:24:44.290 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: Ipv4 Connectivity Result: SUCCESS
    3943: XTCSSPWA03: 6 10 2013 11:24:44.290 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: Ipv6 Connectivity Result: FAILURE
    3944: XTCSSPWA03: 6 10 2013 11:24:44.290 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: ACE: adapter SM current: state(STATE_AUTHENTICATED), event(EVENT_IP_CONNECTIVITY)
    3945: XTCSSPWA03: 6 10 2013 11:24:44.290 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: ACE: adapter SM state change: STATE_AUTHENTICATED -> STATE_CONNECTED
    3946: XTCSSPWA03: 6 10 2013 11:24:44.290 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: handleEventAndDoStateTransitionAction action : ACTION_IP_CONNECTIVITY
    3947: XTCSSPWA03: 6 10 2013 11:24:44.290 -0100: %NAM-7-DEBUG_MSG: %[tid=1436][comp=SAE]: NET (0) S_ndisIoControl: returning cached xmitLinkSpeed: 100000000 bps (cimdIo.cpp 3558)
    3948: XTCSSPWA03: 6 10 2013 11:24:44.290 -0100: %NAM-7-DEBUG_MSG: %[tid=1436][comp=SAE]: NET (0) NDIS OID: ifIndex=1 GET OID_GEN_LINK_SPEED(0x10107) datalen=4, cbRW=4 cbNeeded=0 acErr=0 winErr=0 (cimdIo.cpp 3686)
    1: XTCSSPWA03: 6 10 2013 11:24:54.007 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: DllGetClassObject CLSID: {25CBB996-92ED-457E-B28C-4774084BD562} LogLevel=0xF
    2: XTCSSPWA03: 6 10 2013 11:24:54.007 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: GetWrappedDllName: retrieved C:\windows\system32\authui.dll.
    3: XTCSSPWA03: 6 10 2013 11:24:54.022 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: LoadLib({25CBB996-92ED-457E-B28C-4774084BD562}): Attempting to load Dir=C:\windows\system32, FileName=authui.dll
    4: XTCSSPWA03: 6 10 2013 11:24:54.022 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: CredProvider(00000000001FC050) instantiated for CLSID:{25CBB996-92ED-457E-B28C-4774084BD562}
    5: XTCSSPWA03: 6 10 2013 11:24:54.022 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: DllGetClassObject CLSID: {3DD6BEC0-8193-4FFE-AE25-E08E39EA4063} LogLevel=0xF
    6: XTCSSPWA03: 6 10 2013 11:24:54.022 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: GetWrappedDllName: retrieved C:\windows\system32\authui.dll.
    7: XTCSSPWA03: 6 10 2013 11:24:54.022 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: LoadLib({3DD6BEC0-8193-4FFE-AE25-E08E39EA4063}): Attempting to load Dir=C:\windows\system32, FileName=authui.dll
    8: XTCSSPWA03: 6 10 2013 11:24:54.022 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: CredProvider(00000000001FC850) instantiated for CLSID:{3DD6BEC0-8193-4FFE-AE25-E08E39EA4063}
    9: XTCSSPWA03: 6 10 2013 11:24:54.022 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: DllGetClassObject CLSID: {503739D0-4C5E-4CFD-B3BA-D881334F0DF2} LogLevel=0xF
    10: XTCSSPWA03: 6 10 2013 11:24:54.022 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: GetWrappedDllName: retrieved C:\windows\System32\VaultCredProvider.dll.
    11: XTCSSPWA03: 6 10 2013 11:24:54.022 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: LoadLib({503739D0-4C5E-4CFD-B3BA-D881334F0DF2}): Attempting to load Dir=C:\windows\System32, FileName=VaultCredProvider.dll
    12: XTCSSPWA03: 6 10 2013 11:24:54.022 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: CredProvider(00000000003A30B0) instantiated for CLSID:{503739D0-4C5E-4CFD-B3BA-D881334F0DF2}
    13: XTCSSPWA03: 6 10 2013 11:24:54.038 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: DllGetClassObject CLSID: {6F45DC1E-5384-457A-BC13-2CD81B0D28ED} LogLevel=0xF
    14: XTCSSPWA03: 6 10 2013 11:24:54.038 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: GetWrappedDllName: retrieved C:\windows\system32\authui.dll.
    15: XTCSSPWA03: 6 10 2013 11:24:54.038 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: LoadLib({6F45DC1E-5384-457A-BC13-2CD81B0D28ED}): Attempting to load Dir=C:\windows\system32, FileName=authui.dll
    16: XTCSSPWA03: 6 10 2013 11:24:54.038 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: CredProvider(00000000003AF710) instantiated for CLSID:{6F45DC1E-5384-457A-BC13-2CD81B0D28ED}
    17: XTCSSPWA03: 6 10 2013 11:24:54.038 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: DllGetClassObject CLSID: {8BF9A910-A8FF-457F-999F-A5CA10B4A885} LogLevel=0xF
    18: XTCSSPWA03: 6 10 2013 11:24:54.038 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: GetWrappedDllName: retrieved SmartcardCredentialProvider.dll.
    19: XTCSSPWA03: 6 10 2013 11:24:54.038 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: LoadLib({8BF9A910-A8FF-457F-999F-A5CA10B4A885}): Attempting to load Dir=, FileName=SmartcardCredentialProvider.dll
    20: XTCSSPWA03: 6 10 2013 11:24:54.053 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: CredProvider(00000000003B7D70) instantiated for CLSID:{8BF9A910-A8FF-457F-999F-A5CA10B4A885}
