Invalid Session ID - cookie encode/decode

Question

Hello,
I'm looking for the correct combination of cookie encode/decode parameters for my own setup.
Machine am : AM Server 7.0 on WS6.1
Machine amc : my own webapps using AM client SDK & protected by a Policy agent. 2.2 Everything within a WS6.1 container.
After being redirected to AM, I obtain my iPlanetDirectoryPro cookie and my webapp can obtain a SSOToken using the SSOToken token = manager.createSSOToken(String) if obtain the String via Cookie accessor's method.
No luck with SSOToken token = manager.createSSOToken(HttpServletRequest) which always gives a Invalid Session Id message. I know that this is an encoding problem but I tried many combinations & heard that these settings are not always well documented. I have at the moment :
am server AMConfig.properties :
com.iplanet.am.cookie.encode=false
am client sdk AMConfig.properties :
com.iplanet.am.cookie.encode=false
policy agent AMAgent.properties :
com.sun.identity.agents.config.sso.decode = false
com.iplanet.am.cookie.encode = false
Has somebody worked that out ?
Thanks !
nieuwenj

Answer 1

Hi, am using this code:
AMUtil.java
import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.io.IOException;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.ChoiceCallback;
import javax.security.auth.callback.NameCallback;
import javax.security.auth.callback.PasswordCallback;
import javax.security.auth.callback.TextInputCallback;
import javax.security.auth.callback.TextOutputCallback;
import javax.security.auth.callback.UnsupportedCallbackException;
import com.sun.identity.authentication.AuthContext;
import com.sun.identity.authentication.spi.AuthLoginException;
import com.iplanet.am.util.Debug;
* @author hjimenez
public class AMUtil {
    private String loginIndexName;
    private String orgName;
    private String user;
    private String password;
     * Creates a new instance of AMUtil
    public AMUtil(String loginIndexName, String orgName) {
        this.loginIndexName = loginIndexName;
        this.orgName = orgName;
    protected AuthContext getAuthContext()
    throws AuthLoginException, com.iplanet.sso.SSOException, Exception {
        AuthContext lc = new AuthContext(orgName);
        AuthContext.IndexType indexType = AuthContext.IndexType.MODULE_INSTANCE;
        lc.login(indexType, loginIndexName);
        debugMessage(loginIndexName + ": Se obtuvo login context");
        return lc;
    private void addLoginCallbackMessage(Callback[] callbacks)
    throws UnsupportedCallbackException {
        int i = 0;
        try {
            for (i = 0; i < callbacks.length; i++) {
                if (callbacks[i] instanceof TextOutputCallback) {
                    handleTextOutputCallback((TextOutputCallback)callbacks);
} else if (callbacks[i] instanceof NameCallback) {
handleNameCallback((NameCallback)callbacks[i]);
} else if (callbacks[i] instanceof PasswordCallback) {
handlePasswordCallback((PasswordCallback)callbacks[i]);
} else if (callbacks[i] instanceof TextInputCallback) {
handleTextInputCallback((TextInputCallback)callbacks[i]);
} else if (callbacks[i] instanceof ChoiceCallback) {
handleChoiceCallback((ChoiceCallback)callbacks[i]);
} catch (IOException e) {
e.printStackTrace();
throw new UnsupportedCallbackException(callbacks[i],e.getMessage());
private void handleTextOutputCallback(TextOutputCallback toc) {
debugMessage("Se ejecut� TextOutputCallback");
// Mostrar mensaje de acuerdo al tipo especificado
switch (toc.getMessageType()) {
case TextOutputCallback.INFORMATION:
debugMessage(toc.getMessage());
break;
case TextOutputCallback.ERROR:
debugMessage("ERROR: " + toc.getMessage());
break;
case TextOutputCallback.WARNING:
debugMessage("WARNING: " + toc.getMessage());
break;
default:
debugMessage("Tipo de mensaje no soportaado: " +
toc.getMessageType());
private void handleNameCallback(NameCallback nc)
throws IOException {
// asignar usuario
nc.setName(this.user);
