JAAS NTLoginModule for basic http authentication

Hi all,
Can someone point me to the right direction on this subject? I'd like to use JAAS' NTLoginModule to get a user's credentials, then use those credentials to authenticate the user into something that requires a basic http authentication... specifically, a domino web service. (I don't want the user to have to type in his/her password).
First, is this even doable? and Second, what would I need to do to get this working?
Thanks in advance.

I am using IIS 6 with Windows Integrated Authentication which passes all HTTP requests to Tomcat 5.5 for processing via the ISAPI plug-in jk1.2 It does nothing else. Don't ask the obvious, I can't tell you. It just is.
I have a new requirement for a new web application on our intranet. I would like to be able to identify my users without them typing anything in. How can I capture any part of the Window's user credential's from within my Java web application on Tomcat?
I'm looking at HttpServletRequest.getRemoteUser() and HttpServletRequest.getUserPrincipals() and I'm thinking I can (minus establishing my own Tomcat realms, etc...).
Any thoughts? Even if you don't know how, just tell me if you know this can be/is being done somewhere.

Similar Messages

Internationalizing Basic HTTP authentication browser dialog for UserID

Is it possible to have multibyte user ID for Basic HTTP authentication? Based on RFC2617 user ID has to be *Text, which basically is ASCII. But I thought maybe someone has a workaround for this limitation. Our entire web app is internationalized, we use UTF-8 as encoding for JPS pages and request processing, and that all works fine, but there is one area where we use Basic HTTP authentication, and so far I was not able to find a way to internatianalize that. Once the resource is reqested, we process request in the servlet and if the user is not authenticated we send authentication challenge response to the browser. Response encoding is set to UTF-8. After user enters the credentials, I process those in the same servlet , again using UTF-8. Of course when I tried to input the japanese ( multibyte)userID, the authentication is failing. I think the browser is corrupting DBCS data once it Base64 encodes it... Does anyone have ideas whether it is possible to internationalize this at all?

You'll probably need your own ServletFilter to process the authentication header, since servers will mostly decode headers in the locale encoding, regardless of any charset in the Content-type header of the request. Getting browsers to use UTF-8 encoding before base64 might be a bit tricky though.
It is probably better to use form based login. The procedure for getting UTF-8 encoded form parameters is a well understood FAQ for this forum.

Basic http authentication not working when consuming Web Service in BPEL.

Hi,
I am consuming an AXIS Web Service from BPEL 10.1.3. The Web Service uses basic http
authentication so we need a way to get username and password into the http
header. In the Oracle BPEL Process Manager Administrator's Guide 10g
(10.1.3.1.0) section 1.3.4.1 HTTP Basic Authentication (10.1.2.0.2) is stated
that this can be done using the properties httpUsername and httpPassword. I
have set the 2 for the partner link in bpel.xml but username and password does
not get in to the http header. Has anybody got an idea?
Regards Pete

I'm having the same sorts of problems with 10.1.3.1.0. I've got a deployed BPEL suitcase that's trying to hit a BASIC AUTH-secured web service running on a WebLogic 8.1 server. I've set up my partner link according to the documentation, and the BPEL console Descriptor tab even shows the parameters correctly:
partnerLinkBindings
client
 wsdlLocation awardService.wsdl
spsAwardSubmitPartnerLink
 basicHeaders credentials
 basicUsername ko1
 basicPassword xxxxx
 wsdlLocation IAwardDraftServiceRef1.wsdl
However, when I funnel the resultant call to the endpoint specified in IAwardDraftServiceRef1.wsdl, none of the fields I would expect show up in the HTTP header:
POST /pd2WebServices/service/IAwardDraftService HTTP/1.1
Host: vm-orcl-app-srv:4444
Connection: Keep-Alive, TE
TE: trailers, deflate, gzip, compress
User-Agent: Oracle HTTPClient Version 10h
SOAPAction: ""
Accept-Encoding: gzip, x-gzip, compress, x-compress
Content-type: text/xml; charset=UTF-8
Content-length: 3800
<?xml version="1.0" encoding="UTF-8"?>
<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><env:Body><IAwardDraftSubmitNew xmlns="http://www.caci.com/pd2/pub">
<IAwardDraft>
<accessController/>
<agreementEndDate/>
Is there some other configuration piece I'm missing?? I've tried the other variation using httpBasicHeaders, with the same results. I even noted that the "Oracle® BPEL Process Manager Administrator's Guide" says that "Starting with Oracle BPEL Process Manager release 10.1.3, all partner link properties are automatically propagated into the HTTP header." I've tried putting "extra" parms in the partner link bindings, but they don't show up either.
What am I missing??
Thanks,
Mike

