Help, Authentication failed

Question

I am having a very difficult time making a simple login program work
I am using Java SDK 1.4.2_02 on a Windows 2000 host, the DS is on the same host
My Directory Server is Sun One Directory Server 5.2
I am using the JAAS package, with a JndiLoginModule
When I use a bogus uid I get a �user not found� message so I know I am contacting the DS correctly
The Access log looks like this
[09/Dec/2003:13:09:52 -0600] conn=1606 op=0 msgId=1 - BIND dn="" method=128 version=3
[09/Dec/2003:13:09:52 -0600] conn=1606 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn=""
[09/Dec/2003:13:09:52 -0600] conn=1606 op=1 msgId=2 - SRCH base="ou=people,dc=auto-trol,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL
[09/Dec/2003:13:09:52 -0600] conn=1606 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0
[09/Dec/2003:13:09:52 -0600] conn=1606 op=2 msgId=3 - SRCH base="ou=people,dc=auto-trol,dc=com" scope=1 filter="(uid=jpsb)" attrs=ALL
[09/Dec/2003:13:09:52 -0600] conn=1606 op=2 msgId=3 - RESULT err=0 tag=101 nentries=1 etime=0
[09/Dec/2003:13:09:52 -0600] conn=1606 op=3 msgId=4 - ABANDON targetop=NOTFOUND msgid=3
My config file looks like this
Sample
com.sun.security.auth.module.JndiLoginModule required debug=true
     user.provider.url="ldap://localhost:4661/ou=People,dc=auto-trol,dc=com"
     group.provider.url="ldap//localhost:4661/ou=Group,dc=auto-trol,dc=com";
The error I get is this:
[JndiLoginModule] user provider: ldap://localhost:4661/ou=People,dc=auto-trol,dc=com
[JndiLoginModule] group provider: ldap//localhost:4661/ou=Group,dc=auto-trol,dc=com
ldap username: jpsb
ldap password: jim
[JndiLoginModule] attemptAuthentication() failed
[JndiLoginModule] regular authentication failed
[JndiLoginModule]: aborted authentication failed
Authentication failed:
Login incorrect
A stack trace looks like this
javax.security.auth.login.FailedLoginException: Login incorrect
at com.sun.security.auth.module.JndiLoginModule.attemptAuthentication(JndiLoginModule.java:552)
at com.sun.security.auth.module.JndiLoginModule.login(JndiLoginModule.java:310)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:324)
at javax.security.auth.login.LoginContext.invoke(LoginContext.java:675)
at javax.security.auth.login.LoginContext.access$000(LoginContext.java:129)
at javax.security.auth.login.LoginContext$4.run(LoginContext.java:610)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.login.LoginContext.invokeModule(LoginContext.java:607)
at javax.security.auth.login.LoginContext.login(LoginContext.java:534)
at LoginJaas.main(LoginJaas.java:93)
It appears to me that there must be some kind password problem, I can login from the 5.2 console or switch user ids from the console so I know the user and Directory Server are OK.
Can anyone help? I�ve been pounding on this for a few days and it is getting frustrating.
Thanks in advance
Jim

Answer 1

Here it is along with some bat files to make and run. I can't understand why it does not work. It is mostly a slightly modified example from Sun. I'm using Sun code, a Sun Directory Server and a Sun's JndiLoginModule so why the damn thing does not work is a mystery. I have looked EVERYWHERE for a sample JAAS/LDAP Authenicate code and can't find a thing. Makes me think there isn't any and JAAS is not the way to go. I and going to try with a different DS maybe open LDP or active Directory and if that doesn't work I'll forget JAAS and use JNDI instead.
Any help would be greatly appreciated.
thanks in advance
jim
Start LoginJass.java
* @(#)LoginJaas.java
* Copyright 2001-2002 Sun Microsystems, Inc. All Rights Reserved.