    21: XTCSSPWA03: 6 10 2013 11:24:54.053 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: DllGetClassObject CLSID: {94596C7E-3744-41CE-893E-BBF09122F76A} LogLevel=0xF
    22: XTCSSPWA03: 6 10 2013 11:24:54.053 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: GetWrappedDllName: retrieved SmartcardCredentialProvider.dll.
    23: XTCSSPWA03: 6 10 2013 11:24:54.053 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: LoadLib({94596C7E-3744-41CE-893E-BBF09122F76A}): Attempting to load Dir=, FileName=SmartcardCredentialProvider.dll
    24: XTCSSPWA03: 6 10 2013 11:24:54.053 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: CredProvider(00000000003C03D0) instantiated for CLSID:{94596C7E-3744-41CE-893E-BBF09122F76A}
    25: XTCSSPWA03: 6 10 2013 11:24:54.053 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: DllGetClassObject CLSID: {AC3AC249-E820-4343-A65B-377AC634DC09} LogLevel=0xF
    26: XTCSSPWA03: 6 10 2013 11:24:54.053 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: GetWrappedDllName: retrieved C:\windows\System32\BioCredProv.dll.
    27: XTCSSPWA03: 6 10 2013 11:24:54.053 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: LoadLib({AC3AC249-E820-4343-A65B-377AC634DC09}): Attempting to load Dir=C:\windows\System32, FileName=BioCredProv.dll
    28: XTCSSPWA03: 6 10 2013 11:24:54.069 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: CredProvider(00000000003CABC0) instantiated for CLSID:{AC3AC249-E820-4343-A65B-377AC634DC09}
    29: XTCSSPWA03: 6 10 2013 11:24:54.069 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: DllGetClassObject CLSID: {B12744B8-5BB7-463A-B85E-BB7627E73002} LogLevel=0xF
    30: XTCSSPWA03: 6 10 2013 11:24:54.069 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: CClassFactory(00000000001FFF00)  CreateInstance calling CoCreateInstance on MS password cred prov
    31: XTCSSPWA03: 6 10 2013 11:24:54.069 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: DllGetClassObject CLSID: {6F45DC1E-5384-457A-BC13-2CD81B0D28ED} LogLevel=0xF
    32: XTCSSPWA03: 6 10 2013 11:24:54.069 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: GetWrappedDllName: retrieved C:\windows\system32\authui.dll.
    33: XTCSSPWA03: 6 10 2013 11:24:54.069 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: LoadLib({6F45DC1E-5384-457A-BC13-2CD81B0D28ED}): Attempting to load Dir=C:\windows\system32, FileName=authui.dll
    34: XTCSSPWA03: 6 10 2013 11:24:54.069 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: CredProvider(00000000003D3220) instantiated for CLSID:{6F45DC1E-5384-457A-BC13-2CD81B0D28ED}
    35: XTCSSPWA03: 6 10 2013 11:24:54.069 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: CredProvider(00000000003DB880) instantiated for CLSID:{B12744B8-5BB7-463A-B85E-BB7627E73002}
    36: XTCSSPWA03: 6 10 2013 11:24:54.069 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: DllGetClassObject CLSID: {E74E57B0-6C6D-44D5-9CDA-FB2DF5ED7435} LogLevel=0xF
    37: XTCSSPWA03: 6 10 2013 11:24:54.069 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: GetWrappedDllName: retrieved C:\windows\system32\certCredProvider.dll.
    38: XTCSSPWA03: 6 10 2013 11:24:54.069 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: LoadLib({E74E57B0-6C6D-44D5-9CDA-FB2DF5ED7435}): Attempting to load Dir=C:\windows\system32, FileName=certCredProvider.dll
    39: XTCSSPWA03: 6 10 2013 11:24:54.069 -0100: %NAMCP-7-DEBUG_MSG: %[tid=2680]: CredProvider(00000000003E3EE0) instantiated for CLSID:{E74E57B0-6C6D-44D5-9CDA-FB2DF5ED7435}
    3963: XTCSSPWA03: 6 10 2013 11:24:59.247 -0100: %NAM-7-DEBUG_MSG: %[tid=2460]: SysLib:DBG: .\src\os\win\osAsync_win.c:233: => SL_STATUS_NO_CONNECTION
    3964: XTCSSPWA03: 6 10 2013 11:24:59.247 -0100: %NAM-7-DEBUG_MSG: %[tid=2460]: SysLib:DBG: .\src\ipc\win\ipcPipeBase_win.c:102: => SL_STATUS_NO_CONNECTION
    3965: XTCSSPWA03: 6 10 2013 11:24:59.262 -0100: %NAM-7-DEBUG_MSG: %[tid=2460]: SysLib:DBG: .\src\ipc\win\ipcPipeBase_win.c:194: => SL_STATUS_NO_CONNECTION
    3966: XTCSSPWA03: 6 10 2013 11:24:59.262 -0100: %NAM-7-DEBUG_MSG: %[tid=2460]: SysLib:DBG: .\src\ipc\ipcFuncs.c:105: => SL_STATUS_NO_CONNECTION
    3967: XTCSSPWA03: 6 10 2013 11:24:59.262 -0100: %NAM-7-DEBUG_MSG: %[tid=2460]: CAUGHT: NoConnectionException
    3968: XTCSSPWA03: 6 10 2013 11:24:59.262 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: CoreLib:TRACE: context=acnam, thread join, ThreadImpl.cpp:58, m00585050, err=0(OS_OK), thread_id=2460
    3969: XTCSSPWA03: 6 10 2013 11:24:59.262 -0100: %NAM-7-DEBUG_MSG: %[tid=1436]: CoreLib:TRACE: context=acnam, thread join, ThreadImpl.cpp:58, m00585838, err=0(OS_OK), thread_id=3692
    89: XTCSSPWA03: 6 10 2013 11:25:06.367 -0100: %NAMSSO-7-DEBUG_MSG: %[tid=1228]: ServiceControlHandlerEx:WTS_SESSION_LOGOFF, Session ID: 1
    If we do not change VLAN from machine to user, it works just fine.
    Have anybody seen this problem? Have anybody fixed it?
    Thanx, Martin

