Glassfish 3.1 Container managed security - custom authentication

I have used custom authentication with tomcat and it works great. I am moving to glassfish 3.1 and want to set it up there now. I haven't found any specifics for glassfish 3.1. Anybody got it working in GF 3.1?
Thanks,
John

To follow up ...
I am using container managed security and form based authentication. My custom SJSAS login realm, however, never fails to authenticate users. Instead of failing authentication when a username and password match cannot be found, I add the user to an 'unknown-user' group who has no rights to the application.
I do this because I can then catch 403 errors for users who have failed authentication (because they are not authorized to access any pages), or for users who are not in the right role to access part of the application.
It's not the way that I would prefer to handle login 'failures', but it works.

Similar Messages

  • SHA-1 Encryption is not working in Container managed security

    Hi,
    I have to turn to your help after no luck with other possible resource.
    I implemented container managed security on my apps and it works well without the encrypted password(clear text) in the table column. Now I referred OC4J Security guide to implement the password encryption as follows:
    1. Using the DBTableOraDataSourceLoginModule, set the option pw_encoding_class = oracle.security.jazn.login.module.db.util.DBLoginModuleSHA1Encoder
    2. run the following procedure:
    DECLARE
        l_password VARCHAR2(50) := 'welcome';
        l_password_raw RAW(128) := utl_raw.CAST_TO_RAW(l_password);
        l_encrypted_raw RAW(2048);
        l_encrypted_string VARCHAR2(2048);
        l_encrypted_string2 VARCHAR2(2048);
    BEGIN
        dbms_output.put_line('Password in String: ' || l_password);
        dbms_output.put_line('Password in raw: ' || l_password_raw);
        l_encrypted_raw := dbms_crypto.hash(l_password_raw, dbms_crypto.HASH_SH1);
        dbms_output.put_line('SH1: ' || l_encrypted_raw);
        l_encrypted_string := UTL_ENCODE.BASE64_ENCODE(l_encrypted_raw);
        dbms_output.put_line('Base64Encoding: ' || l_encrypted_string);
    END;
    3. update the clear text password with the SHA-1 encrypted password and encoded in Base64Encoding (in my case, it's the parameter "l_encrypted_string")Now I run the application and login says "password not matching!" If anyone know what's going on, please advise me what's wrong...pls
    thanks very much,

    Hi,
    hard to say without knowing the code the OC4J team uses in their login module. I know they based it on a JAAS LoginModule I wrote some years ago, but they did change some parts of it. In the original version. the password was read from the database and then compared with the provided password string. Using encryption it uses a class to encode and decode the password queried from teh database. My guess is that the returned string - after decoding - doesn't meet the password string you provide when authenticating. Since this piece of code is owned by the OC4J team, I suggest to try the Application Server forum or the Security forum
    Frank

  • Container Managed Security on Tomcat - configuring different auth-methods

    I am trying to configure the container managed security on tomcat4. Or rather I am trying to add a further dimension to the configuration that already exists.
    At the moment the entire application uses LDAP authentication and I would like to separate an area that requires further authentication. That is to say I would like everyone using the web application to authenticate using the existing Form-Based LDAP authentication but I would like only certain users to be able to use the data upload facility (whose code is stored in it's own directory).
    This is the authentication bit of my web.xml:
      <security-constraint>
        <web-resource-collection>
          <web-resource-name>qmrae</web-resource-name>
          <url-pattern>*.do</url-pattern>
          <url-pattern>*.jsp</url-pattern>
        </web-resource-collection>
        <auth-constraint>
          <role-name>*</role-name>
        </auth-constraint>
      </security-constraint>
      <login-config>
        <auth-method>FORM</auth-method>
        <realm-name>Form-Based Authentication Area</realm-name>
        <form-login-config>
          <form-login-page>/login.jsp</form-login-page>
          <form-error-page>/loginError.jsp</form-error-page>
        </form-login-config>
      </login-config>My first hurdle is in understanding exactly how the application knows where to go for its authentication.
    I had guessed that the realm-name would map "areas" of my application to realm configuration defined in my application's context area in Tomcat's web.xml but this doesnt seem to be the case. In fact I have read conflicting explanations as to what the realm-name is for. One source has said that this is only used for BASIC authentication as a way of naming the resulting pop up window - many others say it maps the login-config to the web-resource-name. However the latter doesnt make sense because the authentication works in my application at the moment even though those values are completely different (and indeed are different in most of the examples i've read on the web). Furthermore I can find any other mention of the defined realm-name in any other file (which of course be because i'm looking in the wrong place).
    I was prepared to accept that the realm-name might not actually do anything and so I've been looking for examples of defining a different auth-method for different url-patterns but i've had no luck.
    I know a user can have one or more roles but I dont have access to the LDAP server to set these up and haven't found anything about defining different auth-methods other than one thread in this forum suggesting that is wasnt possible on AIS.
    This thread suggests that you can have more than one security-constraint but again i'm not sure about the auth methods and how you map an auth method to a security-constraint
    http://forum.java.sun.com/thread.jspa?forumID=33&threadID=320918
    To summarise my questions:
    1) What are the functions of the realm-name and web-resource-name? Are they related?
    2) Is it possible to configure different areas of an application to use different authentication methods? and if so, could you point me in the direction of relevant documentation
    3) If (2) is not possible and I have to assign a new role to the privileged LDAP users, is it enough to define a new security-constraint? Could you describe the behaviour I could expect for users that have authenticated once and try to access this super-security area, will they be shown another login form or will it just let them in because the container is already aware of their permissions.
    Many thanks for your attention,
    Rachel

    If you create your own Realm classes - look at JAAS - you can sort out your last login time, just wrap them around the DataSourceRealm.
    As far as 'remind' him is concerned - I'm guessing you mean provider a reminder for the password based on the user name. If you use form based authentication you can put what ever you like on the page.

