Form based authentication -- control URGENT PLS.

I am following Form based authentication. I have a login page. I have specified the security constraints in the web.xml.
I would like to know after the execution of login where will the controller go to?? will it go the controller servlet, followed by an action class??
For any typical event (such as create customer)---the following has been the flow:
controller servlet--> createAction-->createUserBD (business delegate) --> customerManagerEJB --> customerDAO;
Now in case of login..
After the execution of login (authentication is by form based authentication ) where will the controll go to?
My requirement is to store the logged in userID details in Stateful Session bean. how will the flow look like?

If the access is through a web invocation, control will go to whichever portion of the web app triggered
the security constraint. The ejb has no knowledge of the authentication. If you want to provide the
login details to the ejb you'll have to explicitly pass them from the web tier.
--ken                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   

Similar Messages

  • Form based authentication -- controller --- URGENT PLS.

    I am following Form based authentication. I have a login page. I have specified the security constraints in the web.xml.
    I would like to know after the execution of login where will the controller go to?? will it go the controller servlet, followed by an action class??
    For any typical event (such as create customer)---the following has been the flow:
    controller servlet--> createAction-->createUserBD (business delegate) --> customerManagerEJB --> customerDAO;
    Now in case of login..
    After the execution of login (authentication is by form based authentication ) where will the controll go to?
    My requirement is to store the logged in userID details in Stateful Session bean. how will the flow look like?

    where will the controller go to?? wherever you program it to go to?

  • Issue with form based Authentication in three tier sharepoint 2013 environment.

    Hi,
    We are facing issue with form based Authentication in three tier environment.
    We are able to add users to the database and in SharePoint.
    But we are not able to login with created users.
    In single tier everything working fine
    Please help , Its urgent ... Thanks in advance.
    Regards,
    Hari
    Regards, Hari

    if the environments match, then it sounds like a kerberos double-hop issue
    Scott Brickey
    MCTS, MCPD, MCITP
    www.sbrickey.com
    Strategic Data Systems - for all your SharePoint needs

  • Logout Functionality in Form Based Authentication Not Working Properly

    Hi All,
    I am using Form Based Authentication in ADF. In this I followed the following steps:-
    1.Login On Page.
    2.In successful login page ,copy the url
    3.Click on "Logout"
    4.Paste the url in login page and click enter
    5.System taking me back to that page where I can perform all the actions.
    But the Login operation should not happen just by entering the url. Please provide any help how to stop redirecting to my authenticated page just by typing the url. This is a big security constraint.Any Assistance to this is highly appreciated.
    Thanks & Regards
    Lovenish Garg

    Hi BaiG,
    For Login I am using the form based authentication and for logout here is my code:-
    public void logout() {
    ExternalContext ectx =
    FacesContext.getCurrentInstance().getExternalContext();
    HttpServletResponse response = (HttpServletResponse)ectx.getResponse();
    HttpSession session = (HttpSession)ectx.getSession(false);
    session.invalidate();
    response.setHeader("Cache-Control", "no-cache");
    response.setHeader("expires", "0");
    response.setHeader("Pragma", "no-cache");
    try {
    response.sendRedirect("AdminLogin.html");
    } catch (IOException e) {
    logger.severe(e.getMessage());
    //Inform JSF to not take the response in hands
    FacesContext.getCurrentInstance().responseComplete();
    logger.info("session invalidated");
    Thanks,
    Lovenish Garg

  • Oracle form based authentication

    can anyone tell me how to do the simple form-based authentication with IIS in OAM10g ??? pls
    Edited by: 859749 on May 19, 2011 4:32 AM

    Please refer to the product documentation.
    http://download.oracle.com/docs/cd/E15217_01/doc.1014/e12488/v2form.htm#BABCDIEE

