JAAS/JAZN: LDAPLoginModule doesn't work with servlet RunAs() security mode

Question

Just thought I'd post this here too, in case any developers actually read this list or in case someone else has run into a similar issue or has any ideas...
I'm having a problem where whenever I use Oracle 10gAS's LDAPLoginModule at the same time as RunAs() mode OC4J crashes.
Application is UIX/Struts for the view layer and ADF BC for the model layer. It is being developed in JDeveloper 10g (10.1.2.0.0) and deployed on 10gAS (10.1.2.0.0)
I am using JAAS (JAZN) for authentication. I am using a custom JAAS LoginModule for the app: "oracle.security.jazn.login.module.LDAPLoginModule". Instructions for using the module are documented in the OC4J Security Guide, Chapter 9 "Configuring External LDAP
Providers":
http://download-east.oracle.com/docs/cd/B14099_07/web.1012/b14013/ldap3rdparty.h
tm#sthref500
This is working fine - I can successfully authenticate against my LDAP server.
In order to retrieve security credentials (i.e. the Subject) while in the Model later, I am running the servlet in doAs() mode, also known as "runas-mode". This is documented in Chapter 4:
http://download-east.oracle.com/docs/cd/B14099_07/web.1012/b14013/genconfig.htm#
sthref322
This works great - when I authenticate against the local XML file I can successfully run the application and retrieve the Subject and Principals.
The problem is that whenever I try to use both of these at the same time the application will not run. I have attached a trace with JAAS/JAZN debug messages enabled.
It appears to be failing in the process of creating the BC Application Module. Apparently when it creates a new thread to monitor the application module pool, in the process of establishing JAAS permissions for the new thread it attempts to retrieve the REALM from the oracle.security.jazn.realm.LDAPPrincipal object -- which is an unsupported function when the Principal was generated by an LDAPLoginModule. For some reason this error crashes the entire process.
You can see a trace of my program here:
http://www.asugroup.com/jazn-errorlog.txt
This should be simple to reproduce by simply creating an ADF BC application, modifying orion-web.xml so that the servlet is in runas-mode, and modifying $ORACLE_HOME/j2ee/home/config/jazn-data.xml to use the LDAPLoginModule.
All I can figure is that it must be a "bug" (or unsupported functionality) in 10gAS. WHY in the world is 10g failing on the getRealm() function of a Principal that it setup itself? Any suggestions or help would be appreciated. The only solution I can think of at this point is to throw Oracle's LoginModule implementation right out the window and write my own... although I don't even know if that will work yet.
Jeremy