  • ADF Security to J2EE Container Managed Security Problems

    Hi al!
    I had ADF security enabled in my application. I've added roles and users to embedded OC4J Server Preferences..., configured authorization using pageDefs... (following the Introduction to ADF Security in JDeveloper 10.1.3.2 howto).
    For the sake of friendlier user and roles management I decided to go to 2EE Container Managed Security (I want application manager in production environment to be able to manage users in only one place, not in DB table and extra for web app). I followed Frank Nimphius's Database Authentication and Authorization in J2EE Container Managed Security article.
    Now I have some problems. I removed users and roles from embedded OC4J Server Preferences... (I believe this are used only for ADF security, am I right?). I can log to application with admin user account (app index page doesn't have any binds and even pageDef), but when trying to access admin pages I get 401 Unauthorized page.
    What am I doing wrong, probably I've forgotten something? I'm a bit confused now with users and roles settings and ADF and container managed security.
    Part of my web.xml file:
    <servlet>
    <servlet-name>adfAuthentication</servlet-name>
    <servlet-class>oracle.adf.share.security.authentication.AuthenticationServlet</servlet-class>
    <init-param>
    <param-name>success_url</param-name>
    <param-value>/faces/app/index.jspx</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
    <servlet-name>adfAuthentication</servlet-name>
    <url-pattern>/adfAuthentication/*</url-pattern>
    </servlet-mapping>
    <security-role>
    <description>Admins</description>
    <role-name>admin_role</role-name>
    </security-role>
    <security-role>
    <description>Users</description>
    <role-name>user_role</role-name>
    </security-role>
    <security-role>
    <role-name>oc4j-administrators</role-name>
    </security-role>
    <security-constraint>
    <web-resource-collection>
    <web-resource-name>AllAdmins</web-resource-name>
    <url-pattern>faces/admin/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
    <role-name>admin_role</role-name>
    </auth-constraint>
    </security-constraint>
    <security-constraint>
    <web-resource-collection>
    <web-resource-name>AllUsers</web-resource-name>
    <url-pattern>faces/app/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
    <role-name>user_role</role-name>
    <role-name>admin_role</role-name>
    </auth-constraint>
    </security-constraint>
    <security-constraint>
    <web-resource-collection>
    <web-resource-name>adfAuthentication</web-resource-name>
    <url-pattern>/adfAuthentication</url-pattern>
    </web-resource-collection>
    <auth-constraint>
    <role-name>oc4j-administrators</role-name>
    <role-name>user_role</role-name>
    <role-name>admin_role</role-name>
    </auth-constraint>
    </security-constraint>
    Do I have to remove this adfAuthentication tags?
    I know I've made things a bit complicated for me now and for anyone to help, but I hope I will get at least some pointers what to do now and maybe some explanation about roles in container managed security? Is it enaugh to have security constraints and roles defined in web.xml file or they have to be defined somewhere else also (beside the database)?
    Thank you in advance!
    Bye
    PS
    Maybe stack trace after login:
    FINE: LoginConfigProvider.ctr: lmm=[LoginModuleManager: jznCfg=[JAZNConfig null], appConfigEntries={oracle.security.jazn.oc4j.CertificateAuthenticator=[javax.security.auth.login.AppConfigurationEntry@3625d0], oracle.security.jazn.tools.Admintool=[javax.security.auth.login.AppConfigurationEntry@eca6e7], oracle.security.jazn.oc4j.WebCoreIDSSOAuthenticator=[javax.security.auth.login.AppConfigurationEntry@c1c7c4], oracle.security.jazn.oc4j.DigestAuthenticator=[javax.security.auth.login.AppConfigurationEntry@221f81], oracle.security.wss.jaas.SAMLAuthManager=[javax.security.auth.login.AppConfigurationEntry@426e05], oracle.security.jazn.oc4j.JAZNUserManager=[javax.security.auth.login.AppConfigurationEntry@145240a], current-workspace-app=[javax.security.auth.login.AppConfigurationEntry@4120aa], oracle.security.wss.jaas.JAASAuthManager=[javax.security.auth.login.AppConfigurationEntry@1c78f98]}]
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule initialize
    FINE: [DBTableOraDataSourceLoginModule] option data_source_name = jdbc/TESTDbDS
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule initialize
    FINE: [DBTableOraDataSourceLoginModule] option table = APPLICATION_USER
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule initialize
    FINE: [DBTableOraDataSourceLoginModule] option groupMembershipTableName = APPLICATION_ROLE
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule initialize
    FINE: [DBTableOraDataSourceLoginModule] option usernameField = USR_EMAIL
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule initialize
    FINE: [DBTableOraDataSourceLoginModule] option passwordField = USR_PSW
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule initialize
    FINE: [DBTableOraDataSourceLoginModule] option groupMembershipGroupFieldName = ROLE_NAME
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule initialize
    FINE: [DBTableOraDataSourceLoginModule] option user_pk_column = USR_EMAIL
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule initialize
    FINE: [DBTableOraDataSourceLoginModule] option roles_fk_column = USR_EMAIL
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule initialize
    FINE: [DBTableOraDataSourceLoginModule] option pw_encoding_class = null
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule initialize
    FINE: [DBTableOraDataSourceLoginModule] option realm_column = null
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule initialize
    FINE: [DBTableOraDataSourceLoginModule] option application_realm = null
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule initialize
    FINE: [DBTableOraDataSourceLoginModule] option casing = toupper
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule login
    FINE: [DBTableOraDataSourceLoginModule]login called on DBTableLoginModule
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule login
    FINE: [DBTableOraDataSourceLoginModule]Calling callbackhandler ...
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule login
    FINE: [DBTableOraDataSourceLoginModule]Username returned by callback = admin
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule login
    FINE: [DBTableOraDataSourceLoginModule]Username changed to case as defined by toupper to ADMIN
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule performDbAuthentication
    FINE: [DBTableOraDataSourceLoginModule]User query string: select USR_EMAIL,USR_PSW from APPLICATION_USER where USR_EMAIL= (?)
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule performDbAuthentication
    FINE: [DBTableOraDataSourceLoginModule]User primary key value found = ADMIN
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule performDbAuthentication
    FINE: [DBTableOraDataSourceLoginModule]Password encoded by: oracle.security.jazn.login.module.db.util.DBLoginModuleClearTextEncoder
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule performDbAuthentication
    FINE: [DBTableOraDataSourceLoginModule]User ADMIN authenticated successfully
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule performDbAuthentication
    FINE: [DBTableOraDataSourceLoginModule]Roles query string: select ROLE_NAME from APPLICATION_ROLE where USR_EMAIL= (?)
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule performDbAuthentication
    FINE: [DBTableOraDataSourceLoginModule]DBUser Principal Name: ADMIN
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule performDbAuthentication
    FINE: [DBTableOraDataSourceLoginModule]DBRole Principal Name: admin_role
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule login
    FINE: [DBTableOraDataSourceLoginModule]Logon Successful = true
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule commit
    FINE: [DBTableOraDataSourceLoginModule]Subject contains 0 Principals before auth
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule commit
    FINE: [DBTableOraDataSourceLoginModule]Local LM commit succeeded
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule commit
    FINE: [DBTableOraDataSourceLoginModule]Subject contains 2 Principals after auth
    24.8.2007 10:17:19 oracle.security.jazn.login.module.db.DBTableOraDataSourceLoginModule commit
    FINE: [DBTableOraDataSourceLoginModule]Cleaning internal state!

    Hi there!
    I have another question about this. I've modified a bit DBRolePrincipal class to see what's going on. At the beginning of the equals(Object another) method I added this lines:
    log("method equals start",0);
    log("another type = " + another.getClass(), 0);
    if (another instanceof Principal)
    Principal mine = (Principal)another;
    log("Principal mine.getName() = " + mine.getName(), 0);
    The result is this output (after navigating to page that gives 401 forbidden):
    07/10/12 08:38:36 [DBRolePrincipal] method equals start
    07/10/12 08:38:36 [DBRolePrincipal] another type = class oracle.security.jazn.oc4j.JAZNUserAdaptor
    07/10/12 08:38:36 [DBRolePrincipal] Principal mine.getName() = admin_user
    07/10/12 08:38:36 [DBRolePrincipal] method equals start
    07/10/12 08:38:36 [DBRolePrincipal] another type = class oracle.adf.share.security.authentication.ADFRolePrincipal
    07/10/12 08:38:36 [DBRolePrincipal] Principal mine.getName() = anyone
    07/10/12 08:38:36 [DBRolePrincipal] method equals start
    07/10/12 08:38:36 [DBRolePrincipal] another type = class oracle.security.jazn.oc4j.JAZNUserAdaptor
    07/10/12 08:38:36 [DBRolePrincipal] Principal mine.getName() = admin_user
    07/10/12 08:38:36 [DBRolePrincipal] method equals start
    07/10/12 08:38:36 [DBRolePrincipal] another type = class oracle.adf.share.security.authentication.ADFRolePrincipal
    07/10/12 08:38:36 [DBRolePrincipal] Principal mine.getName() = anyone
    07/10/12 08:38:36 [DBRolePrincipal] method equals start
    07/10/12 08:38:36 [DBRolePrincipal] another type = class oracle.security.jazn.oc4j.JAZNUserAdaptor
    07/10/12 08:38:36 [DBRolePrincipal] Principal mine.getName() = admin_user
    07/10/12 08:38:36 [DBRolePrincipal] method equals start
    07/10/12 08:38:36 [DBRolePrincipal] another type = class oracle.adf.share.security.authentication.ADFRolePrincipal
    07/10/12 08:38:36 [DBRolePrincipal] Principal mine.getName() = anyone
    07/10/12 08:38:36 [DBRolePrincipal] method equals start
    07/10/12 08:38:36 [DBRolePrincipal] another type = class oracle.security.jazn.oc4j.JAZNUserAdaptor
    07/10/12 08:38:36 [DBRolePrincipal] Principal mine.getName() = admin_user
    07/10/12 08:38:36 [DBRolePrincipal] method equals start
    07/10/12 08:38:36 [DBRolePrincipal] another type = class oracle.adf.share.security.authentication.ADFRolePrincipal
    07/10/12 08:38:36 [DBRolePrincipal] Principal mine.getName() = anyone
    07/10/12 08:38:36 [DBRolePrincipal] method equals start
    07/10/12 08:38:36 [DBRolePrincipal] another type = class oracle.security.jazn.oc4j.JAZNUserAdaptor
    07/10/12 08:38:36 [DBRolePrincipal] Principal mine.getName() = admin_user
    07/10/12 08:38:36 [DBRolePrincipal] method equals start
    07/10/12 08:38:36 [DBRolePrincipal] another type = class oracle.adf.share.security.authentication.ADFRolePrincipal
    07/10/12 08:38:36 [DBRolePrincipal] Principal mine.getName() = anyone
    07/10/12 08:38:36 [DBRolePrincipal] method equals start
    07/10/12 08:38:36 [DBRolePrincipal] another type = class oracle.security.jazn.oc4j.JAZNUserAdaptor
    07/10/12 08:38:36 [DBRolePrincipal] Principal mine.getName() = admin_user
    07/10/12 08:38:36 [DBRolePrincipal] method equals start
    07/10/12 08:38:36 [DBRolePrincipal] another type = class oracle.adf.share.security.authentication.ADFRolePrincipal
    07/10/12 08:38:36 [DBRolePrincipal] Principal mine.getName() = anyone
    07/10/12 08:38:36 [DBRolePrincipal] method equals start
    07/10/12 08:38:36 [DBRolePrincipal] another type = class oracle.security.jazn.oc4j.JAZNUserAdaptor
    07/10/12 08:38:36 [DBRolePrincipal] Principal mine.getName() = admin_user
    07/10/12 08:38:36 [DBRolePrincipal] method equals start
    07/10/12 08:38:36 [DBRolePrincipal] another type = class oracle.adf.share.security.authentication.ADFRolePrincipal
    07/10/12 08:38:36 [DBRolePrincipal] Principal mine.getName() = anyone
    Why is the name of ADFRolePrincipal always anyone? When I sign in with this user the output says:
    07/10/12 08:46:09 [DBTableOraDatasourceLoginModule] User query string: select USERNAME,PASSWORD from ACTIVE_APP_USER_V where USERNAME= (?)
    07/10/12 08:46:09 [DBTableOraDatasourceLoginModule] User primary key value found = admin_user
    07/10/12 08:46:09 [DBTableOraDatasourceLoginModule] Password encoded by: oracle.sample.dbloginmodule.util.DBLoginModuleCearTextEncoder
    07/10/12 08:46:09 [DBTableOraDatasourceLoginModule] User admin_user authenticated successfully
    07/10/12 08:46:09 [DBTableOraDatasourceLoginModule] Roles query string: select ROLE_NAME from ACTIVE_APP_ROLE_V where USERNAME= (?)
    07/10/12 08:46:09 [DBTableOraDatasourceLoginModule] DBRole Principal Name: admin_role
    07/10/12 08:46:09 [DBTableOraDatasourceLoginModule] DBUser Principal Name: admin_user
    07/10/12 08:46:09 [DBTableOraDatasourceLoginModule] Logon Successful = true
    07/10/12 08:46:09 [DBTableOraDatasourceLoginModule] Subject contains 0 Principals before auth
    07/10/12 08:46:09 [DBUserPrincipal] method equals start
    07/10/12 08:46:09 [DBUserPrincipal] another type = class oracle.sample.dbloginmodule.principals.DBRolePrincipal
    07/10/12 08:46:09 [DBTableOraDatasourceLoginModule] Local LM commit succeeded
    07/10/12 08:46:09 [DBTableOraDatasourceLoginModule] Subject contains 2 Principals after auth
    07/10/12 08:46:09 [DBTableOraDatasourceLoginModule] Cleaning internal state!
    Frank, if you haven't given up on this issue yet could you please try to explain this to me? Why doesn't admin_role principal never get compared in [equals[/i] method?
    Thank you!
    BB