  • FORM based authentication

    Hi,
    I'm using Oracle JDeveloper 9.0.3 with the embedded oc4j. I have configured for simple FORM based authentication by storing username/password in the principals.xml file.
    I am presented with the login form correctly when I try to access a protected resource, but my username/password is always rejected (I'm redirected to the error page after trying to log-in). Can someone pls help??
    The relevant portions of the contents of the deployment descriptor files that I'm using:
    principals.xml
    <principals>
    <groups>
    <group name="securegroup">
    <description>secureusers</description>
    </group>
    </groups>
    <users>
    <user username="testuser" password="test">
    <description>test user </description>
    <group-membership group="securegroup" />
    </user>
    </users>
    </principals>
    web.xml
    <web-app>
    <security-constraint>
    <display-name>Example Security Constraint</display-name>
    <web-resource-collection>
    <web-resource-name>Protected Area</web-resource-name>
    <!-- Define the context-relative URL(s) to be protected -->
    <url-pattern>*</url-pattern>
    <!-- If you list http methods, only those methods are protected -->
    </web-resource-collection>
    <auth-constraint>
    <!-- Anyone with one of the listed roles may access this area -->
    <role-name>role1</role-name>
    </auth-constraint>
    </security-constraint>
    <!-- Default login configuration uses form-based authentication -->
    <login-config>
    <auth-method>FORM</auth-method>
    <realm-name>Example Form-Based Authentication Area</realm-name>
    <form-login-config>
    <form-login-page>login.jsp</form-login-page>
    <form-error-page>error.jsp</form-error-page>
    </form-login-config>
    </login-config>
    <!-- Security roles referenced by this web application -->
    <security-role>
    <role-name>role1</role-name>
    </security-role>
    </web-app>
    orion-application.xml
    <orion-application>
    <security-role-mapping name="role1">
    <group name="securegroup" />
    </security-role-mapping>
    </orion-application>
    application.xml (stored in my D:\JDeveloper\jdev\MyProj\MyProject\WEB-INF\src\META-INF folder)
    <?xml version = '1.0' encoding = 'windows-1252'?>
    <!DOCTYPE application PUBLIC "-//Sun Microsystems, Inc.//DTD J2EE Application 1.2//EN" "http://java.sun.com/j2ee/dtds/application_1_2.dtd">
    <application>
    <security-role-mapping name="role1">
    <group name="securegroup" />
    </security-role-mapping>
    </application>

    REPOST
    <br><br>
    Keywords: form-login, principals.xml, embedded OC4J, authentication
    <p>
    Please see http://forums.oracle.com/forums/message.jsp?id=1266989
    <p>
    The provided link does not work.<br><br>
    In the application.xml of the OC4j config folder I have comemnted out the: <br> <jazn provider="XML" location="./jazn-data.xml"/>
    and added my roles mappings from web.xml :<br>
         <security-role-mapping name="OES_admin">
              <group name="administrators"/>
         </security-role-mapping>
    <p>
    plus in proncipals.xml have created an entry for my test user:<p>
              <user username="testusr" password="test">
                   <description>Just me</description>
                   <group-membership group="users" />
                   <group-membership group="guests" />
                   <group-membership group="administrators" />
              </user>
    <p>
    And still cannot run Form-authentication from inside jdeveloper .... authentication runs fine when the app is deployed to Tomcat5
    <p>
    Help Please, I'm using jdev 10.1.2.0
    Message was edited by:
    omar71