    Hi,
    unfortunately not.
    I have gone through extensive troubleshooting from Microsoft and Cisco sides twice and the result is:
    1) AnyConnect performs EAPol logoff when it detects RDP session termination. So it goes from user to machine authentication
    2) Windows 7 performs RDP session termination when IP address changes due to the change of VLAN (from machine VLAN to user VLAN)
    Cisco claims that AnyConnect behavior is correct and Microsoft claims that they do not want to change this behavior (reset of RDP session).
    I can imagine that Cisco can detect whether RDP session was terminated due to the IP address change or not and do not revert back to machine authentication in such a case.
    In fact there was nobody at Cisco that was willing to listen to me or accept this like something that needs a fix. The only thing you can do is to enable "Extend connection beyond logoff". AnyConnect does not send EAPol logoff if it detects RDP session termination and you can establish another RDP session which does not fail and you stay connected with RDP.
    Martin

  • WLC2112 with Guest / Web-Auth and vlan

    Hi
    I'm trying to configure my WLC with guest SSID and vlan 10.
    The security is only set to Web-auth, and it is all working if the guest network is set to nativ vlan (1) But it seems that the http(s)://1.1.1.1/login.html is not reacheble from the guest SSID/VLAN??
    Please help.
    Management IP Address 192.168.14.252
    Software Version 6.0.182.0
    Emergency Image Version
    I have tried with ver. 5.2 also -

    I think that 1.1.1.1 is only reachable from a wireless client during webauth. They should not be able to reach that address once they have passed through the web auth page.
    Don't know if that helps, or not.

  • [SOLVED] MS-CHAP[v2] auth, Microsoft VPN client setup with pptpclient

    Hi,
    Have just started with Archlinux and trying to set up a VPN tunnel using pptp.
    I have been following the guide at:
    https://wiki.archlinux.org/index.php/Mi … pptpclient
    I want to connect to a service from www.ipredator.se
    Info from them when connection to Windows XP are:
    Enter company name "Ipredator". Click Next.
    Enter "vpn.ipredator.se" as "Host name or IP address".
    I have been given a <USERNAME> and <PASSWORD> from them.
    I got the VPN tunnel up and running in Ubuntu with the settings.
    Only enabled MSCHAPv2
    use MPPE 128 bit
    and allow data compression, BSD, Deflate and TCP header.
    My configuration files:
    options.pptp
    # $Id: options.pptp,v 1.3 2006/03/26 23:11:05 quozl Exp $
    # Sample PPTP PPP options file /etc/ppp/options.pptp
    # Options used by PPP when a connection is made by a PPTP client.
    # This file can be referred to by an /etc/ppp/peers file for the tunnel.
    # Changes are effective on the next connection. See "man pppd".
    # You are expected to change this file to suit your system. As
    # packaged, it requires PPP 2.4.2 or later from [url]http://ppp.samba.org[/url]/
    # and the kernel MPPE module available from the CVS repository also on
    # [url]http://ppp.samba.org[/url]/, which is packaged for DKMS as kernel_ppp_mppe.
    # Lock the port
    lock
    # Authentication
    # We don't need the tunnel server to authenticate itself
    noauth
    # We won't do PAP, EAP, CHAP, or MSCHAP, but we will accept MSCHAP-V2
    # (you may need to remove these refusals if the server is not using MPPE)
    refuse-pap
    refuse-eap
    refuse-chap
    refuse-mschap
    # Compression
    # Turn off compression protocols we know won't be used
    nobsdcomp
    nodeflate
    # Encryption
    # (There have been multiple versions of PPP with encryption support,
    # choose with of the following sections you will use. Note that MPPE
    # requires the use of MSCHAP-V2 during authentication)
    # [url]http://ppp.samba.org[/url]/ the PPP project version of PPP by Paul Mackarras
    # ppp-2.4.2 or later with MPPE only, kernel module ppp_mppe.o
    # Require MPPE 128-bit encryption
    # require-mppe-128
    # [url]http://polbox.com/h/hs001/[/url] fork from PPP project by Jan Dubiec
    # ppp-2.4.2 or later with MPPE and MPPC, kernel module ppp_mppe_mppc.o
    # Require MPPE 128-bit encryption
    # mppe required,stateless
    chap-secrets
    # Secrets for authentication using CHAP
    # client server secret IP addresses
    <USERNAME> pptpd <PASSWORD> *
    I named my tunnel "ipredator"
    /etc/ppp/peers/ipredator
    pty "pptp vpn.ipredator.se --nolaunchpppd"
    name <USERNAME>
    remotename Ipredator
    require-mppe-128
    file /etc/ppp/options.pptp
    ipparam ipredator
    When I try to connect I get following:
    [root@archlinux ppp]# pon $TUNNEL ipredator dump logfd 2 nodetach
    pppd options in effect:
    nodetach # (from command line)
    logfd 2 # (from command line)
    dump # (from command line)
    noauth # (from /etc/ppp/options.pptp)
    refuse-pap # (from /etc/ppp/options.pptp)
    refuse-chap # (from /etc/ppp/options.pptp)
    refuse-mschap # (from /etc/ppp/options.pptp)
    refuse-eap # (from /etc/ppp/options.pptp)
    name <USERNAME> # (from /etc/ppp/peers/ipredator)
    remotename Ipredator # (from /etc/ppp/peers/ipredator)
    # (from /etc/ppp/options.pptp)
    pty pptp vpn.ipredator.se --nolaunchpppd # (from /etc/ppp/peers/ipredator)
    crtscts # (from /etc/ppp/options)
    # (from /etc/ppp/options)
    asyncmap 0 # (from /etc/ppp/options)
    lcp-echo-failure 4 # (from /etc/ppp/options)
    lcp-echo-interval 30 # (from /etc/ppp/options)
    hide-password # (from /etc/ppp/options)
    ipparam ipredator # (from /etc/ppp/peers/ipredator)
    proxyarp # (from /etc/ppp/options)
    nobsdcomp # (from /etc/ppp/options.pptp)
    nodeflate # (from /etc/ppp/options.pptp)
    require-mppe-128 # (from /etc/ppp/peers/ipredator)
    noipx # (from /etc/ppp/options)
    Using interface ppp0
    Connect: ppp0 <--> /dev/pts/1
    MPPE required, but MS-CHAP[v2] auth not performed.
    Connection terminated.
    [root@archlinux ppp]#
    I have not managed to understand way MS-CHAP[v2] auth is not performed.
    Any ideas on what I have missed during my configuration would be most appreciated!
    use code tags instead of quote since they provide scrollers and keep the thread from becoming a mile long -- Inxsible
    Thank you!
    Regards,
    /Christer
    Last edited by agkbill (2011-06-14 15:23:15)