  • Session creation with container managed security

    I implemented container managed security, first question does the container creates session automatically when login is successful ?
    second is there a way to do some processing when a user is authenticated like some event gets fired and listeners are called ?

    You have to enclose input component into an <h:form></h:form>.
    Note that the various Form components available in JSF will not let you specify the target action, everything is a post-back.
    I suggest you this article: [J2EE Security - A JSF based Login Form|http://groundside.com/blog/DuncanMills.php?title=j2ee_security_a_jsf_based_login_form&more=1&c=1&tb=1&pb=1]
    [Is This User Logged In?|http://mowyourlawn.com/blog/?p=6]

  • Container Managed Security

    Hi,
    Could you explain me what is the implication of "Container Managed Security"?
    Thanks.
    Pengyou

    Container managed security in what context?
    EJB access?
    This means that the user must be in a role which is authenticated to execute the method(s) of the bean.
    Resource access?
    The container is responsible for authentication at the resource, for example at setting up the connection to a database.
    Hope this helps

  • EJB 3.0 Security with ACEGI and not with Container Managed Security

    Hi,
         Currently we are using EJB 2.0 in our project, We want to use EJB 3.0
         But for security we want to use Spring ACEGI Security and we don�t want to use container managed security (No Portability, Difficult, �)
         ACEGI supports Servlet/JSP security very well (I am able to call isUserInRole(), getUserPrincipal() because ACEGI implements by ServletRequestWrapper in a filter)
         But for EJB, it lacks this feature. (There is no standard EJB interceptor API as there is with servlets (using filters), so there's no generic way of modify in the EJB context for the invocation)
         Without using container managed security, Is there any way to propogate my security context from Servlet Layer to EJB Layer, So that I can use EJB Declartive security and getCallerPrincipal(), isCallerInRole() API.
         For more info please see this thread http://forum.springframework.org/showthread.php?t=26514
         Why don�t you provide standard EJB interceptor API as there is with servlets (using filters), so there I am able add security identity to EJB context.
         I am eagerly waiting for the reply

    Reason: javax.naming.NameNotFoundException: jdbc not bound
    Although i am quite new to this as well i would say that there is a problem with your connection with the database.
    It seems it cannot connect to Mysql.
    have you download the mysql package library and imported it ?
    Also in your deploy folder in you Jboss
    have you altered the jdbc to connect to you database in your dataset ? ( i am not sure about mysql, but postgre reguired this)
    Most probably it would be the same in mysql.
    <connection-url>jdbc:postgresql://127.0.0.1:5432/Dissertation</connection-url>
    Not sure if this is what you reguire, i am new at this my self

  • J2EE Container Managed Security doc and inquiry about what to do if I tweak

    hello:
    If the application_roles is taken out of the database schema, would the example still work with minimal changes? There is a possibility our organization may a separate department handling username and password while our app and our separate database will handle roles. Is there something I need to be aware of or is it just a matter of looking up the role in a separate table after authentication? Based on roles, users will have different authorities. is there something built in Oracle JDev?
    Thanks

    Hi,
    you can do anything you want with custom LoginModules. If the provided database login module in OC4J is not sufficient then you can also build yur own login module (or use one of the three I built and published 2 years ago). So the answer is that it is not relevant of where the role definition comes from as long as it is associated with the user upon authentication
    Frank