  • Ask for help with form based authentication & authorization

    Hi:
    I encountered the following problem when I tried the form based authentication & authorization (see the attached part of the config files, web.xml, weblogic.xml & weblogic.properties)
    1. authorization seems not invoked against the rules specfied, it doesn't go the login error page as long as the user/pwd match, even though the user does not have the necessary role
    in the example below, user3 should be denied to access the signin page, but seems no login error page returned, actually I never see any page / error message which complain about the authorization / access control error
    2. after authenticate correctly, always get redirected to the / (context root) url, instead of the url prior the login page, for e.g., signin page
    Any idea ?
    Thanks in advance.
    HaiMing
    attach config files
    web.xml
    <security-constraint>
    <web-resource-collection>
    <web-resource-name>MySecureBit1</web-resource-name>
    <description>no description</description>
    <url-pattern>/control/signin</url-pattern>
    <http-method>POST</http-method>
    <http-method>GET</http-method>
    </web-resource-collection>
    </security-constraint>
    <login-config>
    <auth-method>FORM</auth-method>
    <realm-name>default</realm-name>
    <form-login-config>
    <form-login-page>/control/formbasedlogin</form-login-page>
    <form-error-page>/control/formbasedloginerror</form-error-page>
    </form-login-config>
    </login-config>
    <security-role>
    <description>the customer role</description>
    <role-name>customer</role-name>
    </security-role>
    weblogic.xml
    <security-role-assignment>
    <role-name>
    customer
    </role-name>
    <principal-name>
    customer_group
    </security-role-assignment>
    weblogic.properties
    weblogic.password.user1=user1pass
    weblogic.password.user2=user2pass
    weblogic.password.user3=user3pass
    weblogic.security.group.customer_group=user1,user2

    Hi, Paul:
    Thanks a lot for your reply.
    Firstly let me just correct a little in the attachment I put previously, I think I missed following lines :
    <auth-constraint>
    <description>no description</description>
    <role-name>customer</role-name>
    </auth-constraint>
    So, user1 & user2 are in the customer group, but user3 not, and /control/singin is protected by this security constraint, as a result, when anyone click the link to /control/singin, he was led to the login page, if he tries to login as user1 & user2, he should pass & led to original page (in this case /control/singin, and my code's logic, once /control/signin is used, means that he already login successfully & redirected to the login success page), but if he tries to login as user3, he should only pass the authentication check, but fail the authorization check, and led to login error page.
    What not happen are :
    1. user1 & user2 pass, but redirect to /
    2. user3 also pass, because I see that debug message shows also get redirected to /, instead of login error page
    (login error page will be displayed, only if I try to login as a user with either wrong userid, or wrong password)
    3. one more thing I notice after I first time post the message, the container does not remember the principal, after 1. is done, not even for a while
    And the similar configuration works under Tomcat 3.2.1, for all 3. mentioned above.
    Any idea ?
    HaiMing
    "Paul Patrick" <[email protected]> wrote:
    If I understand what your trying to do, everyone should get access to the
    login page since roles are not
    associated with principals until after they authenticate. If I follow what
    you specified in the XML files,
    authenticated users user1 and user2 are members of a group called
    customer_group.
    The principal customer_group (and therefore its members) is mapped in the
    weblogic.xml file to the role
    customer.
    I can't speak to the reason your being redirected to the document root.
    Paul Patrick
    "HaiMing" <[email protected]> wrote in message
    news:[email protected]...
    Hi:
    I encountered the following problem when I tried the form basedauthentication & authorization (see the attached part of the config files,
    web.xml, weblogic.xml & weblogic.properties)
    1. authorization seems not invoked against the rules specfied, itdoesn't go the login error page as long as the user/pwd match, even though
    the user does not have the necessary role
    in the example below, user3 should be denied to access the signinpage, but seems no login error page returned, actually I never see any page
    / error message which complain about the authorization / access control
    error
    2. after authenticate correctly, always get redirected to the / (contextroot) url, instead of the url prior the login page, for e.g., signin page
    Any idea ?
    Thanks in advance.
    HaiMing
    attach config files
    web.xml
    <security-constraint>
    <web-resource-collection>
    <web-resource-name>MySecureBit1</web-resource-name>
    <description>no description</description>
    <url-pattern>/control/signin</url-pattern>
    <http-method>POST</http-method>
    <http-method>GET</http-method>
    </web-resource-collection>
    </security-constraint>
    <login-config>
    <auth-method>FORM</auth-method>
    <realm-name>default</realm-name>
    <form-login-config>
    <form-login-page>/control/formbasedlogin</form-login-page>
    <form-error-page>/control/formbasedloginerror</form-error-page>
    </form-login-config>
    </login-config>
    <security-role>
    <description>the customer role</description>
    <role-name>customer</role-name>
    </security-role>
    weblogic.xml
    <security-role-assignment>
    <role-name>
    customer
    </role-name>
    <principal-name>
    customer_group
    </security-role-assignment>
    weblogic.properties
    weblogic.password.user1=user1pass
    weblogic.password.user2=user2pass
    weblogic.password.user3=user3pass
    weblogic.security.group.customer_group=user1,user2