* Redistribution and use in source and binary forms, with or
* without modification, are permitted provided that the following
* conditions are met:
* -Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* -Redistribution in binary form must reproduct the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
* Neither the name of Sun Microsystems, Inc. or the names of
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
* This software is provided "AS IS," without a warranty of any
* kind. ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND
* WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE HEREBY
* EXCLUDED. SUN AND ITS LICENSORS SHALL NOT BE LIABLE FOR ANY
* DAMAGES OR LIABILITIES SUFFERED BY LICENSEE AS A RESULT OF OR
* RELATING TO USE, MODIFICATION OR DISTRIBUTION OF THE SOFTWARE OR
* ITS DERIVATIVES. IN NO EVENT WILL SUN OR ITS LICENSORS BE LIABLE
* FOR ANY LOST REVENUE, PROFIT OR DATA, OR FOR DIRECT, INDIRECT,
* SPECIAL, CONSEQUENTIAL, INCIDENTAL OR PUNITIVE DAMAGES, HOWEVER
* CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, ARISING OUT OF
* THE USE OF OR INABILITY TO USE SOFTWARE, EVEN IF SUN HAS BEEN
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
* You acknowledge that Software is not designed, licensed or
* intended for use in the design, construction, operation or
* maintenance of any nuclear facility.
import javax.security.auth.Subject;
import javax.security.auth.callback.*;
import javax.security.auth.login.*;
import com.sun.security.auth.callback.TextCallbackHandler;
import java.security.PrivilegedAction;
* This LoginJaas application attempts to authenticate a user
* and reports whether or not the authentication was successful.
* If successful, it then sets up subsequent execution of
* code in the run method of the SampleAction class such that
* access control checks for security-sensitive operations will be
* based on the user running the code.
public class LoginJaas
     private static Subject mySubject;
     public static void main(String[] args)
          // Obtain a LoginContext, needed for authentication. Tell it
          // to use the LoginModule implementation specified by the
          // entry named "JaasSample" in the JAAS login configuration
          // file and to also use the specified CallbackHandler.
          LoginContext lc = null;
          try
               lc = new LoginContext("Sample", new TextCallbackHandler());
          catch (LoginException le)
               System.err.println("le:Cannot create LoginContext. "
               + le.getMessage());
               le.printStackTrace();
               System.exit(-1);
          catch (SecurityException se)
               System.err.println("se:Cannot create LoginContext. "
               + se.getMessage());
               se.printStackTrace();
               System.exit(-1);
          try
               // attempt authentication
               lc.login();
          catch (LoginException le)
               System.err.println("Authentication failed:");
               System.err.println(" " + le.getMessage());
               le.printStackTrace();
               System.exit(-1);
          System.out.println("Authentication succeeded!");
          // now try to execute the SampleAction as the authenticated Subject
          Subject mySubject = lc.getSubject();
          PrivilegedAction action = new SampleAction();
          Subject.doAsPrivileged(mySubject, action, null);
End LoginJass.java
Start MyCallbackHandler.java
import java.io.*;
import javax.security.auth.*;
import javax.security.auth.callback.*;
public class MyCallbackHandler implements CallbackHandler
     public void handle(Callback callbacks[]) throws IOException, UnsupportedCallbackException
          for(int i=0;i<callbacks.length;i++)
               if(callbacks[i] instanceof NameCallback)
               NameCallback nc = (NameCallback) callbacks[0];
               System.err.print(nc.getPrompt());
               System.err.flush();
               String name = (new BufferedReader(new InputStreamReader(System.in))).readLine();
               nc.setName(name);
               else
               throw(new UnsupportedCallbackException(callbacks,
                         "Callback handler not support"));
End MyCallbackHandler.java
Start Sample.java
* @(#)Sample.java     1.19 00/01/11
* Copyright 2000-01 Sun Microsystems, Inc. All rights reserved.
* Copyright 2000-01 Sun Microsystems, Inc. Tous droits reserves.
import java.io.*;
import java.util.*;
import java.security.Principal;
import javax.security.auth.*;
import javax.security.auth.callback.*;
import javax.security.auth.login.*;
import javax.security.auth.spi.*;
import com.sun.security.auth.*;
* <p> This Sample application attempts to authenticate a user
* and executes a SampleAction as that user.