  • Using container managed form-based security in JSF

    h1. Using container managed, form-based security in a JSF web app.
    A Practical Solution
    h2. {color:#993300}*But first, some background on the problem*{color}
    The Form components available in JSF will not let you specify the target action, everything is a post-back. When using container security, however, you have to specifically submit to the magic action j_security_check to trigger authentication. This means that the only way to do this in a JSF page is to use an HTML form tag enclosed in verbatim tags. This has the side effect that the post is not handled by JSF at all meaning you can't take advantage of normal JSF functionality such as validators, plus you have a horrible chimera of a page containing both markup and components. This screws up things like skinning. ([credit to Duncan Mills in this 2 years old article|http://groundside.com/blog/DuncanMills.php?title=j2ee_security_a_jsf_based_login_form&more=1&c=1&tb=1&pb=1]).
    In this solution, I will use a pure JSF page as the login page that the end user interacts with. This page will simply gather the input for the username and password and pass that on to a plain old jsp proxy to do the actual submit. This will avoid the whole problem of having to use verbatim tags or a mixture of JSF and JSP in the user view.
    h2. {color:#993300}*Step 1: Configure the Security Realm in the Web App Container*{color}
    What is a container? A container is basically a security framework that is implemented directly by whatever app server you are running, in my case Glassfish v2ur2 that comes with Netbeans 6.1. Your container can have multiple security realms. Each realm manages a definition of the security "*principles*" that are defined to interact with your application. A security principle is basically just a user of the system that is defined by three fields:
    - Username
    - Group
    - Password
    The security realm can be set up to authenticate using a simple file, or through JDBC, or LDAP, and more. In my case, I am using a "file" based realm. The users are statically defined directly through the app server interface. Here's how to do it (on Glassfish):
    1. Start up your app server and log into the admin interface (http://localhost:4848)
    2. Drill down into Configuration > Security > Realms.
    3. Here you will see the default realms defined on the server. Drill down into the file realm.
    4. There is no need to change any of the default settings. Click the Manage Users button.
    5. Create a new user by entering username/password.
    Note: If you enter a group name then you will be able to define permissions based on group in your app, which is much more usefull in a real app.
    I entered a group named "Users" since my app will only have one set of permissions and all users should be authenticated and treated the same.
    That way I will be able to set permissions to resources for the "Users" group that will apply to all users that have this group assigned.
    TIP: After you get everything working, you can hook it all up to JDBC instead of "file" so that you can manage your users in a database.
    h2. {color:#993300}*Step 2: Create the project*{color}
    Since I'm a newbie to JSF, I am using Netbeans 6.1 so that I can play around with all of the fancy Visual Web JavaServer Faces components and the visual designer.
    1. Start by creating a new Visual Web JSF project.
    2. Next, create a new subfolder under your web root called "secure". This is the folder that we will define a Security Constraint for in a later step, so that any user trying to access any page in this folder will be redirected to a login page to sign in, if they haven't already.
    h2. {color:#993300}*Step 3: Create the JSF and JSP files*{color}
    In my very simple project I have 3 pages set up. Create the following files using the default templates in Netbeans 6.1:
    1. login.jsp (A Visual Web JSF file)
    2. loginproxy.jspx (A plain JSPX file)
    3. secure/securepage.jsp (A Visual Web JSF file... Note that it is in the sub-folder named secure)
    Code follows for each of the files:
    h3. {color:#ff6600}*First we need to add a navigation rule to faces-config.xml:*{color}
        <navigation-rule>
    <from-view-id>/login.jsp</from-view-id>
            <navigation-case>
    <from-outcome>loginproxy</from-outcome>
    <to-view-id>/loginproxy.jspx</to-view-id>
            </navigation-case>
        </navigation-rule>
    NOTE: This navigation rule simply forwards the request to loginproxy.jspx whenever the user clicks the submit button. The button1_action() method below returns the "loginproxy" case to make this happen.
    h3. {color:#ff6600}*login.jsp -- A very simple Visual Web JSF file with two input fields and a button:*{color}
    <?xml version="1.0" encoding="UTF-8"?>
    <jsp:root version="2.1"
    xmlns:f="http://java.sun.com/jsf/core"
    xmlns:h="http://java.sun.com/jsf/html"
    xmlns:jsp="http://java.sun.com/JSP/Page"
    xmlns:webuijsf="http://www.sun.com/webui/webuijsf">
        <jsp:directive.page
    contentType="text/html;charset=UTF-8"
    pageEncoding="UTF-8"/>
        <f:view>
            <webuijsf:page
    id="page1">
    <webuijsf:html id="html1">
    <webuijsf:head id="head1">
    <webuijsf:link id="link1"
    url="/resources/stylesheet.css"/>
    </webuijsf:head>
    <webuijsf:body id="body1" style="-rave-layout: grid">
    <webuijsf:form id="form1">
    <webuijsf:textField binding="#{login.username}"
    id="username" style="position: absolute; left: 216px; top:
    96px"/>
    <webuijsf:passwordField binding="#{login.password}" id="password"
    style="left: 216px; top: 144px; position: absolute"/>
    <webuijsf:button actionExpression="#{login.button1_action}"
    id="button1" style="position: absolute; left: 216px; top:
    216px" text="GO"/>
    </webuijsf:form>
    </webuijsf:body>
    </webuijsf:html>
            </webuijsf:page>
        </f:view>
    </jsp:root>h3. *login.java -- implent the
    button1_action() method in the login.java backing bean*
        public String button1_action() {
            setValue("#{requestScope.username}",
    (String)username.getValue());
    setValue("#{requestScope.password}", (String)password.getValue());
            return "loginproxy";
        }h3. {color:#ff6600}*loginproxy.jspx -- a login proxy that the user never sees. The onload="document.forms[0].submit()" automatically submits the form as soon as it is rendered in the browser.*{color}
    {code}
    <?xml version="1.0" encoding="UTF-8"?>
    <jsp:root xmlns:jsp="http://java.sun.com/JSP/Page"
    version="2.0">
    <jsp:output omit-xml-declaration="true" doctype-root-element="HTML"
    doctype-system="http://www.w3.org/TR/html4/loose.dtd"
    doctype-public="-W3CDTD HTML 4.01 Transitional//EN"/>
    <jsp:directive.page contentType="text/html"
    pageEncoding="UTF-8"/>
    <html>
    <head> <meta
    http-equiv="Content-Type" content="text/html;
    charset=UTF-8"/>
    <title>Logging in...</title>
    </head>
    <body
    onload="document.forms[0].submit()">
    <form
    action="j_security_check" method="POST">
    <input type="hidden" name="j_username"
    value="${requestScope.username}" />
    <input type="hidden" name="j_password"
    value="${requestScope.password}" />
    </form>
    </body>
    </html>
    </jsp:root>
    {code}
    h3. {color:#ff6600}*secure/securepage.jsp -- A simple JSF{color}
    target page, placed in the secure folder to test access*
    {code}
    <?xml version="1.0" encoding="UTF-8"?>
    <jsp:root version="2.1"
    xmlns:f="http://java.sun.com/jsf/core"
    xmlns:h="http://java.sun.com/jsf/html"
    xmlns:jsp="http://java.sun.com/JSP/Page" xmlns:webuijsf="http://www.sun.com/webui/webuijsf">
    <jsp:directive.page
    contentType="text/html;charset=UTF-8"
    pageEncoding="UTF-8"/>
    <f:view>
    <webuijsf:page
    id="page1">
    <webuijsf:html id="html1">
    <webuijsf:head id="head1">
    <webuijsf:link id="link1"
    url="/resources/stylesheet.css"/>
    </webuijsf:head>
    <webuijsf:body id="body1" style="-rave-layout: grid">
    <webuijsf:form id="form1">
    <webuijsf:staticText id="staticText1" style="position:
    absolute; left: 168px; top: 144px" text="A Secure Page"/>
    </webuijsf:form>
    </webuijsf:body>
    </webuijsf:html>
    </webuijsf:page>
    </f:view>
    </jsp:root>
    {code}
    h2. {color:#993300}*_Step 4: Configure Declarative Security_*{color}
    This type of security is called +declarative+ because it is not configured programatically. It is configured by declaring all of the relevant parameters in the configuration files: *web.xml* and *sun-web.xml*. Once you have it configured, the container (application server and java framework) already have the implementation to make everything work for you.
    *web.xml will be used to define:*
    - Type of security - We will be using "form based". The loginpage.jsp we created will be set as both the login and error page.
    - Security Roles - The security role defined here will be mapped (in sun-web.xml) to users or groups.
    - Security Constraints - A security constraint defines the resource(s) that is being secured, and which Roles are able to authenticate to them.
    *sun-web.xml will be used to define:*
    - This is where you map a Role to the Users or Groups that are allowed to use it.
    +I know this is confusing the first time, but basically it works like this:+
    *Security Constraint for a URL* -> mapped to -> *Role* -> mapped to -> *Users & Groups*
    h3. {color:#ff6600}*web.xml -- here's the relevant section:*{color}
    {code}
    <security-constraint>
    <display-name>SecurityConstraint</display-name>
    <web-resource-collection>
    <web-resource-name>SecurePages</web-resource-name>
    <description/>
    <url-pattern>/faces/secure/*</url-pattern>
    <http-method>GET</http-method>
    <http-method>POST</http-method>
    <http-method>HEAD</http-method>
    <http-method>PUT</http-method>
    <http-method>OPTIONS</http-method>
    <http-method>TRACE</http-method>
    <http-method>DELETE</http-method>
    </web-resource-collection>
    <auth-constraint>
    <description/>
    <role-name>User</role-name>
    </auth-constraint>
    </security-constraint>
    <login-config>
    <auth-method>FORM</auth-method>
    <realm-name/>
    <form-login-config>
    <form-login-page>/faces/login.jsp</form-login-page>
    <form-error-page>/faces/login.jsp</form-error-page>
    </form-login-config>
    </login-config>
    <security-role>
    <description/>
    <role-name>User</role-name>
    </security-role>
    {code}
    h3. {color:#ff6600}*sun-web.xml -- here's the relevant section:*{color}
    {code}
    <security-role-mapping>
    <role-name>User</role-name>
    <group-name>Users</group-name>
    </security-role-mapping>
    {code}
    h3. {color:#ff6600}*Almost done!!!*{color}
    h2. {color:#993300}*_Step 5: A couple of minor "Gotcha's"_ *{color}
    h3. {color:#ff6600}*_Gotcha #1_*{color}
    You need to configure the "welcome page" in web.xml to point to faces/secure/securepage.jsp ... Note that there is *_no_* leading / ... If you put a / in there it will barf all over itself .
    h3. {color:#ff6600}*_Gotcha #2_*{color}
    Note that we set the <form-login-page> in web.xml to /faces/login.jsp ... Note the leading / ... This time, you NEED the leading slash, or the server will gag.
    *DONE!!!*
    h2. {color:#993300}*_Here's how it works:_*{color}
    1. The user requests the a page from your context (http://localhost/MyLogin/)
    2. The servlet forwards the request to the welcome page: faces/secure/securepage.jsp
    3. faces/secure/securepage.jsp has a security constraint defined, so the servlet checks to see if the user is authenticated for the session.
    4. Of course the user is not authenticated since this is the first request, so the servlet forwards the request to the login page we configured in web.xml (/faces/login.jsp).
    5. The user enters username and password and clicks a button to submit.
    6. The button's action method stores away the username and password in the request scope.
    7. The button returns "loginproxy" navigation case which tells the navigation handler to forward the request to loginproxy.jspx
    8. loginproxy.jspx renders a blank page to the user which has hidden username and password fields.
    9. The hidden username and password fields grab the username and password variables from the request scope.
    10. The loginproxy page is automatically submitted with the magic action "j_security_check"
    11. j_security_check notifies the container that authentication needs to be intercepted and handled.
    12. The container authenticates the user credentials.
    13. If the credentials fail, the container forwards the request to the login.jsp page.
    14. If the credentials pass, the container forwards the request to *+the last protected resource that was attempted.+*
    +Note the last point! I don't know how, but no matter how many times you fail authentication, the container remembers the last page that triggered authentication and once you finally succeed the container forwards your request there!!!!+
    +The user is now at the secure welcome page.+
    If you have read this far, I thank you for your time, and I seriously question your ability to ration your time pragmatically.
    Kerry Randolph

    If you want login security on your web app, this is one way to do it. (the easiest way i have seen).
    This method allows you to create a custom login form and error page using JSF.
    The container handles the actual authentication and protection of the resources based on what you declare in web.xml and sun-web.xml.
    This example uses a statically defined user/password, stored in a file, but you can also configure JDBC realm in Glassfish, so that that users can register for access and your program can store the username/passwrod in a database.
    I'm new to programming, so none of this may be a good practice, or may not be secure at all.
    I really don't know what I'm doing, but I'm learning, and this has been the easiest way that I have found to add authentication to a web app, without having to write the login modules yourself.
    Another benefit, and I think this is key ***You don't have to include any extra code in the pages that you want to protect*** The container manages this for you, based on the constraints you declare in web.xml.
    So basically you set it up to protect certain folders, then when any user tries to access pages in that folder, they are required to authenticate.
    --Kerry                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   

  • Custom Authentication Provider and User Manage like SQLAuthenticator, How?