  • Form-based authentication and JSF

    I am trying to use a form-based authentication in Tomcat 6, and from what I understand the page that contains the login form can not be a JSF page.
    The problem I'm having with this is that I need the client's username and password accessible from my backing bean, but I don't know how to put them there from a standard JSP.
    Before all this, I had a simple login form with username/password fields that were bound to a bean, and a button that executed a bean method that would perform the login procedure, retrieve the client's data from the DB and create a Client object in the session to be accessible throughout the application. Now, I need to use container managed access control with form-based authentication, and I know how to set it up but don't know how to create the Client object if the container does all the authentication and I never even get a hold of a username/password combination let alone the rest of the client's data.
    Any advice on this would be greatly appreciated.

    alf.redo wrote:
    ...following article: [j2ee_security_a_jsf_based_login_form|http://groundside.com/blog/DuncanMills.php?title=j2ee_security_a_jsf_based_login_form]
    This is exactly the solution I am planning to use. It is good to know there are others who have decided to go that way.
    Thanks

  • Webgate : problem in Form based authentication

    I have configured a WebGate to protect an web application hosted on Sun WebServer 6.1.
    It works fine, If I use the basic authentication mechanism. If I access the application, it challenges me uid/pwd thru a small pop up window; after successful authentication I am redirected to the requested application.
    However, the same does not work for Form based authentication. The webgate plugin doe not look like picking the userid/ pwd field from the login.html. Also it redirect to the mentioned action "/access/dummy" in the html.
    My login.html for looks like this :
    <html>
    <form name="myloginform" action="/access/dummy" method="post">
         UserID <input type="text" name="userid" size="20">
         Password <input type="password" name="password" size="20">
         <input type="submit" name="submit" value="Login">
    </form>
    </html>
    Pls help me out, I have spent several hours debugging this. surprisingly, I have a different machine with exactly same set up works fine.
    Thanks

    Hi Eric,
    It may be a problem in your web.xml, I missed the "/" slash character
    in the web.xml's in <form-login-page> element. So your web.xml
    must look like

  • Forcing specific clients or groups to use forms based authentication (FBA) instead of windows based authentication (WIA) with ADFS

    Hi,
    We are have a quite specific issue. The problem is most likely by design in ADFS 3.0 (running on Windows Server 2012 R2) and we are trying to find a "work-around".
    Most users in the organization is using their own personal computer and everything is fine and working as expected, single sign-on (WIA) internally to Office 365 and forms based (FBA) externally (using Citrix NetScaler as reverse proxy and load
    balancing with the correct rewrites to add client-ip, proxy header and URL-transformation).
    The problem occurs for a few (50-100) users where they are sharing the same computer, automatically logged on to the computer using a generic AD-user (same for all of them). This AD-user they are logged on with does not have any access to Office365
    and if they try to access SharePoint Online they receive an error that they can't login (from SharePoint Online, not ADFS).
    We can't change this, they need to have this generic account logged on to these computers. The issue occurs when a user that has access to SharePoint Online tries to access it when logged on with a generic account.
    They are not able to "switch" from the generic account in ADFS / SharePoint Online to their personal account.
    The only way I've found that may work is removing IE as a WIA-capable agent and deploy a User-Agent version string specific to most users but not the generic account.
    My question to you: Is there another way? Maybe when ADFS sees the generic user, it forces forms based authentication or something like that?
    Best regards,
    Simon

    I'd go with your original workaround using the user-agent and publishing a GPO for your normal users that elects to use a user-agent string associated with Integrated Windows Auth.. for the generic accounts, I'd look at using a loopback policy that overwrites
    that user agent setting, so that forms logon is preferred for that subset of users. I don't think the Netscaler here is useful in this capacity as it's a front-end proxy and you need to evaluate the AuthZ rules on the AD FS server after the request has been
    proxied. The error pages in Windows Server 2012 R2 are canned as the previous poster mentioned and difficult to customize (Javascript only)...
    http://blog.auth360.net