    The problem was that <PASSWORD> was never found.
    What is written after "remotename" in peers file in the guide "PPTP" is used to find the password in chap-secreds.
    But in the guide chap-secrets look like "<USERNAME> pptpd <PASSWORD> *".
    Consecuently <PASSWORD> will never be found. It should have been  "<USERNAME> PPTP <PASSWORD> *" then it would have worked OK.
    The solution was to understand how password was found.
    require-mppe-128 works fine as well.
    Now it looks like this.
    # Secrets for authentication using CHAP
    # client server secret IP addresses
    <USERNAME> PPTP <PASSWORD> *
    pty "pptp vpn.ipredator.se --nolaunchpppd"
    lock
    noauth
    nobsdcomp
    nodeflate
    name <USERNAME>
    remotename PPTP
    require-mppe-128
    #file /etc/ppp/options.pptp
    ipparam ipredator
    Output:
    [root@archlinux ppp]# pon ipredator debug logfd 2 nodetach
    using channel 14
    Using interface ppp0
    Connect: ppp0 <--> /dev/pts/1
    sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x7540313b> <pcomp> <accomp>]
    rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0xc615076a> <pcomp> <accomp>]
    sent [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0xc615076a> <pcomp> <accomp>]
    rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x7540313b> <pcomp> <accomp>]
    sent [LCP EchoReq id=0x0 magic=0x7540313b]
    rcvd [LCP EchoReq id=0x0 magic=0xc615076a]
    sent [LCP EchoRep id=0x0 magic=0x7540313b]
    rcvd [CHAP Challenge id=0x46 <be769cd654150cc3dc0fd20bc73c03>, name = "pptpd"]
    sent [CHAP Response id=0x46 <6ce74a85ab09e4ae223bc85f679395f0000000000000000dbb8dc66e8950ab46831b62f5815e015b1e72de1e01a4d00>, name = "<USERNAME>"]
    rcvd [LCP EchoRep id=0x0 magic=0xc616076a]
    rcvd [CHAP Success id=0x46 "S=2694D1D727F2B8C8E402125EA401750011F24F20"]
    CHAP authentication succeeded
    sent [CCP ConfReq id=0x1 <mppe +H -M +S -L -D -C>]
    rcvd [CCP ConfReq id=0x1 <mppe +H -M +S -L -D -C>]
    sent [CCP ConfAck id=0x1 <mppe +H -M +S -L -D -C>]
    rcvd [CCP ConfAck id=0x1 <mppe +H -M +S -L -D -C>]
    MPPE 128-bit stateless compression enabled
    sent [IPCP ConfReq id=0x1 <compress VJ 0f 01> <addr 0.0.0.0>]
    rcvd [IPCP ConfReq id=0x1 <compress VJ 0f 01> <addr x.x.x.x>]
    sent [IPCP ConfAck id=0x1 <compress VJ 0f 01> <addr x.x.x.x>]
    rcvd [IPCP ConfNak id=0x1 <addr 93.182.150.56>]
    sent [IPCP ConfReq id=0x2 <compress VJ 0f 01> <addr x.x.x.x>]
    rcvd [IPCP ConfAck id=0x2 <compress VJ 0f 01> <addr x.x.x.x>]
    Cannot determine ethernet address for proxy ARP
    local IP address
    remote IP address x.x.x.x
    Script /etc/ppp/ip-up started (pid 1778)
    Script /etc/ppp/ip-up finished (pid 1778), status = 0x0
    All the best!
    /Christer

  • How to use GSS and JAAS with kerberos

    Hi,
    I am new to this subject, I have setup a kerberos server on win 2000, and i have registered my other servers to it, this setup works fine , now what i have to do is the following
    1, Display a HTML page where i will take the user id and password for domain 1,
    2 Validate this user id and password using JAAS
    3 Create a connection object with domain 2, (which is AS400)
    So how do i setup my websphere to do so, also can any one provide java code to get GSS credentials and create connection to any other server
    Ashish

    Look for "Single Sign-on Using Kerberos in Java" in google or on Sun's web site. Maybe this paper will help you.
    Claude

  • How to upload a file into server using j2ee jsp and servlet with bean?

    How to upload a file into server using j2ee jsp and servlet with bean? Please give me the reference or url about how to do that. If related to struts is more suitable.
    Anyone help me please!

    u don't need j2ee and struts to do file uploading. An example is as such
    in JSP. u use the <input> file tag like
    <input type="file"....>You need a bean to capture the file contents like
    class FileUploadObj {
        private FormFile srcFile;
        private byte[] fileContent;
        // all the getter and setter methods
    }Then in the servlet, you process the file for uploading
        * The following loads the uploaded binary data into a byte Array.
        FileUploadObj form = new FileUploadObj();
        byte[] byteArr = null;
        if (form.signFile != null) {
            int filesize = form.srcFile.getFileSize();
            byteArr = new byte[filesize];
            ByteArrayInputStream bytein = new ByteArrayInputStream (form.srcFile.getFileData());
            bytein.read(byteArr);
            bytein.close();
            form.setFileContent(byteArr);
        // Write file content using Writer class into the destination file in the server.
        ...