private void handleTextInputCallback(TextInputCallback tic)
throws IOException {
// poner un prompt para obtener datos
System.out.print(tic.getPrompt());
System.out.flush();
tic.setText((new BufferedReader
(new InputStreamReader(System.in))).readLine());
private void handlePasswordCallback(PasswordCallback pc)
throws IOException {
// asignar password
String passwd = this.password;
pc.setPassword(passwd.toCharArray());
private void handleChoiceCallback(ChoiceCallback cc)
throws IOException {
// ignorar el valor default dado
System.out.print(cc.getPrompt());
String[] strChoices = cc.getChoices();
for (int j = 0; j < strChoices.length; j++) {
System.out.print("choice[" + j + "] : " + strChoices[j]);
System.out.flush();
cc.setSelectedIndex(Integer.parseInt((new BufferedReader
(new InputStreamReader(System.in))).readLine()));
public boolean login(AuthContext lc)
throws UnsupportedCallbackException {
boolean succeed = false;
Callback[] callbacks = null;
// obtener informaci�n del m�dulo solicitada
while (lc.hasMoreRequirements()) {
callbacks = lc.getRequirements();
if (callbacks != null) {
addLoginCallbackMessage(callbacks);
lc.submitRequirements(callbacks);
if (lc.getStatus() == AuthContext.Status.SUCCESS) {
System.out.println("Login exitoso.");
succeed = true;
} else if (lc.getStatus() == AuthContext.Status.FAILED) {
System.out.println("Login fallo.");
} else {
System.out.println("Estatus desconocido: " + lc.getStatus());
return succeed;
public void logout(AuthContext lc)
throws AuthLoginException {
lc.logout();
System.out.println("Log Out!!");
static void debugMessage(String msg) {
System.out.println(msg);
public String getUser() {
return user;
public void setUser(String user) {
this.user = user;
public String getPassword() {
return password;
public void setPassword(String password) {
this.password = password;
and call it from:
import com.iplanet.sso.SSOToken;
import com.sun.identity.authentication.AuthContext;
import com.sun.identity.authentication.spi.AuthLoginException;
import javax.security.auth.callback.UnsupportedCallbackException;
import com.iplanet.sso.SSOException;
import java.net.InetAddress;
* @author hjimenez
public class TestLogin {
    /** Creates a new instance of TestLogin */
    public TestLogin() throws SSOException {
     * @param args the command line arguments
    public static void main(String[] args) {
        try {
            // arg0 = LDAP arg1 = tecnet
            AMUtil login = new AMUtil(args[0], args[1]);
            // arg2=usuario arg3=pass
            login.setUser(args[2]);
            login.setPassword(args[3]);
            AuthContext lc = login.getAuthContext();
            if (login.login(lc)) {
                SSOToken token = lc.getSSOToken();
                System.out.println("Token asignado: "+token.getTokenID().toString());
                String host = token.getHostName();
                java.security.Principal principal = token.getPrincipal();
                String authType = token.getAuthType();
                int level = token.getAuthLevel();
                InetAddress ipAddress = token.getIPAddress();
                long maxTime = token.getMaxSessionTime();
                long idleTime = token.getIdleTime();
                long maxIdleTime = token.getMaxIdleTime();
                System.out.println("SSOToken host name: " + host);
                System.out.println("SSOToken Principal name: " +
                        principal.getName());
                System.out.println("Authentication type used: " + authType);
                System.out.println("IPAddress of the host: " +
                        ipAddress.getHostAddress());   
                login.logout(lc); 
        } catch (AuthLoginException e) {
            e.printStackTrace();
        } catch (UnsupportedCallbackException e) {
            e.printStackTrace();
        } catch (SSOException e) {
            e.printStackTrace();
        }  catch (Exception e) {
            e.printStackTrace();