    Hi everyone,
    I faced a problem with login function of my portal (Webcenter Application). The Problem is:
    - Allow the users logging in by user that store in another system. I must communicate using low level of socket. This really is not a problem.
    - If user logged in, for first time of logging in, i must store them in some identity store (Maybe tables database).
    - View Users in Weblogic Console. To do that, i known that i must implemeted something that i dont what that are.
    Here are my work:
    - I Created a Custom Authentication Provider. And configuration in Admin Console. But i don't know what are that i should implementing to View user & group in Admin Console.
    - I Cannot logging in: After i created simple application for testing, i cannot logging in even i tested with SQLAuthenticator Provider and original DefaultProvider. In Logging Console, I saw every I Printed In The Code of Login Module.
    Here are my Code:
    <?xml version="1.0" ?>
    <MBeanType Name = "OrkitVASPortal" DisplayName = "OrkitVASPortal"
               Package = "orkit"
               Extends = "weblogic.management.security.authentication.Authenticator"
               PersistPolicy = "OnUpdate">
        <MBeanAttribute
            Name        = "ProviderClassName"
            Type        = "java.lang.String"
            Writeable   = "false"
            Default     = "&quot;orkit.OrkitVASPortalProviderImpl&quot;"
    />
        <MBeanAttribute
            Name        = "Description"
            Type        = "java.lang.String"
            Writeable   = "false"
            Default     = "&quot;WebLogic Simple Sample Audit Provider&quot;"
    />
        <MBeanAttribute
            Name        = "Version"
            Type        = "java.lang.String"
            Writeable   = "false"
            Default     = "&quot;1.0&quot;"
    />
        <MBeanAttribute
            Name        = "LogFileName"
            Type        = "java.lang.String"
            Default     = "&quot;SimpleSampleAuditor.log&quot;"
    />
    </MBeanType>
    package orkit;
    import java.util.HashMap;
    import javax.security.auth.login.AppConfigurationEntry;
    import javax.security.auth.login.AppConfigurationEntry.LoginModuleControlFlag;
    import weblogic.management.security.ProviderMBean;
    import weblogic.security.provider.PrincipalValidatorImpl;
    import weblogic.security.spi.*;
    public final class OrkitVASPortalProviderImpl implements AuthenticationProviderV2 {
        private String description;
        private LoginModuleControlFlag controlFlag;
        public OrkitVASPortalProviderImpl() {
            System.out.println("The Orkit VASPortal Provider Implemented!!!!!");
        @Override
        public IdentityAsserterV2 getIdentityAsserter() {
            return null;
        // Our mapping of users to passwords/groups, instead of being in LDAP or in a
        // database, is represented by a HashMap of MyUserDetails objects..
        public class MyUserDetails {
            String pw;
            String group;
            // We use this to represent the user's groups and passwords
            public MyUserDetails(String pw, String group) {
                this.pw = pw;
                this.group = group;
            public String getPassword() {
                return pw;
            public String getGroup() {
                return group;
        // This is our database
        private HashMap userGroupMapping = null;
        public void initialize(ProviderMBean mbean, SecurityServices services) {
            System.out.println("The Orkit VASPortal Provider is intializing......");
            OrkitVASPortalMBean myMBean = (OrkitVASPortalMBean) mbean;
            description = myMBean.getDescription() + "\n" + myMBean.getVersion();
            System.err.println("#In realm:" + myMBean.getRealm().wls_getDisplayName());
            // We would typically use the realm name to find the database
            // we want to use for authentication. Here, we just create one.
            userGroupMapping = new HashMap();
            userGroupMapping.put("a", new MyUserDetails("passworda", "g1"));
            userGroupMapping.put("b", new MyUserDetails("passwordb", "g2"));
            userGroupMapping.put("system", new MyUserDetails("12341234",
                    "Administrators"));
            String flag = myMBean.getControlFlag();
            if (flag.equalsIgnoreCase("REQUIRED")) {
                controlFlag = LoginModuleControlFlag.REQUIRED;
            } else if (flag.equalsIgnoreCase("OPTIONAL")) {
                controlFlag = LoginModuleControlFlag.OPTIONAL;
            } else if (flag.equalsIgnoreCase("REQUISITE")) {
                controlFlag = LoginModuleControlFlag.REQUISITE;
            } else if (flag.equalsIgnoreCase("SUFFICIENT")) {
                controlFlag = LoginModuleControlFlag.SUFFICIENT;
            } else {
                throw new IllegalArgumentException("Invalid control flag " + flag);
        public AppConfigurationEntry getLoginModuleConfiguration() {
            HashMap options = new HashMap();
            options.put("usermap", userGroupMapping);
            System.out.println("UserMap: " + options);
            return new AppConfigurationEntry(
                    "orkit.OrkitVASPortalLoginModule",
                    controlFlag, options);
        public String getDescription() {
            return description;
        public PrincipalValidator getPrincipalValidator() {
            return new PrincipalValidatorImpl();
        public AppConfigurationEntry getAssertionModuleConfiguration() {
            return null;
    //    public IdentityAsserter getIdentityAsserter() {
    //        return null;
        public void shutdown() {
    * To change this template, choose Tools | Templates
    * and open the template in the editor.
    package orkit;
    import orkit.OrkitVASPortalProviderImpl;
    import java.io.IOException;
    import java.util.*;
    import javax.security.auth.Subject;
    import javax.security.auth.callback.*;
    import javax.security.auth.login.*;
    import javax.security.auth.spi.LoginModule;
    import weblogic.security.principal.WLSGroupImpl;
    import weblogic.security.principal.WLSUserImpl;
    * This login module will be called by our Authentication Provider. It assumes
    * that the option, usermap, will be passed which contains the map of users to
    * passwords and groups.
    public class OrkitVASPortalLoginModule implements LoginModule {
        private Subject subject;
        private CallbackHandler callbackHandler;
        private HashMap userMap;
        // Authentication status
        private boolean loginSucceeded;
        private boolean principalsInSubject;
        private Vector principalsBeforeCommit = new Vector();
        public void initialize(Subject subject, CallbackHandler callbackHandler,
                Map sharedState, Map options) {
            this.subject = subject;
            this.callbackHandler = callbackHandler;
            // Fetch user/password map that should be set by the authenticator
            userMap = (HashMap) options.get("usermap");
         * Called once after initialize to try and log the person in
        public boolean login() throws LoginException {
            // First thing we do is create an array of callbacks so that
            // we can get the data from the user
            Callback[] callbacks;
            callbacks = new Callback[2];
            callbacks[0] = new NameCallback("username: ");
            callbacks[1] = new PasswordCallback("password: ", false);
            try {
                callbackHandler.handle(callbacks);
            } catch (IOException eio) {
                throw new LoginException(eio.toString());
            } catch (UnsupportedCallbackException eu) {
                throw new LoginException(eu.toString());
            String username = ((NameCallback) callbacks[0]).getName();
            System.out.println("Username: " + username);
            char[] pw = ((PasswordCallback) callbacks[1]).getPassword();
            String password = new String(pw);
            System.out.println("PASSWORD: " + password);
            if (username.length() > 0) {
                if (!userMap.containsKey(username)) {
                    throw new FailedLoginException("Authentication Failed: Could not find user:" + username);
                }else{
                    System.out.println("Contstainded Username");
                String realPassword = ((OrkitVASPortalProviderImpl.MyUserDetails) userMap.get(username)).getPassword();
                if (realPassword == null || !realPassword.equals(password)) {
                    throw new FailedLoginException("Authentication Failed: Password incorrect for user" + username);
                }else{
                    System.out.println("Everyitng OKIE");
            } else {
                // No Username, so anonymous access is being attempted
            loginSucceeded = true;
            // We collect some principals that we would like to add to the user
            // once this is committed.
            // First, we add his username itself
            principalsBeforeCommit.add(new WLSUserImpl(username));
            // Now we add his group
            principalsBeforeCommit.add(new WLSGroupImpl(((OrkitVASPortalProviderImpl.MyUserDetails) userMap.get(username)).getGroup()));
            return loginSucceeded;
        public boolean commit() throws LoginException {
            if (loginSucceeded) {
                subject.getPrincipals().removeAll(principalsBeforeCommit);
                principalsInSubject = true;
                return true;
            } else {
                return false;
        public boolean abort() throws LoginException {
            if (principalsInSubject) {
                subject.getPrincipals().removeAll(principalsBeforeCommit);
                principalsInSubject = false;
            return true;
        public boolean logout() throws LoginException {
            return true;
    }and OrkitVASPortalMBean & OrkitVASPortalImpl class created by MBeanMaker tool.
    Can someome help.
    Thanks in advance!