  • Problems using JAAS with EJB 3.0 on JBoss 4.0.4-GA

    Hello all,
    I am trying to build a very simple JavaEE application with JAAS, but I getting mad.
    I have an EAR packed with a WAR module an EJB JAR module and a JAR with other classes. Struts is the MVC framework and EJB 3.0 is been used.
    First of all, I configured the "login-config.xml" file within /conf directory in JBoss, like this:
    <application-policy name="exemplo1">
         <authentication>
              <login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag="required">
                   <module-option name="dsJndiName">java:jdbc/Infra_Seguranca</module-option>
                   <module-option name="principalsQuery">SELECT COD_USUARIO AS Password FROM USUARIO WHERE COD_USUARIO=?</module-option>
                   <module-option name="rolesQuery">SELECT NOME_ROLE AS Roles, 'Roles' AS RoleGroups FROM ROLE_USUARIO WHERE COD_USUARIO=?</module-option>
              </login-module>
         </authentication>
    </application-policy>Next I configured the "web.xml" file like this:
    <security-constraint>
         <web-resource-collection>
              <web-resource-name>Restricted</web-resource-name>
              <description>Declarative security tests</description>
              <url-pattern>*.do</url-pattern>
         </web-resource-collection>
         <auth-constraint>
              <role-name>xxx</role-name>
         </auth-constraint>
         <user-data-constraint>
              <description>no description</description>
              <transport-guarantee>NONE</transport-guarantee>
         </user-data-constraint>
    </security-constraint>
    <login-config>
         <auth-method>FORM</auth-method>
         <realm-name>exemplo1</realm-name>
         <form-login-config>
              <form-login-page>/login.jsp</form-login-page>
              <form-error-page>/loginErro.jsp</form-error-page>
         </form-login-config>
    </login-config>
    <security-role>
         <description>Role xxx</description>
         <role-name>xxx</role-name>
    </security-role>Notice that I am using the "xxx" role to protect the "*.do" URL pattern.
    The "jboss-web.xml" is like this:
    <?xml version="1.0"?>
    <jboss-web>
         <security-domain>java:/jaas/exemplo1</security-domain>
    </jboss-web>As it is, it works perfectly, which means, every time I try to access a "*.do" URL it verifies whether I am authenticated and have authroization or not. If not, the login page shows up.
    Now I wanna to be able to also protect my EJBs.
    My Stateless Session Bean is implemented as follow:
    @RolesAllowed("yyy")
    @Stateless(name="UserManagement")
    public class UserManagementBean implements UserManagement {
         public void add(User user) {
    }When I run all this, the container simply igoners the @RolesAllowed("yyy") annotation and allow the EJB execution.
    If I add the "jboss.xml" file, like this:
    <?xml version="1.0"?>
    <jboss>
         <security-domain>java:/jaas/exemplo1</security-domain>
    </jboss>I start getting this stack trace:
    ERROR [UsersRolesLoginModule] Failed to load users/passwords/role files
    java.io.IOException: No properties file: users.properties or defaults: defaultUsers.properties found
    at org.jboss.security.auth.spi.Util.loadProperties(Util.java:313)
    at org.jboss.security.auth.spi.UsersRolesLoginModule.loadUsers(UsersRolesLoginModule.java:186)
    at org.jboss.security.auth.spi.UsersRolesLoginModule.createUsers(UsersRolesLoginModule.java:200)
    at org.jboss.security.auth.spi.UsersRolesLoginModule.initialize(UsersRolesLoginModule.java:127)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    ... Am I missing something? What do I have to do to get JAAS working fine with my EJBs? Do I have to also configure and/or provide "ejb-jar.xml" ???
    Thanks
    Daniel

    Using @SecurityDomain("exemplo1") in my EJB and NOT providing jboss.xml, it works.
    @SecurityDomain("exemplo1")
    @RolesAllowed("yyy")
    @Stateless(name="UserManagement")
    public class UserManagementBean implements UserManagement {
      public void add(User user) {
    }Damn! This is some serious shit... I don�t want to configure this in every single EJB.
    EJB 3.0 is nice, but some small trivial details like this and others, that was forgotten by Sun, piss me off!

  • Has anyone managed to get Authorization working with JAAS from CusLoginMod?

    Hi everybody,
    I am on a standalone oc4j 10.1.3.1.0
    I want to be able to access a private resource using form based authentication
    and I would like to use JAAS from with a custom login module.
    The authentication part works just fine but the authorization doesn't seem to happen.
    Both login() and commit() from my LoginModule are called and after authentication takes place, the subject is populated with the right Principals, in my case "testers".
    This Subject then it should be matched against the <security-role> defined in my application's web.xml
    This is the part from my application's web.xml which holds the security information.
    <security-role>
    <description>Online User</description>
    <role-name>testers</role-name>
    </security-role>
    <security-constraint>
    <web-resource-collection>
    <web-resource-name>access to the private application</web-resource-name>
    <url-pattern>/faces/user/*</url-pattern>
    </web-resource-collection>
    <!-- authorization -->
    <auth-constraint>
    <role-name>testers</role-name>
    </auth-constraint>
    <user-data-constraint>
    <transport-guarantee>NONE</transport-guarantee>
    </user-data-constraint>
    </security-constraint>
    <login-config>
    <auth-method>FORM</auth-method>
    <form-login-config>
    <form-login-page>protected.htm</form-login-page>
    <form-error-page>error.jspx</form-error-page>
    </form-login-config>
    </login-config>
    Has anyone faced this scenario before?
    Any advices much appreciated
    thank you.