* <p> If the user successfully authenticates itself,
* the username and number of Credentials is displayed.
* @version 1.19, 01/11/00
public class Sample {
* Attempt to authenticate the user.
* <p>
* @param args input arguments for this application. These are ignored.
public static void main(String[] args) {
     // use the configured LoginModules for the "Sample" entry
     LoginContext lc = null;
     try {
     lc = new LoginContext("Sample", new MyCallbackHandler());
     } catch (LoginException le) {
     le.printStackTrace();
     System.exit(-1);
     // the user has 3 attempts to authenticate successfully
     int i;
     for (i = 0; i < 3; i++) {
     try {
          // attempt authentication
          lc.login();
          // if we return with no exception, authentication succeeded
          break;
     } catch (AccountExpiredException aee) {
          System.out.println("Your account has expired. " +
                    "Please notify your administrator.");
          System.exit(-1);
     } catch (CredentialExpiredException cee) {
          System.out.println("Your credentials have expired.");
          System.exit(-1);
     } catch (FailedLoginException fle) {
          System.out.println("Authentication Failed");
          try {
          Thread.currentThread().sleep(3000);
          } catch (Exception e) {
          // ignore
     } catch (Exception e) {
          System.out.println("Unexpected Exception - unable to continue");
          e.printStackTrace();
          System.exit(-1);
     // did they fail three times?
     if (i == 3) {
     System.out.println("Sorry");
     System.exit(-1);
     // let's see what Principals we have
     Iterator principalIterator = lc.getSubject().getPrincipals().iterator();
     System.out.println("Authenticated user has the following Principals:");
     while (principalIterator.hasNext()) {
     Principal p = (Principal)principalIterator.next();
     System.out.println("\t" + p.toString());
     System.out.println("User has " +
               lc.getSubject().getPublicCredentials().size() +
               " Public Credential(s)");
     // now try to execute the SampleAction as the authenticated Subject
     Subject.doAs(lc.getSubject(), new SampleAction());
     System.exit(0);
End Sample.java
Start SampleAction.java
* @(#)SampleAction.java     1.4 00/01/11
* Copyright 2000-01 Sun Microsystems, Inc. All rights reserved.
* Copyright 2000-01 Sun Microsystems, Inc. Tous droits reserves.
import java.io.File;
import java.security.PrivilegedAction;
* <p> This is a Sample PrivilegedAction implementation, designed to be
* used with the Sample application.
* @version 1.4, 01/11/00
public class SampleAction implements PrivilegedAction {
* <p> This Sample PrivilegedAction performs the following operations:
* <ul>
* <li> Access the System property, <i>java.home</i>
* <li> Access the System property, <i>user.home</i>
* <li> Access the file, <i>foo.txt</i>
* </ul>
* @return <code>null</code> in all cases.
* @exception SecurityException if the caller does not have permission
*          to perform the operations listed above.
public Object run() {
     System.out.println("\nYour java.home property: "
               +System.getProperty("java.home"));
     System.out.println("\nYour user.home property: "
               +System.getProperty("user.home"));
     File f = new File("foo.txt");
     System.out.print("\nfoo.txt does ");
     if (!f.exists())
     System.out.print("not ");
     System.out.println("exist in the current working directory.");
     return null;
End SampleAction.java
Start princible/SamplePrincipal.java
package principal;
* @(#)SamplePrincipal.java     1.4 00/01/11
* Copyright 2000-01 Sun Microsystems, Inc. All rights reserved.
* Copyright 2000-01 Sun Microsystems, Inc. Tous droits reserves.
import java.security.Principal;
* <p> This class implements the <code>Principal</code> interface
* and represents a Sample user.
* <p> Principals such as this <code>SamplePrincipal</code>
* may be associated with a particular <code>Subject</code>
* to augment that <code>Subject</code> with an additional
* identity. Refer to the <code>Subject</code> class for more information
* on how to achieve this. Authorization decisions can then be based upon
* the Principals associated with a <code>Subject</code>.