Embedding basic http authentication credentials in JNLP file

I want to embed basic http authentication credentials in the JNLP file.
Basically, I want the jars to be behind basic http authentication in order to distribute the application only to authorized users (I understand this is not strong security, but it's fine for my purposes) who are all on Windows, and once the java app is initially installed, I never want to have to enter the http login credentials again.
So I set up the http authentication and in the jnlp file I have:
<jnlp
spec="1.5*"
codebase="http://username:[email protected]"
href="program.jnlp">
This doesn't seem to phase the JWS authenticator. So on the first launch from the desktop shortcut I put the credentials in manually and select "save this password in my password list". It seems like I'm in the clear as the next time I launch the application from a desktop shortcut I am not asked for any credentials, but every time the Windows machine is restarted, I get the JWS authenticator again...the password is no longer saved.
Is there a way to embed the username/password in the JNLP file to get past the JWS authenticator without having to retype the username and password every time the machine is restarted? Or to permanently save the password in the JWS authenticator password list? Or any other way to set it up where once the application is initially installed, the http authentication credentials never have to be manually entered again?
Thanks!

Hi everybody,
I manage to do almost all (I suppose), but I need last help.
Through SM59 I created the HTTP Destination needed; then, I implemented the code given by SAP here:
http://help.sap.com/saphelp_47x200/helpdata/en/2d/64d053e74911d6b2e400508b6b8a93/content.htm
I ran the program, and it gives me the error: "Binder not found for soapAction = null.
I suppose that I should give the link to the soapAction, but I don't know where in the code.
Have you any idea?
Thanks and Regards,
Francesco

Basic HTTP Authentication

Hi everyone,
I'm trying to make a portal/gateway environment where a user can be automatically logged in other applications using Basic HTTP Authentication.
To do this I have enabled the Basic HTTP Authentication in the psconsole (under Secure Remote Access > default > Core).
I have also added a couple of LDAP attributes in the Portal LDAP: sunPortalGatewayWWWAuthorization.
Are these the only two steps needed? Or am I forgetting something?
Could someone tell me how the values in the sunPortalGatewayWWWAuthorization can be formed? I am currently using someone else's code, which used to work on a Portal Server 6 environment. I'm not sure if I understand well how those Basic Authentication values are formed.
Thanks a lot!
Sten

Thank you Yvan, for your reply.
I have looked at the Access Manager in the old environment, and did not see any SSO functionality being enabled.
The old environment does not have a psconsole, so I was not able to check the settings over there.
What bothers me, is that I do not know what kind of values should be stored in the sunPortalGatewayWWWAuthorization attribute. A basic http authentication string would look like this: Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
(This would be a Base64 encoding of Aladdin:open sesame).
But in the Portal LDAP it seems that everything is encoded in Base64. As far as I understand the code is doing the following:
- Make-up string: "+hostname+|Authorization: Basic +username+:+password+"
- additionally, it looks like the whole string is being encrypted too, using a PBEWithMD5andDES algorithm
Is this a requirement for the Gateway? Or is this for some kind of security reason? And is this correct?
Thanks,
Sten

Performing Basic HTTP Authentication on the iPhone

Hi,
I need to perform a HTTP Request with Basic Authentication on the iPhone. To perform the request I use the NSURLConnection and NSMutableURLRequest. The request basically works but I can't get the authentication working. Is there a "convenient" way to do HTTP authentication or do I have to do it by hand?
Best regards,
Michael

Ok thanks - that explains it:
From the Apple article: "
Note: Touch ID cannot be used for purchases if Require Password in Settings > General > Restrictions is set to Immediately."
Not sure why - but clearly intentional.