    I can't see what am I missing if I'm missing something.
    This is my orion-application.xml
    <orion-application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://xmlns.oracle.com/oracleas/schema/orion-application-10_0.xsd">
    <jazn provider="XML" jaas-mode="doAsPrivileged" location="">
    <property name="role.mapping.dynamic" value="true"></property>
    <property name="custom.loginmodule.provider" value="true"></property>
    </jazn>
    <jazn-loginconfig>
    <application>
    <name>JAAS</name>
    <login-modules>
    <login-module>
    <class>jaas.JAASLoginModule</class>
    <!-- <class>jaas.SampleLoginModule</class> -->
    <control-flag>required</control-flag>
    <options>
    <option>
    <name>debug</name>
    <value>true</value>
    </option>
    <option>
    <name>log_level</name>
    <value>ALL</value>
    </option>
    </options>
    </login-module>
    </login-modules>
    </application>
    </jazn-loginconfig>
    </orion-application>

  • Conflict of weblogic with jaas.jar

    Hi there,
    I am using weblogic6.0+sp1 for JAAS simple and SSL authentication. Sun's
    implementation class com.sun.security.auth.login.ConfigFile in jaas.jar
    is conflict with the Config class I implemented that extends
    Configuration to parse the login policy file and return the array of
    AppConfigurationEntry. If this jaas.jar gets picked up before
    weblogic.jar (For some jdk version, this jar is put under the jdk's
    lib/ext directory) the sun's implementation will be picked up instead of
    mine and this will results in failure. I am wandering if this is a bug
    or not?
    Thanks,
    Cathy

    This has nothing to do with the class name, since both my implementation and
    sun's are subclass of Configuration class. Runtime, it will pick up sun's if
    jaas.jar is put in front of weblogic.jar.
    Hellen Andersen wrote:
    An aside related question: isn't jaas.jar always installed in lib/ext?
    Otherwise, couldn't you rename your ConfigFile class so it doesn't match
    Sun's?
    "Cathy Wei" <[email protected]> wrote in message
    news:[email protected]..
    Hi there,
    I am using weblogic6.0+sp1 for JAAS simple and SSL authentication. Sun's
    implementation class com.sun.security.auth.login.ConfigFile in jaas.jar
    is conflict with the Config class I implemented that extends
    Configuration to parse the login policy file and return the array of
    AppConfigurationEntry. If this jaas.jar gets picked up before
    weblogic.jar (For some jdk version, this jar is put under the jdk's
    lib/ext directory) the sun's implementation will be picked up instead of
    mine and this will results in failure. I am wandering if this is a bug
    or not?
    Thanks,
    Cathy

  • Authorization with JAAS in JSF with facelets

    hi,
    can u please hint me where i did mistake.. i clearly mention what i did and what i getting ..i did this in jsf1.2,tomcat6.x
    i did JAAS authentication in jsf with facelets.but i am unable to do the authorization with JAAS in jsf
    after getting authentication i put the subject in session. if i print the values in suject i got the following out put
    Subject:
    Principal: TypedPrincipal: hari [USER] // user name
    Principal: TypedPrincipal: admin [GROUP] // user role.
    now i want to authorization based on the role.
    for this i wrote policy file --principal.policy like this
    grant Principal com.alw.reports.jaas.TypedPrincipal "admin" {
        permission com.alw.reports.jaas.ViewIdPermission "*";
    grant Principal com.alw.reports.jaas.TypedPrincipal "hari" {
        permission com.alw.reports.jaas.ViewIdPermission "*";
    grant Principal com.alw.reports.jaas.TypedPrincipal "user" {
        permission com.alw.reports.jaas.ViewIdPermission "/contents.jsp";
    };and i set the path for this policy file like
                  System.setProperty("java.security.policy", "policy file location" );when i run my application i am getting login page after that i gave username and passwed. it is getting authentication .. but not able to displaying next page that is /pages/welcome.xhtml but directly it is showin /pages/error.xhtml
    i am getting following error
    java.security.AccessControlException: access denied (com.alw.reports.jaas.ViewIdPermission /pages/welcome.xhtml)
         at java.security.AccessControlContext.checkPermission(Unknown Source)
         at java.security.AccessController.checkPermission(Unknown Source)
         at java.lang.SecurityManager.checkPermission(Unknown Source)
         at com.alw.reports.jaas.JAASHelper$1.run(JAASHelper.java:87)
         at java.security.AccessController.doPrivileged(Native Method)
         at javax.security.auth.Subject.doAsPrivileged(Unknown Source)
         at com.alw.reports.jaas.JAASHelper.permitionToAccessViewId(JAASHelper.java:83)
         at com.alw.reports.jaas.JAASActionListener.processAction(JAASActionListener.java:65)
         at javax.faces.component.UICommand.broadcast(UICommand.java:106)
         at org.ajax4jsf.component.AjaxViewRoot.processEvents(AjaxViewRoot.java:184)
         at org.ajax4jsf.component.AjaxViewRoot.broadcastEvents(AjaxViewRoot.java:162)
         at org.ajax4jsf.component.AjaxViewRoot.processApplication(AjaxViewRoot.java:350)
         at org.apache.myfaces.lifecycle.LifecycleImpl.invokeApplication(LifecycleImpl.java:316)
         at org.apache.myfaces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:86)
         at javax.faces.webapp.FacesServlet.service(FacesServlet.java:106)
         at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
         at org.ajax4jsf.webapp.BaseXMLFilter.doXmlFilter(BaseXMLFilter.java:141)
         at org.ajax4jsf.webapp.BaseFilter.doFilter(BaseFilter.java:281)
         at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
         at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
         at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
         at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
         at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
         at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
         at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:263)
         at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)
         at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:584)
         at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
         at java.lang.Thread.run(Unknown Source)
    my faces-config.xml
    <navigation-rule>
              <display-name>pages/login</display-name>
              <from-view-id>/pages/login.xhtml</from-view-id>
              <navigation-case>
                   <from-outcome>loginSuccess</from-outcome>
                   <to-view-id>/pages/welcome.xhtml</to-view-id>
              </navigation-case>
         </navigation-rule>
    <navigation-case>
                   <from-outcome>errorpage</from-outcome>
                   <to-view-id>
                        /pages/error.xhtml
                   </to-view-id>
              </navigation-case>my command button in login.xhtml
                             <td align="center" colspan="2">
                                  <h:commandButton value="Reset" type="reset"/>
                                  <h:commandButton   action="loginSuccess"
                                       id="login" value="Login" />
                             </td>my actionlister
    package com.alw.reports.jaas;
    import javax.faces.component.UIOutput;
    import javax.faces.context.FacesContext;
    import javax.faces.event.AbortProcessingException;
    import javax.faces.event.ActionEvent;
    import javax.faces.event.ActionListener;
    import javax.security.auth.Subject;
    public class JAASActionListener implements ActionListener   {
         private ActionListener parent = null;
         public JAASActionListener(javax.faces.event.ActionListener parent) {
              System.out.println("-------------- in JAASActionListener ;");
           this.parent = parent;
         public void processAction(ActionEvent event)
           throws AbortProcessingException {
              System.out.println("-------------- in processAction ;");
           FacesContext context = FacesContext.getCurrentInstance();
           UIOutput comp = null;
           String userid = null, password = null;
           JAASHelper jaasHelper = new JAASHelper();
           // Check to see if they are on the login page.
           boolean onLoginPage = (-1 != context.getViewRoot().getViewId().lastIndexOf("login")) ? true : false;
           if (onLoginPage) {
             if (null != (comp = (UIOutput)
               context.getViewRoot().findComponent("helloForm:username"))) {
               userid = (String) comp.getValue();
             if (null != (comp = (UIOutput)
               context.getViewRoot().findComponent("helloForm:password"))) {
               password = (String) comp.getValue();
             // If JAAS authentication failed
             if (!jaasHelper.authenticate(userid, password)) {
               context.getApplication().getNavigationHandler().handleNavigation(context, null, "login");
               return;
             else {
               // Subject must not be null, since authentication succeeded
                  System.out.println("----------- setting the subjects in context in  ActionListner ");
               assert(null != jaasHelper.getSubject());
               // Put the authenticated subject in the session.
               System.out.println("---- putting the authenicated subject in the seesion ");
               context.getExternalContext().getSessionMap().put("JAASSubject",jaasHelper.getSubject());
           parent.processAction(event);
           Subject subject=(Subject)context.getExternalContext().getSessionMap().get("JAASSubject");
          System.out.println("subject after parent process action>>>>>>>>>>>>>>>>>>>>>"+subject);
          assert(null != subject);
          if(!jaasHelper.permitionToAccessViewId(subject,context,context.getViewRoot().getViewId())){
              context.getApplication().getNavigationHandler().handleNavigation(context, null, "errorpage");
    }can u please hint me where i did mistake
    thanks in advance