  • Error re-logging in after session timeout using form-based authentication

    Hello,
    We have a web app configured for form-based authentication. When the session times out, we're redirected to our login page as expected. However, after re-logging in, we are not redirected to the desired page (e.g., /faces/OurMainPage.jspx) but to /afr/page_lev_idle.gif.
    Do we have to do anything special for session timeouts?
    Thanks,
    Rico

    Some extra information that might help:
    After re-logging in and we're in /afr/page_lev_idle.gif, we hit the browser Back button (showing the login page again) and then hit the browser Refresh/Reload button and voila we're at the page we expect to be.
    Rico

  • How to redirect to j_security_check without the form based authentication

    Hi,
    I am trying to integrate my application authentication to a backend system with the ibm websphere form based authentication. Below is the scenario:
    1. when the user clicks on a protected url, the container will redirect the user to the login page.
    2. instead of displaying the login page, i would like to automatically redirect the user to j_security_check action. which means that instead of displaying the login.jsp page, the user will automatically be redirected to j_security_check to perform some user authentication, and if successful, the application pages will be displayed.
    The reason i want to auto redirect the user to j_security_check is because i am implementing some integration work with a backend system. the user will key in the username/password from another system. once the user is authenticated, the user information will be passed to my system. The login page of my system will not be displayed again, and by using the username value, my system will assume that the user has successfully been authenticated (authentication done by the backend system), and therefore automatically gain authorization to login into my application.
    i hope that clarifies my problem.
    anyone out there has any solution to my problem?
    thanks a lot in advance.

    Hi Darren,
    Let me explain the whole authentication environment.
    There are actually 2 systems in this environment. Let;s call it system A and system B.
    System B is actually using the authentication mechanism that i described in my previous message.
    A login page will be presented to the user (within system A). User credential is collected and passed to system A to be authenticated. System A will use its own mechanism to authenticate the user.
    Once the user is authenticated, system A will pass the user ID to system B. At this point, system B will assume that the user is authenticated and grant authorization to access the application. (system B global security is enabled and implements the form based authentication mechanism) Therefore, at this point, the redirect page (so called login page) will not be displayed to the user, instead it will be automatically redirected to the j_security_check action to execute the customer Ldap Registry class. (ps : eventhough authentication is no longer needed, the flow will still go to Ldap Registry class. A check is done in the Ldap Registry class to skip the authentication, if it is not boot strap login. Only first and only time authentication is done for boot strap login).
    In the case a protected url is clicked or invoked by the user directly, the application will redirect the user to the initial login of system A. Otherwise (the url link originates from system A, during the passing of user token to system B), system B will redirect to j_security_check and execute the customer Ldap Registry class.
    Based on the above explained scenario, in your opinion, is there any security loopholes? consider that system B no longer perform authentication but only to grant authorization to the user.
    Appreciate your advice. Thanks in advance
    Anyway, i am using the ibm websphere server. :)

  • Faces context not found (Form based authentication)

    <security-constraint>
    <display-name>Example Security Constraint</display-name>
    <web-resource-collection>
    <web-resource-name>Protected Area</web-resource-name>
    <url-pattern>/jsp/WorkingZone.jsp</url-pattern>
    <http-method>GET</http-method>
    <http-method>POST</http-method>
    </web-resource-collection>
    <auth-constraint>
    <role-name>manager</role-name>
    </auth-constraint>
    </security-constraint>
    <login-config>
    <auth-method>FORM</auth-method>
    <realm-name>Example Form-Based Authentication Area</realm-name>
    <form-login-config>
    <form-login-page>/Login/login.jsp</form-login-page>
    <form-error-page>/Login/error.jsp</form-error-page>
    </form-login-config>
    </login-config>
    when i tried to login with valid user the the url shows
    http://localhost:8080/FormAuth/jsp/WorkingZone.jsp
    how to append faces context automatically.
    I am not finding for this faces context.
    Plz suggest me a solution soon.
    Thanks
    Raghavendra Pattar