Using Weblogic LDAP JAAS credentials for 3rd party authentication

Hello to all!
I'm posting this question because I'm developing a software layer that will connect a weblogic based web application, with LDAP authentication, to a 3rd party application, also with LDAP authentication, and I'm having difficulties in getting a javax.security.auth.Subject object from the weblogic server.
I already have a way of doing it, but it requires that a username and a password exist in some sort of storage, in order to work (either hardcoded (which is to be avoided as much as possible) or stored in a file (which is to be avoided if possible, but if nothing better exists...)).
I'm using a Weblogic 11g server, with LDAP authentication (LDAP provider placed in last at the provider list, with flag SUFFICIENT) and I'm developing the software layer using Oracle's jDeveloper 11g Release 1.
Now, this 3rd party application requires a javax.security.auth.Subject object in order to perform authentication.
How do I get this from the weblogic server ?
Of the following approaches, can you tell me which are the most correct ones ?
<ul>
a)
 LoginContext lc = null;
 try {
 lc = new LoginContext("<JAAS instance name>");
 lc.login();
 } catch (LoginException e) {
 e.printStackTrace();
 javax.security.auth.Subject subject = lc.getSubject();

</ul>
<ul>
b)
 LoginContext lc = new LoginContext("<JAAS instance name>"
 new MyClass.CallbackHandler(userid, password));
 lc.login();
 javax.security.auth.Subject subject = lc.getSubject();
 javax.security.auth.Subject.doAs(subject, myClassObject);

</ul>
<ul>
c)
 javax.security.auth.Subject subjectA = weblogic.security.Security.getCurrentSubject();
 subjectA.doAs(subjectA, myClassObject);

</ul>
Thanks in advance,
Nuno B.

Here is a document on Monitoring and Reporting Tool Integration into Network Admission Control.
http://www.cisco.com/en/US/netsol/ns466/networking_solutions_white_paper0900aecd801dee49.shtml

Removing Basic HTTP Authentication required by Adapter Engine

Hi guys,
can you please help me with this issue? I'm sending a SOAP requests to PI but I need to remove required authentication by WAS as the sending system is not able to provide username and password.
Thank you,
Peter

Peter,
AFAIK if you remove authentication, it will remove it for all the SOAP scenarios and cannot be achieved for a single scenario.
Check the reply from Bhavesh in this thread:
Re: SOAP User ID/Password - Authoraization
If you want to refer more similar threads check this:
https://forums.sdn.sap.com/search.jspa?threadID=&q=%22remove+authentication%22&objID=f44&dateRange=all&numResults=15&rankBy=10001
Regards,
Neetesh

Webservice with HTTP authentication

Hi,
how do i supply the userid an password for a http authenticated webservice. I already choose the option for http authentication on the security tab on the logical port.
Alos tried to find it in the Visual Admin to the server but i am stuck.
Greetings Danny.

There are two ways to do this
Option 1: Hard code the Username/Password
For this, use the method _setUser and _setPassword.
These are methods for your model class Request_<WebService>_PortType.... (the model class for the webservice). I invoked these methods in the wdDoInit method of the component controller class.
For example, i imported the WSDL for the RFC SXMB_GET_MESSAGE_LIST and used it like this:
Request_SXMB_GET_MESSAGE_LISTPortType_SXMB_GET_MESSAGE_LIST oRequest =
new Request_SXMB_GET_MESSAGE_LISTPortType_SXMB_GET_MESSAGE_LIST();
oRequest._setUser("bcuser");
oRequest._setPassword("password");
Option 2: Use HTTP Destinations
Open Visual Administrator and goto node Services, Destination Service. Create a HTTP destination with the URL of the webservice, maybe choose basic authentication and give the username / password. Now, you could use this HTTP destination in the component controller class. Even though there is a method _setHTTPDestinationName, this did not work for me. I had to write the following code to retrieve the URL, username, password from the HTTP destination
import javax.naming.Context;
import javax.naming.InitialContext;
import javax.naming.NamingException;
import java.net.HttpURLConnection;
 InitialContext ctx ;
 Object obj;
 DestinationService dstService;
 Destination destination;
 HTTPDestination httpDestination ;
 HttpURLConnection httpurlconnection = null;
 Properties destprop = null;
 String url = "";
 String username = "";
 String password = "";
 ctx = new InitialContext();
 obj = ctx.lookup(DestinationService.JNDI_KEY);
 dstService = (DestinationService) obj;
 destination = dstService.getDestination("HTTP","NC_IS");
 destprop = destination.getDestinationProperties();
 httpDestination = (HTTPDestination) destination;
 url = httpDestination.getUrl();
 username = destprop.getProperty("USERNAME");
 password = destprop.getProperty("PASSWORD");
(I know the java code sucks and the purists will hang me; nevertheless it works)
Besides the code, you need to do the following as well:
(1) In the Package explorer, select your project, right click, cick on "Set Additional Libraries.."
(2) Select security.class and tc/sec/destinations/interface
(3) Click on menu Project > Properties, goto Webdynpro refereces node in the tree and add the following
 (a) Interface References: tcsecdestinations~interface
 (b) Service References: tcsecdestinations~service
All the best, try option 1 first before you embark on the second one.
Regards, Parag.