* @version 1.4, 01/11/00
* @see java.security.Principal
* @see javax.security.auth.Subject
public class SamplePrincipal implements Principal, java.io.Serializable {
* @serial
private String name;
* Create a SamplePrincipal with a Sample username.
* <p>
* @param name the Sample username for this user.
* @exception NullPointerException if the <code>name</code>
*               is <code>null</code>.
public SamplePrincipal(String name) {
     if (name == null)
     throw new NullPointerException("illegal null input");
     this.name = name;
* Return the Sample username for this <code>SamplePrincipal</code>.
* <p>
* @return the Sample username for this <code>SamplePrincipal</code>
public String getName() {
     return name;
* Return a string representation of this <code>SamplePrincipal</code>.
* <p>
* @return a string representation of this <code>SamplePrincipal</code>.
public String toString() {
     return("SamplePrincipal: " + name);
* Compares the specified Object with this <code>SamplePrincipal</code>
* for equality. Returns true if the given object is also a
* <code>SamplePrincipal</code> and the two SamplePrincipals
* have the same username.
* <p>
* @param o Object to be compared for equality with this
*          <code>SamplePrincipal</code>.
* @return true if the specified Object is equal equal to this
*          <code>SamplePrincipal</code>.
public boolean equals(Object o) {
     if (o == null)
     return false;
if (this == o)
return true;
if (!(o instanceof SamplePrincipal))
return false;
SamplePrincipal that = (SamplePrincipal)o;
     if (this.getName().equals(that.getName()))
     return true;
     return false;
* Return a hash code for this <code>SamplePrincipal</code>.
* <p>
* @return a hash code for this <code>SamplePrincipal</code>.
public int hashCode() {
     return name.hashCode();
End princible/SamplePrincipal.java
Start ample_jaas.config
/** Login Configuration for the JAAS Sample Application **/
Sample
     //SampleLoginModule required debug=true;
     com.sun.security.auth.module.JndiLoginModule required debug=true
     user.provider.url="ldap://localhost:4661/ou=People,dc=testing,dc=com"
     group.provider.url="ldap//localhost:4661/ou=Group,dc=testing,dc=com";
End Sample_jaas.config
Start sample.policy
/** Java 2 Access Control Policy for the JAAS Sample Application **/
/** Code-Based Access Control Policy for LoginJaas **/
grant codebase "file:./sample.jar
permission javax.security.auth.AuthPermission
"createLoginContext.JaasSample";
permission javax.security.auth.AuthPermission "doAsPrivileged";
permission java.security.AllPermission; //darf alles
/** User-Based Access Control Policy for the LoginAction class
** instantiated by LoginJaas
grant     codebase "file:./SampleAction.jar", Principal principal.SamplePrincipal "jimshi"
permission java.util.PropertyPermission "java.home", "read";
permission java.util.PropertyPermission "user.home", "read";
permission java.io.FilePermission "foo.txt", "read";
End sample.policy
Start makelogin.bat
REM
javac LoginJaas.java principal/SamplePrincipal.java
jar -cvf LoginJaas.jar LoginJaas.class principal/SamplePrincipal.java
REM
javac SampleAction.java
jar -cvf SampleAction.jar SampleAction.class
REM
REM javac SampleLoginModule.java
REM jar -cvf sample_module.jar SampleLoginModule.class
REM
javac Sample.java
REM jar -cvf sample.jar MyCallbackHandler.class Sample.class
javac com/sun/security/auth/module/*.java
End makelogin.bat
Start run.bat
REM java -classpath ./;SampleAction.jar;LoginJaas.jar -Djava.security.manager -Djava.security.policy=sample.policy -Djava.security.auth.login.config=sample_jaas.conf LoginJaas
java -classpath ./;SampleAction.jar;LoginJaas.jar -Djava.security.auth.login.config==D:\STUFF\LDAP\loginJim\sample_jaas.config LoginJaas
End run.bat