    The FacesContext is created by FacesServlet which is
    definied in the web.xml with an url-pattern.
    If you just follow the url-pattern of this
    FacesServlet, usually /faces/ or *.faces, or *.jsf,
    then the FacesContext will be created.Hi balu,
    this is the web.xml that i am using
    <?xml version="1.0" encoding="UTF-8"?>
    <web-app xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="2.4" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
    <context-param>
        <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
        <param-value>server</param-value>
      </context-param>
    <context-param>
        <param-name>javax.faces.CONFIG_FILES</param-name>
        <param-value>/WEB-INF/navigation.xml,/WEB-INF/managed-beans.xml</param-value>
      </context-param>
    <context-param>
        <param-name>com.sun.faces.validateXml</param-name>
        <param-value>true</param-value>
      </context-param>
    <context-param>
        <param-name>com.sun.faces.verifyObjects</param-name>
        <param-value>false</param-value>
      </context-param>
    <filter>
        <filter-name>UploadFilter</filter-name>
        <filter-class>com.sun.rave.web.ui.util.UploadFilter</filter-class>
        <init-param>
          <description>
              The maximum allowed upload size in bytes.  If this is set
              to a negative value, there is no maximum.  The default
              value is 1000000.
            </description>
          <param-name>maxSize</param-name>
          <param-value>1000000</param-value>
        </init-param>
        <init-param>
          <description>
              The size (in bytes) of an uploaded file which, if it is
              exceeded, will cause the file to be written directly to
              disk instead of stored in memory.  Files smaller than or
              equal to this size will be stored in memory.  The default
              value is 4096.
            </description>
          <param-name>sizeThreshold</param-name>
          <param-value>4096</param-value>
        </init-param>
      </filter>
    <filter-mapping>
        <filter-name>UploadFilter</filter-name>
        <servlet-name>Faces Servlet</servlet-name>
      </filter-mapping>
    <servlet>
        <servlet-name>Faces Servlet</servlet-name>
        <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
      </servlet>
    <servlet>
        <servlet-name>ThemeServlet</servlet-name>
        <servlet-class>com.sun.rave.web.ui.theme.ThemeServlet</servlet-class>
      </servlet>
    <servlet-mapping>
        <servlet-name>Faces Servlet</servlet-name>
        <url-pattern>/faces/*</url-pattern>
      </servlet-mapping>
    <servlet-mapping>
        <servlet-name>ThemeServlet</servlet-name>
        <url-pattern>/theme/*</url-pattern>
      </servlet-mapping>
    <welcome-file-list>
        <welcome-file></welcome-file>
         </welcome-file-list>
    <jsp-config>
        <jsp-property-group>
          <url-pattern>*.jspf</url-pattern>
          <is-xml>true</is-xml>
        </jsp-property-group>
      </jsp-config>
    <security-constraint>
        <display-name>Example Security Constraint</display-name>
        <web-resource-collection>
          <web-resource-name>Protected Area</web-resource-name>
          <url-pattern>/secure/*</url-pattern>
            <http-method>GET</http-method>
          <http-method>POST</http-method>
        </web-resource-collection>
        <auth-constraint>
          <role-name>manager</role-name>
        </auth-constraint>
      </security-constraint>
      <!-- Default a login configuration that uses form-based authentication -->
      <login-config>
        <auth-method>FORM</auth-method>
        <realm-name>Example Form-Based Authentication Area</realm-name>
        <form-login-config>
          <form-login-page>/Login/login.jsp</form-login-page>
          <form-error-page>/Login/error.jsp</form-error-page>
        </form-login-config>
      </login-config>
      <!-- Define a logical role for this application, needs to be mapped to an actual role at deployment time -->
      <security-role>
        <role-name>manager</role-name>
      </security-role>
    </web-app>1)My requirement is Login page should be the first page
    If enter the valid user and password
    then i will get directory structure
    when i click the secured JSF page inside secure
    i got this URL
    http://localhost/secure/WorkingZone.jsp
    obiviously /faces is missing
    and i am getting faces context not found.
    If u need further clarification i will send u..
    Plz reply me...