Http authentication code

how to generate basic http authentication code of type digest(auth_type="digest") using jdeveloper,

When the following code is used to authenticate the HTTP send request using "digest" authentication type. It gives the error below.
// authentication code
Properties props = new Properties();
props.put(OracleSOAPHTTPConnection.AUTH_TYPE, "digest");
props.put(OracleSOAPHTTPConnection.USERNAME, "userid");
props.put(OracleSOAPHTTPConnection.PASSWORD, "password");
m_httpConnection.setProperties(props);
//Error
[SOAPException: faultCode=SOAP-ENV:IOException; msg="WWW-Authenticate" header is incorrect; targetException=java.io.IOException: "WWW-Authenticate" header is incorrect]
 at org.apache.soap.SOAPException.<init>(SOAPException.java:78)
 at oracle.soap.transport.http.OracleSOAPHTTPConnection.send(OracleSOAPHTTPConnection.java:765)
 at org.apache.soap.messaging.Message.send(Message.java:125)
 at mypackage1.SampleStub.Sample(SampleStub.java:184)
 at mypackage1.SampleStub.main(SampleStub.java:57)

Proxy for Basic Authentication

Hi,
Can someone point out if I am on the right track about this ?
I have an application which uses Basic Authentication as its authentication mechanism.I have defined the Application for single sign-on using the External Applications option in the Portal Builder.
I have read further down in the documentation (Configuring and Administering External Applications) http://download.oracle.com/docs/cd/B10464_01/manage.904/b10851/ext_apps.htm#1009009
that there is something called Proxy Authentication for Basic Authentication Applications.
Can someone explain this to me as I am unsure as to whether I need to set this proxy up as well ? The diagram in the documentation appears to be what I am trying to do.
As I mentioned in a previous post Basic Authentication doesn't appear to be working for me. The very first time I authenticate I get straight into the application but any attempts after that results in the Basic Authentication dialog box appearing even though I have checked the "Remember my login information" tick box.
Any ideas ?
Thanks,

Thank you for the response. I tried with a pass-through service account but could not get it working.
This is what I did:
1. I have a SOAP business service with WS-Policy with username security assertion.
2. I created a SOAP business service with the wsdl. OSB EPE editor said OSB does not support WSSE 1.2 policies. I extended my OSB domain to include OWSM and in the business service policy tab, selected OWSM policy option and added "oracle/wss_username_token_client_policy". (Now I am not sure how the user credentials in HTTP BASIC (headers) will be propagated to WS-Security headers)
3. I created a pass through service account and added this service account in the SOAP business service. I am able to configure service account only when I choose HTTP BASIC authentication in the business service. This did not propagate the username from HTTP to WS-Security. I see errors in the log like "WSM-00015 : The user name is missing.". Looks like wss_username_token_client_policy is looking for username in csf-key map. I do not know this map gets populated internally. If I have to do it programmatically I saw there is java code to set BindingProvider.USER_NAME in the request context. How do I do this from OSB designer ?
4. I tried creating a wrapper proxy around the secure SOAP business service and include the wrapper proxy in my main proxy but could not get it working. I get lof of NullPointers.
I am missing something. Can you please help ?

Use standard HTTP authentication for HDS and HLS VOD playback?