    Hi ,
    SQLAuthenticator is not yet supported with UCM 11g due to some JPS Provider limitations .
    Currently there is an Enhancement request for this .
    Thanks
    Srinath

  • Custom Authentication With Identity Store

    Hi everyone,
    I faced a problem with login function of my portal (Webcenter Application). The Problem is:
    - Allow the users logging in by user that store in another system. I must communicate using low level of socket. This really is not a problem.
    - If user logged in, for first time of logging in, i must store them in some identity store (Maybe tables database).
    - View Users in Weblogic Console. To do that, i known that i must implemeted something that i dont what that are.
    Here are my work:
    - I Created a Custom Authentication Provider. And configuration in Admin Console. But i don't know what are that i should implementing to View user & group in Admin Console.
    - I Cannot logging in: After i created simple application for testing, i cannot logging in even i tested with SQLAuthenticator Provider and original DefaultProvider. In Logging Console, I saw every I Printed In The Code of Login Module.
    Here are my Code:
    <?xml version="1.0" ?>
    <MBeanType Name = "OrkitVASPortal" DisplayName = "OrkitVASPortal"
               Package = "orkit"
               Extends = "weblogic.management.security.authentication.Authenticator"
               PersistPolicy = "OnUpdate">
        <MBeanAttribute
            Name        = "ProviderClassName"
            Type        = "java.lang.String"
            Writeable   = "false"
            Default     = "&quot;orkit.OrkitVASPortalProviderImpl&quot;"
    />
        <MBeanAttribute
            Name        = "Description"
            Type        = "java.lang.String"
            Writeable   = "false"
            Default     = "&quot;WebLogic Simple Sample Audit Provider&quot;"
    />
        <MBeanAttribute
            Name        = "Version"
            Type        = "java.lang.String"
            Writeable   = "false"
            Default     = "&quot;1.0&quot;"
    />
        <MBeanAttribute
            Name        = "LogFileName"
            Type        = "java.lang.String"
            Default     = "&quot;SimpleSampleAuditor.log&quot;"
    />
    </MBeanType>
    package orkit;
    import java.util.HashMap;
    import javax.security.auth.login.AppConfigurationEntry;
    import javax.security.auth.login.AppConfigurationEntry.LoginModuleControlFlag;
    import weblogic.management.security.ProviderMBean;
    import weblogic.security.provider.PrincipalValidatorImpl;
    import weblogic.security.spi.*;
    public final class OrkitVASPortalProviderImpl implements AuthenticationProviderV2 {
        private String description;
        private LoginModuleControlFlag controlFlag;
        public OrkitVASPortalProviderImpl() {
            System.out.println("The Orkit VASPortal Provider Implemented!!!!!");
        @Override
        public IdentityAsserterV2 getIdentityAsserter() {
            return null;
        // Our mapping of users to passwords/groups, instead of being in LDAP or in a
        // database, is represented by a HashMap of MyUserDetails objects..
        public class MyUserDetails {
            String pw;
            String group;
            // We use this to represent the user's groups and passwords
            public MyUserDetails(String pw, String group) {
                this.pw = pw;
                this.group = group;
            public String getPassword() {
                return pw;
            public String getGroup() {
                return group;
        // This is our database
        private HashMap userGroupMapping = null;
        public void initialize(ProviderMBean mbean, SecurityServices services) {
            System.out.println("The Orkit VASPortal Provider is intializing......");
            OrkitVASPortalMBean myMBean = (OrkitVASPortalMBean) mbean;
            description = myMBean.getDescription() + "\n" + myMBean.getVersion();
            System.err.println("#In realm:" + myMBean.getRealm().wls_getDisplayName());
            // We would typically use the realm name to find the database
            // we want to use for authentication. Here, we just create one.
            userGroupMapping = new HashMap();
            userGroupMapping.put("a", new MyUserDetails("passworda", "g1"));
            userGroupMapping.put("b", new MyUserDetails("passwordb", "g2"));
            userGroupMapping.put("system", new MyUserDetails("12341234",
                    "Administrators"));
            String flag = myMBean.getControlFlag();
            if (flag.equalsIgnoreCase("REQUIRED")) {
                controlFlag = LoginModuleControlFlag.REQUIRED;
            } else if (flag.equalsIgnoreCase("OPTIONAL")) {
                controlFlag = LoginModuleControlFlag.OPTIONAL;
            } else if (flag.equalsIgnoreCase("REQUISITE")) {
                controlFlag = LoginModuleControlFlag.REQUISITE;
            } else if (flag.equalsIgnoreCase("SUFFICIENT")) {
                controlFlag = LoginModuleControlFlag.SUFFICIENT;
            } else {
                throw new IllegalArgumentException("Invalid control flag " + flag);
        public AppConfigurationEntry getLoginModuleConfiguration() {
            HashMap options = new HashMap();
            options.put("usermap", userGroupMapping);
            System.out.println("UserMap: " + options);
            return new AppConfigurationEntry(
                    "orkit.OrkitVASPortalLoginModule",
                    controlFlag, options);
        public String getDescription() {
            return description;
        public PrincipalValidator getPrincipalValidator() {
            return new PrincipalValidatorImpl();
        public AppConfigurationEntry getAssertionModuleConfiguration() {
            return null;
    //    public IdentityAsserter getIdentityAsserter() {
    //        return null;
        public void shutdown() {
    * To change this template, choose Tools | Templates
    * and open the template in the editor.
    package orkit;
    import orkit.OrkitVASPortalProviderImpl;
    import java.io.IOException;
    import java.util.*;
    import javax.security.auth.Subject;
    import javax.security.auth.callback.*;
    import javax.security.auth.login.*;
    import javax.security.auth.spi.LoginModule;
    import weblogic.security.principal.WLSGroupImpl;
    import weblogic.security.principal.WLSUserImpl;
    * This login module will be called by our Authentication Provider. It assumes
    * that the option, usermap, will be passed which contains the map of users to
    * passwords and groups.
    public class OrkitVASPortalLoginModule implements LoginModule {
        private Subject subject;
        private CallbackHandler callbackHandler;
        private HashMap userMap;
        // Authentication status
        private boolean loginSucceeded;
        private boolean principalsInSubject;
        private Vector principalsBeforeCommit = new Vector();
        public void initialize(Subject subject, CallbackHandler callbackHandler,
                Map sharedState, Map options) {
            this.subject = subject;
            this.callbackHandler = callbackHandler;
            // Fetch user/password map that should be set by the authenticator
            userMap = (HashMap) options.get("usermap");
         * Called once after initialize to try and log the person in
        public boolean login() throws LoginException {
            // First thing we do is create an array of callbacks so that
            // we can get the data from the user
            Callback[] callbacks;
            callbacks = new Callback[2];
            callbacks[0] = new NameCallback("username: ");
            callbacks[1] = new PasswordCallback("password: ", false);
            try {
                callbackHandler.handle(callbacks);
            } catch (IOException eio) {
                throw new LoginException(eio.toString());
            } catch (UnsupportedCallbackException eu) {
                throw new LoginException(eu.toString());
            String username = ((NameCallback) callbacks[0]).getName();
            System.out.println("Username: " + username);
            char[] pw = ((PasswordCallback) callbacks[1]).getPassword();
            String password = new String(pw);
            System.out.println("PASSWORD: " + password);
            if (username.length() > 0) {
                if (!userMap.containsKey(username)) {
                    throw new FailedLoginException("Authentication Failed: Could not find user:" + username);
                }else{
                    System.out.println("Contstainded Username");
                String realPassword = ((OrkitVASPortalProviderImpl.MyUserDetails) userMap.get(username)).getPassword();
                if (realPassword == null || !realPassword.equals(password)) {
                    throw new FailedLoginException("Authentication Failed: Password incorrect for user" + username);
                }else{
                    System.out.println("Everyitng OKIE");
            } else {
                // No Username, so anonymous access is being attempted
            loginSucceeded = true;
            // We collect some principals that we would like to add to the user
            // once this is committed.
            // First, we add his username itself
            principalsBeforeCommit.add(new WLSUserImpl(username));
            // Now we add his group
            principalsBeforeCommit.add(new WLSGroupImpl(((OrkitVASPortalProviderImpl.MyUserDetails) userMap.get(username)).getGroup()));
            return loginSucceeded;
        public boolean commit() throws LoginException {
            if (loginSucceeded) {
                subject.getPrincipals().removeAll(principalsBeforeCommit);
                principalsInSubject = true;
                return true;
            } else {
                return false;
        public boolean abort() throws LoginException {
            if (principalsInSubject) {
                subject.getPrincipals().removeAll(principalsBeforeCommit);
                principalsInSubject = false;
            return true;
        public boolean logout() throws LoginException {
            return true;
    }and OrkitVASPortalMBean & OrkitVASPortalImpl class created by MBeanMaker tool.
    Can someome help.
    Thank you very much!

    When i login with the password and username from my custom authentication provider, my login module check ok, but logon form still there.