  • SP4 and Form Based Authentication

    Hi,
    I had just advised a customer to apply SP4 to WLS and
    then plug in the 'source code' patch, he replied that he had
    been informed that SP4 breaks Form Based Authentication for
    war web apps?
    Can anyone confirm/deny this for me please ?
    regards,
         Patrick.

    Hehe Hiya Patrick!, that was Me! seems we use the same hot source of info :)
    Cheers
    Rob :)
    "Patrick Byrne" <[email protected]> wrote in message
    news:[email protected]..
    Hi,
    I had just advised a customer to apply SP4 to WLS and
    then plug in the 'source code' patch, he replied that he had
    been informed that SP4 breaks Form Based Authentication for
    war web apps?
    Can anyone confirm/deny this for me please ?
    regards,
    Patrick.

  • J_security_check in form-based authentication - not checking for blank passwords

    I am using the LDAP Security Realm to authenticate against an iPlanet
    Directory Server. All works as expected when a user-id and password
    are entered for form-based authentication.
    However, when a userid is entered but no password, j_security_check
    logs the user in successfully. Aparently, this is correct LDAP
    behaviour as anonymous login to the LDAP server is permitted. It seems
    that the j_security_check servlet should check for blank passwords
    before trying to authenticate against the LDAP server and fail
    authentication if this is the case.
    Has anyone else experienced this problem?

    Hi Brian,
    I do not believe it is j_security_check's job to check for blank
    passwords.
    In many security realms, it is "legal" for a user to have a blank
    password. j_security_check forwards whatever password was entered so that
    even users with blank passwords can be authenticated by the realm on the
    backend. For this reason I believe that j_security_check is "doing the
    right thing" by just forwarding whatever is presented to it, rather than
    having its own logic. It is best if j_security_check just acts as a very
    dumb middle man.
    If behavior was altered, it is true that your particular problem would be
    solved, but then many other people would have a problem with their users
    with blank passwords authenticating properly...
    Try looking into how to disable anonymous logins on the LDAP end of
    things. Hope this helps.
    Cheers,
    Joe Jerry
    brian wrote:
    I am using the LDAP Security Realm to authenticate against an iPlanet
    Directory Server. All works as expected when a user-id and password
    are entered for form-based authentication.
    However, when a userid is entered but no password, j_security_check
    logs the user in successfully. Aparently, this is correct LDAP
    behaviour as anonymous login to the LDAP server is permitted. It seems
    that the j_security_check servlet should check for blank passwords
    before trying to authenticate against the LDAP server and fail
    authentication if this is the case.
    Has anyone else experienced this problem?

Maybe you are looking for

  • Finder: graphic issues while in icon view

    Hi there, my Macbook Pro becomes more and more sluggish since i upgraded to Yosemite. Worst thing i noticed is icon view in Finder. It does not show up correctly and has some weird graphic issues. I made a video while using the guest account: http://

  • Issue with calculation script - please help

    There is a script that I am working on that needs to track the changes made by the user on the data form and push the entered value down proportionally to the lower levels. It's a signal dimensional spread. It needs to spread the parent level values

  • Old Photoshop version download (Photoshop CS, Photoshop 8.0)

    Hello to everyone, i work for a small editorial company, i found out that we have some old Photoshop CS (Photoshop 8.0) licences and i want to use one of them, but the installation cds are missing. Is there a place where i can download the installati

  • Time series Function

    Hello Folks, i have been trying to understand regarding the time series functions and time series calculations to compare two date columns like current date to month date ago. i know using AGO and TODATE functions, we can calculate the measures i.e.

  • Planning Layout - BCS

    Dear All, I wish to create a new planning layout in BCS. the layout is as below, for a series of Commitment Item i also want subtotal. The summary table used is FMBDT. Could you please share some information/knowledge/document which will help me to m