I am using FMS streaming edition. I would like to provide basic authentication on access to the HDS and HLS VOD playback.
I have configured FMS's Apache httpd.conf to use .htaccess file to password protect a directory. So, to download
http://server:8134/vod/some-directory/video.mp4
a user and password is required. This works fine.
However, I would like user and password to be required also when playing back in a player, using the URL such as:
http://server:8134/hds-vod/some-directory/video.mp4.f4m
http://server:8134/hls-vod/some-directory/video.mp4.mu38
When I test from OSMF configurator page, the video plays without needing password:
http://server:8134/hds-vod/some-directory/video.mp4.f4m
I want it to play only if user and password is provided, such as:
http://user:password@server:8134/hds-vod/some-directory/video.mp4.f4m
Anyone have ideas? Thx.

1. Here you don't need to flatten the video.
2. You can try enbling the mod_cache if on linux or add a proxy caching server infront. You can use apache for the same. Here is the guide on how to configure apache for caching http://httpd.apache.org/docs/2.2/caching.html
You need to add following (if not already) in the httpd.conf
LoadModule cache_module modules/mod_cache.so
<IfModule mod_cache.c>
 LoadModule disk_cache_module modules/mod_disk_cache.so
 <IfModule mod_disk_cache.c>
 CacheEnable disk /hds-vod
 CacheEnable disk /hls-vod
 CacheRoot cacheroot
 CacheMaxFileSize 10000000
 CacheLock On
 </IfModule>
</IfModule>

NAM 3.2.1 Custom Authentication Class for BASIC not loaded

Hi!
Im trying to write a custom authentication class for
BASIC/PROTECTED_BASIC, so I started with the PasswordClass sample from
SDK novell-nacm3_2-devel-2012.08.10.tar.gz, stripped out the
STSAuthenticationClass and changed the type to
AuthnConstants.PROTECTED_PASSWORD --> and it works!
public String getType() {
return AuthnConstants.PROTECTED_PASSWORD;
Next I wanted to create a custom BASIC auth class by changing the type
to AuthnConstants.BASIC / AuthnConstants.PROTECTED_BASIC
public String getType() {
return AuthnConstants.PROTECTED_BASIC;
but now IDP complains about the unsupported type.
<amLogEntry> 2012-12-20T15:11:17Z WARNING NIDS Application:
AM#300105006: AMDEVICEID#FC77EC2A45509E7B: Failed to load
authentication class due to unsupported type: ITdBasicTestClass
</amLogEntry>
Im running NAM 3.2.1 single box appliance for development/testing.
There is an old thread here, that looks like the same issue:
http://tinyurl.com/c6eawj6
Any hits?
regards
Thomas
PS: What i really want to solve is strip out the Domain from the
username on basic authentication since most MS apps/clients provide the
username in format DOMAIN\USER...
reibenwein
reibenwein's Profile: https://forums.netiq.com/member.php?userid=1382
View this thread: https://forums.netiq.com/showthread.php?t=46430

hmmm, well try writing the value out to stderr and see if you can at least make sure you are getting
a good read.
Like a System.out.println(AuthnConstants.PROTECTED_PASSWO RD);
I ran into some strange stuff where some constants had no values for no apparent reason when they
should.
I would also try supplying the actual value instead of the constant and see if it goes through that
way. ("ProtectedBasic")
On 1/10/2013 11:14 AM, reibenwein wrote:
>
> Hi!
>
>
> I copied com.novell.nam.authentication.PasswordClass to start with my
> test custom auth class. It includes a method getType() like this:
>
> /**
> * Get the authentication type this class implements
> *
> * @return returns the authentication type represented by this
> class
> */
> public String getType() {
> return AuthnConstants.PROTECTED_PASSWORD;
> }
>
>
> --> IDP loads my custom auth class, as long as a leave getType()
> returning AuthnConstants.PROTECTED_PASSWORD! But this is form base
> authentication. According to the API documentation (see page 17 in
> namc_enu.pfd within the sdk download), getType should
> returnAuthnConstants. PROTECTED_BASIC for secure Basic authentication
> (or AuthnConstants.BASIC for non SSL Basic auth). So i changed getType()
> like this:
>
>
> /**
> * Get the authentication type this class implements
> *
> * @return returns the authentication type represented by this class
> */
> public String getType() {
> return AuthnConstants.PROTECTED_BASIC;
> }
>
>
> --> and then IPD comes with the error "Failed to load authentication
> class due to unsupported type"...
>
>
> regards,
> Thomas
>
>

How do we determine the HTTP authentication header for our hosted solution?