    gbabu wrote:
    My doubt is based on that subject , how to write policy file and how to call doAsPrivileged() mehod on that Subject in order to navigate web pages.how to provide web pages permission for particular role in policy file..
    For example i have three pages login.xhtml,user.xhtml,admin.xhtml.
    1> if the logged in person is admin, then we want to display admin.xhtml
    2> if the loggend is person is user , then we want to display user.xhtml
    untill now i did and found who is logged in and what are his type( admin or user) .now i want configure the web.xml and faces-config.xml based on policy fileTo the best of my knowledge, there is nothing in the standard NavigationHandler which accounts for JAAS security. If you wanted, you could create a custom NavigationHandler to do this. If you think the idea is worthy enough, you could issue an enhancement request to the specification ([https://javaserverfaces-spec-public.dev.java.net/]).

  • MAB and 802.1x issues with IP-phone

    I'm trying to use 802.1x to authenticate clients on my network with dynamic VLAN assignment from RADIUS. We have IP-Phones(powered by PoE) that only supports EAP-MD5, and we would rather use MAB(it also uses LLDP-MED for some settings) to authenticate the phones using the MAC-range from the phones vendor. The following scenario works perfect:
    Connect the phone and let it boot up(takes a while) and authenticate with MAB.
    Connect a computer in the phones data-port and let it authenticate with 802.1x(or fail and reach guest-vlan)
    However, the following scenario doesn't work:
    The computer is already connected to the phone
    The phone is then connected to the switch
    What happends now is that the computer is authenticated using 802.1x before the phone boots up and get's authenticated with MAB. When the phone is ready, it's authenticated with MAB and everything works. However, after a short period(let's say a minute), using `debug authentication all`, we see a "NEW LL MAC: phones mac" message(which is weird since the mac has already been MAB-authenticated), and then we are unable to contact the phone using ping. When I check `show mac address-table` it has now moved the mac from `Port Gi 0/12` to `Port Drop`. However, if I check `show mab interface Gi 0/12` or `show authentication sessions` it lists the phones-mac as `mab auth sucess `.
    Can anyone explain why the first scenario works, and not the second?
    The switch is a 3560E PoE 24p with IOS 12.2.58SE2. Sample of the switch-config:
    network-policy profile 1
    voice vlan 90
    interface GigabitEthernet0/12
    switchport mode access
    network-policy 1
    authentication control-direction in
    authentication event fail retry 1 action authorize vlan 60
    authentication event server dead action authorize vlan 60
    authentication event no-response action authorize vlan 60
    authentication event server alive action reinitialize
    authentication host-mode multi-domain
    authentication order mab dot1x
    authentication priority mab dot1x
    authentication port-control auto
    authentication periodic
    authentication violation replace
    mab
    dot1x pae authenticator
    dot1x timeout tx-period 5
    dot1x max-reauth-req 1
    spanning-tree portfast
    Btw, when we tried authenticating the phones using 802.1x too (EAP-MD5), there are NO problems in any of the scenarios. However, we want to use MAB instead of 802.1x to avoid the requirement of configuring the phones with a username and password. The RADIUS response was the same when using 802.1x as it is with MAB for the phones (including device-traffic-class=voice AV-pair).