Answer 1

ok, so i know that this isn't metalink... but i'm pretty sure this is either a "bug" or "unsupported feature" -- although now that i've looked a bit deeper i'm guessing it has something to do with the "role.mapping.dynamic" flag too. (Haven't tested it yet but I think it might work fine if I put the roles in the local XML file.)
Anyway, if anyone's interested, here's detailed steps so you - YES YOU! - can reproduce the problem yourself if the desire grips you. :)
I put this together for the TAR but figured there's some useful information in here (e.g. the debugging stuff) so it might be helpful for someone in the future to post it here too.
1. Open or create any ADF BC project in JDeveloper. It can be ANY project as long as it uses ADF BC for the MODEL layer.
2. Add orion-web.xml to the VIEW project if it's not already there.
2a) Right click on orion-web.xml and select Properties
2b) In the "JAZN" section, select the checkbox "Run as Mode"
3. Edit web.xml to require authorization to run the app.
3a) Right click on web.xml and select Properties
3b) Under the "security roles" section add the name of an group you're a member of on the LDAP server. Only include the relative name of the group - not the full LDAP distinguished name. Also, convert the name to lowercase.
3c) Under "security constraints" add a new constraint.
3d) In the constraint, make a new resource collection called "everything" and add the URL pattern "/".
3e) In the constraint, go to the authorization tab and select your LDAP group name.
3f) Go to the "Login Configuration" section of web.xml and choose HTTP Basic Authentication. Leave the realm blank.
4. Add orion-application.xml to the project if it's not already there. Configure the "JAZN" tag as follows:
<jazn provider="XML">
<property name="role.mapping.dynamic" value="true" />
</jazn>
3. Deploy the application to Oracle 10g Application Server.
4. On the application server, edit the file $ORACLE_HOME/j2ee/home/config/jazn-data.xml
4a) In the section jazn-data/jazn-loginconfig add a new "application" section for your application. See below for example.
4b) Make sure the "name" of your application matches the deployment name in your EAR file for the project you deployed.
5. I recommend enabling JAZN debugging. See below for instructions on that.
6. Restart OC4J if you already haven't - to make sure it rereads the config, then try to run your application.
SAMPLE JAZN-DATA.XML (CUSTOMIZE FOR YOUR LDAP SERVER)
<jazn-data>
<jazn-loginconfig>
<application>
<name>your_j2ee_deployed_application_name</name>
<login-modules>
<login-module>
<class>oracle.security.jazn.login.module.LDAPLoginModule</class>
<control-flag>required</control-flag>
<options>
<option>
<name>oracle.security.jaas.ldap.provider.url</name>
<value>ldap://10.1.1.7:389</value>
</option>
<option>
<name>oracle.security.jaas.ldap.provider.user</name>
<value>cn=stoneware,ou=stoneware,ou=okemos,ou=mi,ou=et,o=ou1</value>
</option>
<option>
<name>oracle.security.jaas.ldap.provider.credential</name>
<value>!yourpassword</value>
</option>
<option>
<name>oracle.security.jaas.ldap.provider.type</name>
<value>other</value>
</option>
<option>
<name>oracle.security.jaas.ldap.user.searchbase</name>
<value>o=ou1</value>
</option>
<option>
<name>oracle.security.jaas.ldap.user.searchscope</name>
<value>subtree</value>
</option>
<option>
<name>oracle.security.jaas.ldap.user.name.attribute</name>
<value>cn</value>
</option>
<option>
<name>oracle.security.jaas.ldap.user.object.class</name>
<value>inetOrgPerson</value>
</option>
<option>
<name>oracle.security.jaas.ldap.role.searchbase</name>
<value>o=ou1</value>
</option>
<option>
<name>oracle.security.jaas.ldap.role.searchscope</name>
<value>subtree</value>
</option>
<option>
<name>oracle.security.jaas.ldap.role.name.attribute</name>
<value>cn</value>
</option>
<option>
<name>oracle.security.jaas.ldap.role.object.class</name>
<value>groupOfNames</value>
</option>
<option>
<name>oracle.security.jaas.ldap.membership.searchscope</name>
<value>direct</value>
</option>
<option>
<name>oracle.security.jaas.ldap.member.attribute</name>
<value>member</value>
</option>
</options>
</login-module>
</login-modules>
</application>
</jazn-loginconfig>
</jazn-data>
for Sun Java System Application Server and Microsoft Active Directory examples see:
http://download-east.oracle.com/docs/cd/B14099_07/web.1012/b14013/ldap3rdparty.htm#sthref500
ENABLING JAZN DEBUGGING MESSAGES ON ORACLE 10G APPLICATION SERVER
1. Login to Enterprise Manager 10g Application Server Control
2. If you are part of a farm you will get a list of instances. Select the instance your app is deployed on.
3. In the "System Components" section of the home page, click on your OC4J instance (default name is "home").
4. In the OC4J home, click on the "Administration" tab.
5. Select "Server Properties" from the Instance Properties section.
6. In the Command Line Options section, there is an option called "Java Options".
7. At the end of the "Java Options", append the text "-Djazn.debug.log.enable=true"
8. When prompted, restart the OC4J instance.
Debug information is captured by OPMN and stored in a log file. The log file can be found in the directory $ORACLE_HOME/opmn/logs
The default name (if your instance name is "home") is "OC4J~home~default_island~1"