How do we determine the HTTP authentication header (adobeconnect_admin_httpauth) from our hosted solution? The documentation says to find it in a custom.ini file but I have no clue how to access that.
I need to supply that to the adobeconnect plugin used with a Moodle instance, screnshot below.
If it helps, when I click "Test Connection", I see the following output.
A series of tests have been run in order to determine whether the Adobe Connect Pro server has been properly setup for this integration to work and to also determine whether the user credentials provided in the activity global settings has the correct permissions to perform the neccessary tasks required by the activity module. If any of the tests below have failed, this activity module will not function properly.
For further assistance and documentation in how to set up your Adobe Connect Pro server please consult the MoodleDocs help page for this activity module Help page
Sending common-info call:
successfully obtained the session key: na11breezrirhb4f4ryf5shqy
successfully logged in as admin user
Testing retrevial of shared content, recording and meeting folders:
error obtaining shared content folder
XML request:
<?xml version="1.0" encoding="UTF-8"?> <params><param name="action">sco-shortcuts</param></params>
XML response:
<?xml version="1.0" encoding="utf-8"?> <results><status code="no-access" subcode="no-login"/></results>
error obtaining forced-archives (meeting recordings) folder
XML request:
<?xml version="1.0" encoding="UTF-8"?> <params><param name="action">sco-shortcuts</param></params>
XML response:
<?xml version="1.0" encoding="utf-8"?> <results><status code="no-access" subcode="no-login"/></results>
error obtaining meetings folder
XML request:
<?xml version="1.0" encoding="UTF-8"?> <params><param name="action">sco-shortcuts</param></params>
XML response:
<?xml version="1.0" encoding="utf-8"?> <results><status code="no-access" subcode="no-login"/></results>
error creating meeting testmeetingtest folder
XML request:
<?xml version="1.0" encoding="UTF-8"?> <params><param name="action">sco-update</param><param name="type">meeting</param><param name="name">testmeetingtest</param><param name="folder-id"/><param name="date-begin">2015-03-14T06:53:39.000+00:00</param><param name="date-end">2015-03-14T07:53:39.000+00:00</param></params>
XML response:
<?xml version="1.0" encoding="utf-8"?> <results><status code="invalid"><invalid field="folder-id" type="id" subcode="format"/></status></results>
error creating user testusertest
XML request:
<?xml version="1.0" encoding="UTF-8"?> <params><param name="action">principal-update</param><param name="first-name">testusertest</param><param name="last-name">testusertest</param><param name="login">[email protected]</param><param name="password">9B396EA828A00203FB3E8E69010FE537</param><param name="extlogin">[email protected]</param><param name="type">user</param><param name="send-email">false</param><param name="has-children">0</param><param name="email">[email protected]</param></params>
XML response:
<?xml version="1.0" encoding="utf-8"?> <results><status code="no-access" subcode="no-login"/></results>
What are we missing?
Thanks!

Here is the docuementation for loging in with an HTTP Headder Adobe Connect 9 * Log in from an application
Seeing as there may be some modification to files on the server, you may need to work with Adobe Support to see if they can be modified in the Hosted environment.Adobe Connect Help | Adobe Connect Support

Http authentication failing on all sites, does not even prompt me for user/pass

Hi,
After an apt-get update, sites that use HTTP authentication do not prompt for credentials and go straight to HTTP:401. It is only affecting this browser, others have no issues. I also updated a FF in Windows, no issues there after the update.

Start Firefox in [[Safe Mode|Safe Mode]] to check if one of the extensions (Firefox/Tools > Add-ons > Extensions) or if hardware acceleration is causing the problem.
*Switch to the DEFAULT theme: Firefox/Tools > Add-ons > Appearance
*Do NOT click the Reset button on the Safe Mode start window
*https://support.mozilla.org/kb/Safe+Mode
*https://support.mozilla.org/kb/Troubleshooting+extensions+and+themes

JAAS NTLoginModule for basic http authentication

Similar Messages

Maybe you are looking for