  • History Attributes when using Custom Authentication Type

    assigned all History Attributes (in the Entity Object Editor) to my audit columns.
    During run time, I find only Created By is assigned the SYSDATE, and Created On, Modified On, and Modified By are null.
    I am using Custom Authentication Type.
    I have read that the History Attributes only work the the JAAS authentication type. Appreciate any one confirming this.
    Also, how do you implement History Attributes if you are using the Custom Authentication Type? Do you need to write Java code?
    Thanks.
    John

    Hi,
    confirmed it only works with container managed authentication performed through JAZN. You can't use this with custom security as otherwise this feature could be overwritten. Still you can provide your own implementation:
    - create a custom table
    - use the setAttr method on the RowImpl class of a VO to store the username
    Frank

  • Updating a Property in my Custom Authenticator MBean

    I have created a custom AuthenticationProvider. It is configured through an
    MBean produced by WebLogicMBeanMaker from my XML file. I have a custom
    property in the XML file with a default value. My AuthenticationProvider is
    able to get the bean and read back the default value.
    Now, I wish to change that value to something else to allow uses to
    configure the provider. The documentation clearly says that I will be
    unable to use the Weblogic Console to do this and will have to use the
    command line "weblogic.Admin" application to do it. This is fine, but I
    cannot figure out how to access or modify my MBean.
    How do I know the MBeans name or type? The MBean generated is called
    WeblogicCarbonAuthenticatorMBean.java
    I have tried (I have not include username/password in this post for brevity)
    java weblogic.Admin GET -type WeblogicCarbonAuthenticator
    No MBeans found
    java weblogic.Admin GET -type Authenticator
    No MBeans found
    No success.
    I also deployed a pair of JSPs called listMBeans.jsp and showMBean.jsp,
    which claim to show me all the MBeans deployed. Searching through the list
    I see nothing with the world "Carbon" or "Authenticator" in it.
    How can I find/configure my Authenticator MBeans?
    Thanks
    -jordan

    Jordan Reed wrote:
    Getting there! I can now look at my bean, but I cannot seem to update it.
    There is a string property on the MBean called "UserManagerLocation" that I
    need the end user to be able to update to their appropriate location.
    I am able to use the weblogic.Admin utility to query the MBean, but not to
    update.
    So here is my query:
    java weblogic.Admin -pretty GET -mbean
    Security:Name=myrealmWeblogicCarbonAuthenticator
    MBeanName: "Security:Name=myrealmWeblogicCarbonAuthenticator"
    ControlFlag: REQUIRED
    Description: Carbon Authentication Provider adapts authentication
    behavior to the User Manager Service
    ProviderClassName:
    com.sapient.services.security.auth.weblogic7.WeblogicCarbonAuthenticationPro
    vider
    Realm: Security:Name=myrealm
    UserManagerLocation: /security/management/test/RdbmsUserManager
    Version: 4.2
    But here is my failing update:
    java weblogic.Admin SET -mbean
    Security:Name=myrealmWeblogicCarbonAuthenticator -property
    UserManagerLocation "/security/management/RdbmsUserManager"
    MBean not specified for setting of attributes. Value UserManagerLocation for
    parameter ["9"]Get rid of the "'s around the Value. If that does not work, try
    something like this,
    java weblogic.Admin SET -mbean
    Security:Name=myrealmWeblogicCarbonAuthenticator -commotype -property
    UserManagerLocation /security/management/RdbmsUserManager
    If that does not work, please open a support case with BEA.
    Thanks,
    -satya
    >
    >
    >
    But, inside my MBean descriptor I've got it set as writable:
    <MBeanType
    Name = "WeblogicCarbonAuthenticator"
    DisplayName = "WeblogicCarbonAuthenticator"
    Package = "com.sapient.services.security.auth.weblogic7"
    Extends =
    "weblogic.management.security.authentication.Authenticator"
    PersistPolicy = "OnUpdate"
    Writable = "true"
    >
    <MBeanAttribute
    Name = "UserManagerLocation"
    Type = "java.lang.String"
    PersistPolicy = "OnUpdate"
    Readable = "true"
    Writeable = "true"
    Default =
    ""/security/management/test/RdbmsUserManager""
    />
    </MBeanType>
    Any clue why I am unable to update the attribute from the command line?
    Thanks
    -Jordan
    "Satya Ghattu" <[email protected]> wrote in message
    news:[email protected]...
    Jordan,
    You can use weblogic.Admin utility to change values of your custom MBean
    if you know the object name of your MBean.
    Jordan Reed wrote:
    I have created a custom AuthenticationProvider. It is configured
    through an
    MBean produced by WebLogicMBeanMaker from my XML file. I have a custom
    property in the XML file with a default value. MyAuthenticationProvider is
    able to get the bean and read back the default value.
    Now, I wish to change that value to something else to allow uses to
    configure the provider. The documentation clearly says that I will be
    unable to use the Weblogic Console to do this and will have to use the
    command line "weblogic.Admin" application to do it. This is fine, but I
    cannot figure out how to access or modify my MBean.
    How do I know the MBeans name or type? The MBean generated is called
    WeblogicCarbonAuthenticatorMBean.java
    I have tried (I have not include username/password in this post forbrevity)
    java weblogic.Admin GET -type WeblogicCarbonAuthenticator
    No MBeans foundyou should use the fully qualified MBean name. i.e
    java weblogic.Admin GET -type foo.blah.WeblogicCarbonAuthenticator
    java weblogic.Admin GET -type Authenticator
    No MBeans found
    No success.
    I also deployed a pair of JSPs called listMBeans.jsp and showMBean.jsp,
    which claim to show me all the MBeans deployed. Searching through the
    list
    I see nothing with the world "Carbon" or "Authenticator" in it.
    How can I find/configure my Authenticator MBeans?I assume that you are using 7.0sp1, if not please upgrade to sp1. You
    should see a file called CommoConfig.xm.booted file under your domain
    directory, this file contains all the security MBeans that the server
    found. You should be able to get the object names of your custom mbeans
    from this file.
    Hope it helped,
    -satya
    Thanks
    -jordan

  • Custom Authentication Module on Identity Server

    Hi,
    I have a custom authentication module which I am trying to access through the policy agent.
    I have set the following property in AMAgent.properties file
    com.sun.am.policy.am.loginURL= http://host:port/amserver/UI/Login?module=CustomLoginModule.
    My login module code is something like this:
    package com.iplanet.am.samples.authentication.providers;
    import java.util.*;
    import javax.security.auth.Subject;
    import javax.security.auth.callback.Callback;
    import javax.security.auth.callback.NameCallback;
    import javax.security.auth.callback.PasswordCallback;
    import javax.security.auth.login.LoginException;
    import com.sun.identity.authentication.spi.AMLoginModule;
    import com.sun.identity.authentication.spi.AuthLoginException;
    import java.rmi.RemoteException;
    import java.io.FileInputStream;
    import java.util.Properties;
    public class LoginModule1 extends AMLoginModule
    private String userName;
    private String userTokenId;
    private HashMap usersMap;
    private java.security.Principal userPrincipal = null;
    public LoginModule1() throws LoginException
    public void init(Subject subject, Map sharedState, Map options)
              System.out.println("LoginModule1 initialization");
              usersMap = new HashMap();
              ResourceBundle bundle = ResourceBundle.getBundle("users");
              Enumeration users = bundle.getKeys();
              while (users.hasMoreElements())
                   String user = (String)users.nextElement();
                   String password = bundle.getString(user.trim());
                   usersMap.put(user, password);
    public int process(Callback[] callbacks, int state) throws AuthLoginException
              int currentState = state;
              if (currentState == 1)
                   userName = ((NameCallback) callbacks[0]).getName().trim();
                   char[] passwd = ((PasswordCallback) callbacks[1]).getPassword();
                   String passwdString = new String (passwd);
                   if (userName.equals(""))
                        throw new AuthLoginException("names must not be empty");
                   if (userName.equals("testuser") && passwdString.equals("testuser"))
                        userTokenId = userName;
                        return -1;
                   if (usersMap.containsKey(userName))
                        if (usersMap.get(userName).equals(new String(passwd)))
                             userTokenId = userName;
                             return -1;
                   return 0;
         public java.security.Principal getPrincipal()
              if (userPrincipal != null)
                   return userPrincipal;
              else
              if (userTokenId != null)
                   userPrincipal = new SamplePrincipal("testuser");
                   return userPrincipal;
              else
                   return null;
    So When the user requests a protected resource, the policy agent forwards the user to Identity Server with the module as CustomLoginModule. However, after this, authentication does not succeed and I get the following error message in the agent log file.
    2004-08-09 15:24:08.640 Error 2712:130f060 PolicyAgent: validate_session_policy() access allowed to unknown user
    2004-08-09 15:24:09.030 Error 2712:24fda5e8 PolicyAgent: validate_session_policy() access allowed to unknown user
    2004-08-09 15:24:23.484 Error 2712:130f060 PolicyAgent: validate_session_policy() access allowed to unknown user
    2004-08-09 15:24:28.281 Error 2712:24fda5e8 PolicyEngine: am_policy_evaluate: InternalException in Service::construct_auth_svc with error message:Application authentication failed during service creation. and code:20
    2004-08-09 15:24:28.281 Error 2712:24fda5e8 PolicyAgent: validate_session_policy() access allowed to unknown user
    2004-08-09 15:24:29.484 Error 2712:130f060 PolicyAgent: validate_session_policy() access allowed to unknown user
    2004-08-09 15:24:29.499 Error 2712:24fda5e8 PolicyEngine: am_policy_evaluate: InternalException in Service::construct_auth_svc with error message:Application authentication failed during service creation. and code:20
    2004-08-09 15:24:29.499 128 2712:24fda5e8 RemoteLog: User unknown was denied access to http://ps0391.persistent.co.in:80/test/index.html.
    2004-08-09 15:24:29.499 Error 2712:24fda5e8 LogService: LogService::logMessage() loggedBy SSOTokenID is invalid.
    2004-08-09 15:24:29.499 Error 2712:24fda5e8 all: am_log_vlog() failed with status AM_REMOTE_LOG_FAILURE.
    2004-08-09 15:24:29.499 -1 2712:24fda5e8 PolicyAgent: validate_session_policy() access denied to unknown user
    The necessary policy object is already created in Identity Server. Please send your suggestions to fix this problem.
    Thanks
    Srinivas

    Does the principal "testuser" exist in your realm? If I understand your module correctly, it looks like it always returns "testuser".
    I am guessing that Access Manager is not finding your principal. Typically if access manager cannot associate the principal returned by the custom AMLoginModule it will fail the authentication.
    I am wondering if this is related to a seperate problem I have seen with custom login modules. Try chaning the code to return an LDAP style principal it may work:
    so return "uid=testuser,ou=People,dc=yourdomain,dc=com" for example. In theory this should not be necessary but it solved some problems for me, though I am not sure why.