    Hey. Yes, as specified in the last sentence in my post, the phone is placed in the Voice Domain, and both RADIUS and LLDP-MED (network policy profile 1) specifies voice vlan as 90.
    The weird thing is that everything works fine if both use 802.1x, and that there is only a problem when phone(using MAB) already has the computer connected to it, when the phone is turned on(connected to PoE-switch). It must be because the computer boots up and authenticates first I think.
    The phones are Snom 821.

  • APO roles and auth objects

    Hello all,
    Can someone tell me the most common used Tcodes, roles and auth objects in SAP APO - DP and APO-SNP security
    thanks

    I was going to type them out but luckily for me found this link to the DP & SNP auth objects - the info there is as detailed as anything else I have seen
    http://help.sap.com/saphelp_scm50/helpdata/en/21/f6253b90e48743e10000000a11402f/content.htm
    There is a list of useful APO transactions here
    http://help.sap.com/bp_scmv241/documentation/SCM_AIO_BP_Function_List.xls
    I can't help with the standard roles as I build my own.

  • HTTP Basic Auth and Proxy Auth

    Hi,
    i have a problem with the authentication against a proxy server and against a content provider. At first I have to authenticate against the proxy to get "free internet". The next step is to authenticate against the content provider to get a html or xml file.
    The following source code runs very good in Eclipse, i.e. as JUnitTest. But If I execute the same code within a weblogic server, I will get an error (not authenticated). I believe I get this message from the content provider and not from the proxy because If I test this code within the weblogic server and with no authentication (i.e. google needs no authentication), I will get a valide xml/html file.
    StringBuffer sb = new StringBuffer();
              SimpleAuthenticator simple = new SimpleAuthenticator("joeuser","a.b.C.D"); //from openbook
              Authenticator.setDefault(simple);
              String strUrl = "http://www.rahul.net/joeuser/";
              URL url = null;
              try {
                   url = new URL(strUrl);
              } catch (MalformedURLException e) {
                   // TODO Auto-generated catch block
                   e.printStackTrace();
              URLConnection conn = null;
              InetSocketAddress addr = new InetSocketAddress("proxy.domain",8080);
              Proxy proxy = new Proxy(Proxy.Type.HTTP, addr);
              try {
                   conn = url.openConnection(proxy);
              } catch (IOException e) {
                   // TODO Auto-generated catch block
                   e.printStackTrace();
              String proxyStr = "username" + ":" + "passwordl";
              String encoded = new String(Base64.encodeBase64(proxyStr.getBytes()));
              conn.setRequestProperty("Proxy-Authorization", "Basic " + encoded);
              // get http status code which is located in header field 0
              String status = conn.getHeaderField(0);
              if (status.contains("200")) {
                   BufferedReader in = null;
                   try {
                        in = new BufferedReader(new InputStreamReader(conn.getInputStream(),
                                  "ISO-8859-1"));
                        String inputLine;
                        while ((inputLine = in.readLine()) != null) {
                             sb.append(inputLine);
                        in.close();
                   } catch (UnsupportedEncodingException e) {
                        // TODO Auto-generated catch block
                        e.printStackTrace();
                   } catch (IOException e) {
                        // TODO Auto-generated catch block
                        e.printStackTrace();
              else {
                   System.out.println("Error");
              System.out.println(sb.toString());
    public class SimpleAuthenticator
    extends Authenticator
         private String username,
         password;
         public SimpleAuthenticator(String username,String password)
              this.username = username;
              this.password = password;
         protected PasswordAuthentication getPasswordAuthentication()
              return new PasswordAuthentication(
                        username,password.toCharArray());
    Does somebody know a solution? I need the authentication against proxy and content provider in "one application".
    Thank you very much,
    André

    I typically have used Apache Commons HttpClient for anything but trivial URL connections, and especially when combining both basic auth and proxy auth. When you use it, be aware of the "preemptive authentication" flag. One server I worked with didn't send the correct parameters back on particular requests, so I had to turn on this flag to get it to work.

  • BASIC Auth and WSDL in WebLogic 7

    I want to protect my web service URI with HTTP basic authentication. I've modified
    the web.xml and protected my web service URI and all works fine. However, this
    also protects the dynamically generated WSDL URL.
    Is there a way to pass the user/password to the JAX-RPC client for the WSDL URL?
    If not, what is the best way to expose the WSDL through a different unprotected
    URI while still dynamically generating it?
    Mike

    I am aware that this is an old post, but I have never seen a good answer for this
    question and have been struggling with it myself. How do you protect web services
    with basic authentication, but at the same time expose the generated WSDL?
    The best way I have found is to protect only post requests:
    <security-constraint>
    <web-resource-collection>
    <web-resource-name>myservice</web-resource-name>
    <url-pattern>/myservice/*</url-pattern>
    <http-method>POST</http-method>
    </web-resource-collection>
    <auth-constraint>
    <role-name>SomeRoleName</role-name>
    </auth-constraint>
    </security-constraint>
    Since web service requests are posts, security does kick in on the invocation.
    The WSDL 'get' requests are allowed. This setup does break the WLS generated test
    harness, however, since there is no way to authenticate prior to the service invocation.
    Anyone have any better suggestions?
    Anyone know why servicegen doesnt put the WSDL in a separate directory from the
    services to make things a bit easier?
    Mike
    "Mike Gilbode" <[email protected]> wrote:
    >
    I want to protect my web service URI with HTTP basic authentication.
    I've modified
    the web.xml and protected my web service URI and all works fine. However,
    this
    also protects the dynamically generated WSDL URL.
    Is there a way to pass the user/password to the JAX-RPC client for the
    WSDL URL?
    If not, what is the best way to expose the WSDL through a different
    unprotected
    URI while still dynamically generating it?
    Mike

Maybe you are looking for