Error 403-forbidden from IE5 while authenticating a user through NT Realm

Question

Hi,
Before posting this request, I checked the forum until Sep.18 to see if nobody
else experienced my problem, but in vain.
I am using WLS6.1Sp1 under NT4
I would like that NT users for defined NT Primary Domain Controller authenticate
themselves before accessing a web app. For that, I followed thoroughly the BEA
Doc to get the config.xml, web.xml, weblogic.xml and filerealm.properties correctly
configured.
The <auth-method> is set to FORM. The <security-role> and <security-role-assignment>
are also set with business roles and principals from the NT PDC. the <security-constraint>
with all the sub-tags are also defined. etc.etc. When I use the WL console, to
check users and groups lists, it works fine although it takes a lot of time before
being displayed (15 to 20 minutes !!!).
Through a Login.jsp, the user enters his/her login name and password. The result
is that I get the following message :
"Error 403--Forbidden
From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:
10.4.4 403 Forbidden
The server understood the request, but is refusing to fulfill it. Authorization
will not help and the request SHOULD NOT be repeated. If the request method was
not HEAD and the server wishes to make public why the request has not been fulfilled,
it SHOULD describe the reason for the refusal in the entity. This status code
is commonly used when the server does not wish to reveal exactly why the request
has been refused, or when no other response is applicable."
No trace in the log files. No warning . Nothing.
My questions are:
1- Has somebody already experienced this?
2- Could you then help me ?
By advance , thank you very much.
Athmani H.
Note : I can provide you through email the config.xml, web.xml, weblogic.xml and
filerealm.properties and the concerned .jsp files on demand

Answer 1

Hi Jerry,
Many thanks for your interest and your help.
weblogic.properties file for WLS 6.1 SP1? There is none... I do have a filerealm.properties. I didn't state that I was using a weblogic.properties
file.
I checked the URL you proposed. I changed the <Auth-method> from FORM into BASIC.
A pop-up window is displayed requesting the user to enter username and password.
The result is that I get a web page displaying an Error 404 --not found.
Here is the complete error message :"Error 404--Not Found
From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:
10.4.5 404 Not Found
The server has not found anything matching the Request-URI. No indication is given
of whether the condition is temporary or permanent.If the server does not wish
to make this information available to the client, the status code 403 (Forbidden)
can be used instead. The 410 (Gone) status code SHOULD be used if the server knows,
through some internally configurable mechanism, that an old resource is permanently
unavailable and has no forwarding address."
The message is displayed when the browser tries to resolve the following URL :http://localhost:7001/examplesWebApp/j_security_check
Having said that, I had already configured the <security-role-assignement> with
role-name and principals in weblogic.xml, as well as the <security-role> tag in
web.xml.
Thanks for your help
Cheers
Habib
Jerry <[email protected]> wrote:
Hi Athmani,
weblogic.properties file for WLS 6.1 SP1? There is none... weblogic.properties
is in WebLogic
5.1 and lower -- it was changed to config.xml for WLS 6.0 .. what are
you using your
weblogic.properties file for?
Anyways,
I have gotten NTRealms to successfully work with WLS 6.1, with security
on a web app, allowing
NT users to access certain resources. This stuff works.
Since you can see your users and groups through the console (even though
it takes a while) I
think that your NTRealm setup is okay.
I would guess that you have a problem with your deployment descriptors
in your web
application.
There are quite a few posts in this newsgroup that illustrate how to
set up security
constraints on resources in your web app with the deployment descriptors.
For example, check out
http://newsgroups.bea.com/cgi-bin/dnewsweb?cmd=article&group=weblogic.developer.interest.security&item=6244&utag=
Let me know how it goes, okay?
Cheers,
Joe Jerry
"Athmani H." wrote:
Hi,
Before posting this request, I checked the forum until Sep.18 to seeif nobody
else experienced my problem, but in vain.
I am using WLS6.1Sp1 under NT4
I would like that NT users for defined NT Primary Domain Controllerauthenticate
themselves before accessing a web app. For that, I followed thoroughlythe BEA
Doc to get the config.xml, web.xml, weblogic.xml and filerealm.propertiescorrectly
configured.
The <auth-method> is set to FORM. The <security-role> and <security-role-assignment>
are also set with business roles and principals from the NT PDC. the<security-constraint>
with all the sub-tags are also defined. etc.etc. When I use the WLconsole, to
check users and groups lists, it works fine although it takes a lotof time before
being displayed (15 to 20 minutes !!!).
Through a Login.jsp, the user enters his/her login name and password.The result
is that I get the following message :
"Error 403--Forbidden
From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:
10.4.4 403 Forbidden
The server understood the request, but is refusing to fulfill it. Authorization
will not help and the request SHOULD NOT be repeated. If the requestmethod was
not HEAD and the server wishes to make public why the request has notbeen fulfilled,
it SHOULD describe the reason for the refusal in the entity. This statuscode
is commonly used when the server does not wish to reveal exactly whythe request
has been refused, or when no other response is applicable."
No trace in the log files. No warning . Nothing.
My questions are:
1- Has somebody already experienced this?
2- Could you then help me ?
By advance , thank you very much.
Athmani H.
Note : I can provide you through email the config.xml, web.xml, weblogic.xmland
filerealm.properties and the concerned .jsp files on demand