  • New server and/or CA certificate for connection from custom authentication

    We are running Access Manager version 72005Q4 in the Sun ONE Web Server 6.1SP5 B06/23/2005 container with java build 1.5.0_07-b03. I run a custom authentication module which checks sessions against our university single sign on system which is CAS (from Yale/Jasig). The checks are essentially https calls. All this has been working well for us for the last couple of years.
    I would like to migrate the certificate used on the university CAS system from a Verisign certificate to a wildcard certificate issued by the IPS CA in spain -- these are in most browsers but are not in the standard batch of cacerts CA's -- and are free for .edu domains.
    My other java based authentication plugins (Blackboard, custom apps etc) have worked fine once I import the certificate into the cacerts for the java container, but I'm missing something (obvious probably) about importing this certificate so that my amserver custom authentication module can connect to the CAS server once the CAS server is using the new certificate.
    Could anyone provide guidance on where I need to import this server certificate (or preferably the IPS CA) in order to allow the custom authentication module to work properly? I assume this same problem has been solved by people wishing to connect from the amserver to services with self signed certificates. For some reason I'm finding the debugging unexpectedly difficult, I'll outline some of those details below.
    Relevant things I've tried so far:
    Import both the server cert and the IPS CA into the cacerts of the java container identified in the web server server.xml /usr/jdk/entsys-j2se.
    Import the IPS CA into the web server cert8 style db via the web admin server.
    The debugging has surprised me a bit, as I'm not getting an error that is explicitly SSL related error. It almost seems like the URLConnection object ends up using a HttpURLConnection rather than an HttpsURLConnection and never gives me a cert error, rather a connection refused since there is no non SSL service running on CAS. The same code pointed to the server running the verisign cert works as expected.
    Part of the stack:
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: java.net.ConnectException: Connection refused
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at java.net.PlainSocketImpl.socketConnect(Native Method)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at java.net.PlainSocketImpl.doConnect(PlainSocketImpl.java:333)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at java.net.PlainSocketImpl.connectToAddress(PlainSocketImpl.java:195)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at java.net.PlainSocketImpl.connect(PlainSocketImpl.java:182)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at java.net.Socket.connect(Socket.java:516)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at java.net.Socket.connect(Socket.java:466)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at sun.net.NetworkClient.doConnect(NetworkClient.java:157)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at sun.net.www.http.HttpClient.openServer(HttpClient.java:365)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at sun.net.www.http.HttpClient.openServer(HttpClient.java:477)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at sun.net.www.http.HttpClient.<init>(HttpClient.java:214)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at sun.net.www.http.HttpClient.New(HttpClient.java:287)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at sun.net.www.http.HttpClient.New(HttpClient.java:311)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at sun.net.www.protocol.http.HttpURLConnection.setNewClient(HttpURLConnection.java:489)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at sun.net.www.protocol.http.HttpURLConnection.setNewClient(HttpURLConnection.java:477)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at sun.net.www.protocol.http.HttpURLConnection.writeRequests(HttpURLConnection.java:422)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:937)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at edu.yale.its.tp.cas.util.SecureURL.retrieve(Unknown Source)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at edu.yale.its.tp.cas.client.ServiceTicketValidator.validate(Unknown Source)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at edu.fsu.ucs.authentication.providers.CASAMLoginModule.process(CASAMLoginModule.java:86)
    [28/Mar/2008:17:21:54] warning (25335): CORE3283: stderr: at com.sun.identity.authentication.spi.AMLoginModule.wrapProcess(AMLoginModule.java:729)
    The relevent bit of code from the SecureURL.retrieve looks as follows:
    URL u = new URL(url);
    if (!u.getProtocol().equals("https"))
    throw new IOException("only 'https' URLs are valid for this method");
    URLConnection uc = u.openConnection();
    uc.setRequestProperty("Connection", "close");
    r = new BufferedReader(new InputStreamReader(uc.getInputStream()));
    String line;
    StringBuffer buf = new StringBuffer();
    while ((line = r.readLine()) != null)
    buf.append(line + "\n");
    return buf.toString();
    } finally { ...
    The fact that this same code in other authentication modules running outside the amserver (in other web containers as well, tomcat and resin for example) running java 1.5 works fine with the new CA, as well as with self signed certs that I've imported into the appropriate cacerts file leads me to believe that I'm either importing the certificate into the wrong store, or that there is some additional step needed for the amserver in the Sun Web container.
    Thank you very much for any insights and help,
    Ethan

    I thought since this has had a fair number of views I would give an update.
    I have been able to confirm that the custom authentication module is using the cert8 db defined in the AMConfig property com.iplanet.am.admin.cli.certdb.dir as documented. I do seem to have a problem using the certificate to make outgoing connections, even though the certificate verifies correctly for use as a server certificate. This is likely a question for a different forum, but just to show what I'm looking at:
    root@jbc1 providers#/usr/sfw/bin/certutil -V -n "FSU Wildcard Certificate" -d /opt/SUNWwbsvr/alias -P https-jbc1.ucs.fsu.edu-jbc1- -u V
    certutil: certificate is valid
    root@jbc1 providers#/usr/sfw/bin/certutil -V -n "FSU Wildcard Certificate" -d /opt/SUNWwbsvr/alias -P https-jbc1.ucs.fsu.edu-jbc1- -u C
    certutil: certificate is invalid: Certificate type not approved for application.
    root@jbc1 providers#/usr/sfw/bin/certutil -M -n "FSU Wildcard Certificate" -d /opt/SUNWwbsvr/alias -P https-jbc1.ucs.fsu.edu-jbc1- -t uP,uP,uP
    root@jbc1 providers#/usr/sfw/bin/certutil -V -l -n "FSU Wildcard Certificate" -d /opt/SUNWwbsvr/alias -P https-jbc1.ucs.fsu.edu-jbc1- -u C
    FSU Wildcard Certificate : Certificate type not approved for application.
    So it could be that I don't understand how to use the certutiil to get the permissions I want, or it could be that using the same certificate for both server and client functions is not supported -- though you can see why this would be a common case with wildcard certificates.
    BTW for those interested, it did seem to be the case that when the certificate failure occurred that the attempt was then made by the URLConnection to bind to port 80 in cleartext even though the URL was clearly https. I'm sure this was just an attempt to help out misformed URL, but it seemed that the URLConnection implementation in the amserver would swapped traffic over cleartext if that port had been open on the server I was making the https connection to; that seems dangerous to me, I would not have wanted it to quietly work that way exposing sensitive information to the network.
    This was why I was getting back a connection refused instead of a certificate exception. The URLConnection implementation used by the amserver is defined by java.protocol.handler.pkgs=com.iplanet.services.comm argument passwd to the JVM, and I imagine this is done because the amserver pre-dates the inclusion of the sun.net.www.protocol handlers, but I don't know, there maybe reasons why the amserver wants it own handler. I only noticed that this is what was going on when I as casting the httpsURLConnection objects to other types trying to diagnose the certificate problem. I would be interested in hearing if anyone knows if there is a reason not to use sun.net.www.protocol with the amserver.
    After switching to the sun.net.www.protocol handler I was able to get my certificate errors rather than the "Connection Refused" which is what lead me to the above questions about certutil.

Maybe you are looking for

  • How can I use the templates I generated in CS5 Bridge, in Lightroom 4.4?

    How can I use the templates I generated in CS5 Bridge, in Lightroom 4.4 ? It appears that I can not link the templates which I have been using in Bridge for some time to Lightroom 4.4. Is this done on purpose? Thanks in advance Doppy

  • ME23N authotizations - display PO

    Hello! I have the requirement to set up an authorization check for vendors as they only can display POs in ME23N those that belongs to that vendors (lifnr). I mean, If I am a vendor "X" and I go to ME23N transaction, I'll allowed to display just my P

  • Xy graph 1 spot in each axis

    Hi all: I'm plotting voltage and current in a XY graph. The fact is that instead of plotting just a spot (voltage/current coordinates), it plots 1 spot in the x axis(making 0 the Y axis), and in the next while bucle iteration it plots in the Y axis (

  • E7 - Can you txt using the touch screen?

    Hi All, I just got my E7 yesterday. And have a question. When I goto write a new txt msg with the qwerty closed it brings up and on screen keyboard. But it doesn't work??? How can I make it work?

  • Maximum number of nodes in Multimaster Replication

    Has anyone setup a multimaster replication environment on 8.1.7 with more than 11 nodes? What could be the maximum number of nodes for reliable operation?