My custom identity asserter is ignored - what did I miss?

Hello -
My custom identity asserter's assertIdentity method is never called - even though I've verified that the correct token is added to the request header. I am hoping for some guidance as to what I am missing.
1. I downloaded this sample app which uses ADF security: http://jdevsamples.googlecode.com/files/ADFSecurityWL.zip
I changed the app to:
- add a filter to dump request headers to System.out so I could verify that the token is correctly added to the request headers
- changed the auth-method in web.xml from BASIC to CLIENT-CERT
2. I also downloaded the sample authentication providers (for WLS 9.1) from here: https://codesamples.samplecode.oracle.com/servlets/tracking?id=S224
and created a custom identity asserter based on the sample identity asserter provider in the app.
3. I created an EAR file for the app and an mbean jar for the custom identity assertion provider.
4. I added the mbean jar to the correct directory under weblogic, restarted weblogic, and created an instance of my provider in the security realm. I also reordered the providers so mine would be first (not sure if that matters). Then I restarted weblogic again. I verified that my provider was in the list of providers and that the chosen "Active Types" included my token type.
5. I deployed the app EAR file to weblogic.
6. I created a test program based on the test program in the sample providers download (above) and connected to the deployed app. I verified that the test program added the correct token to the request. My app's filter dumped the headers and I could see the token there.
7. My custom identity assertion provider has System.out.println calls in the initialize() and assertIdentity() methods. I can see that the initialize() method is called when I start weblogic. However, I never see the assertIdentity() method's calls to System.out.println when I try to reach the app and those calls are the 1st thing in the method.
8. I am using WebLogic Server version 10.3.3.0
So, is there some obvious step I missed? (I am new to using WLS so it wouldn't surprise me if I got something really obvious wrong...)
Thanks for reading my question,
-- Scott

Thanks Faisal.
When I compared my mbean declaration with yours I discovered that I had set the Extends attribute to "weblogic.management.security.authentication.Authenticator" instead of "weblogic.management.security.authentication.IdentityAsserter". Using the correct value fixed my problem.

Similar Messages

Error deploying custom identity asserter

I'm getting the following error when trying to deploy my custom identity asserter.
An unexpected error occurred while setting Active Types Chooser to .
Partial stack trace is as follows:
[Management:145019]An error occurred while setting attribute:java.lang.NoSuchMethodException: com.foo.security.provider.FooIdentityAsserterImpl.validateActiveTypes([Ljava.lang.String;)
I've been back and forth through the mbean xml file and can't see anything wrong (despite the funky type in the dump).
I'm on 8.1 SP2.
Any ideas as to what would cause this?
Thanks,
Jim

The problem was with the name I was using for the implementation class of the identity asserter. Was calling it XXXIdentityAsserterImpl. This conflicted with the name of a class that was being generated by the MBean tool apparently. Changed it to XXXIdentityAsserterProviderImpl and the issue was resolved.

Hi I am a new iMac user. I got my iTunes on here finally, but now it is telling me I haven't authorized my computer? When I ask @ the app. store- no answers... What did I miss?

Hi, I am a new iMac user and I finally got my itunes to recognize my music to the iMac, but now it says my computer is not authorized?! When I ask at the App. store about this- they have nothing, but that is where the iMac sends me? So what did I miss?

TARDISvt wrote:
When I click on the apple in the left cornor I get App. Store- but I do not get the choice to authorize?...
You need to Open iTunes and then click on Store in the Menu Bar.
See this Discussion...
https://discussions.apple.com/thread/4631735?tstart=0

Family share says I need to complete iCloud setup, what did I miss?

Family share says I need to complete iCloud setup, what did I miss?

Welcome to the Apple Community Siobhan.
Please try the following...
Go to Settings > iCloud > Delete Account (This removes your data from your device, but not from your account, it will be added back later).
Restart the device.
Sign in again (Settings > iCloud, don't use the 'Create New Apple ID' button).

Test custom Identity Asserter

Hello.
I've been trying to use the SampleIdentityAsserter that is available in the dev2dev site, and i've been able to create the provider jar, add it in the console and configure it. But when i try to reach a protected resource (defining CLIENT-CERT in the web.xml) nothing seems to happen and I get a 401 (Unauthorized) error.
The code i'm using to connect to the protected resource is:
try{
URL u = new URL(url);
URLConnection uc = u.openConnection();
//encodedToken is a String value that represents the value of the token that is configured in the identity Asserter as pkcs7
uc.setRequestProperty("pkcs7",encodedToken);
HttpURLConnection connection = (HttpURLConnection)uc;
connection.setDoOutput(true);
connection.setDoInput(true);
InputStreamReader ireader =
new InputStreamReader(connection.getInputStream());
BufferedReader in = new BufferedReader(ireader);
String inputLine;
while ((inputLine = in.readLine()) != null)
System.out.println(inputLine);
in.close();
connection.disconnect();
} catch(Exception e){
e.printStackTrace();
Any clue on how to test this?
thanks in advance!

enable SecurityATN debug and mail me the log file
[email protected]

Installing and configuring CMAN. What did i miss?

Hi,
I am trying to configure cman on one of the exadata machine. I have done the below steps.
1. Installed admin client(11gR2) and connection manager(custom).
2. Configured cman.ora with appropriate host name.
3. Added Listener_cman in database host which has entries to the cman server.
4. Added Listener_cman as remote_listener in the database.
5. cmctl startup at the cman host.
6. cmctl show services is not listing all the services it supposed to list.
Did i miss any of the steps here? Do i need to mention these service names in any of the configuration file?
Please help.
Thanks,
Arun

There is no way for us to know what is going on in your system. You description is often vague about "some trouble" and things that you "guess" and something "may be wrong". Also, I'm pretty sure the cp command you gave is not the actual one you used, so we don't know what the actual command was.
Copying with /path/* will not copy "hidden" files, but there should not be any in /var/.
As the problems are unknown, and there may be no way of knowing them (unless you can give a much better history) then reinstalling the root system would seem best.

Been out of Java for 3 months, what did I miss?

Hey I stopped doing Java for a couple of months, and I plan to get back in it, im gonna buy a book soon, what do you guys think I should focus on when Im looking? Has anything big come up in Java Game design recently?

Also, I plan to start doing some multiplayer games now
as opposed to my old create an AI and the human goes
against the computer style, what should I know about
doing multiplayer stuff, and where can I find info?I hate to give a flippant answer, but the best things to do are...
a) search/browse these very forums (and read the posts); just because people haven't responded to a topic doesn't mean there's nothing useful in them. In the past two, three weeks, we've discussed topics ranging from synchronizing maps to message passing to security, that is, preventing people from hacking the clients to cheat.
b) don't worry about what you have to know and instead, think of some ideas for games that YOU would enjoy playing. Once you have a rough sketch in place for what you'd like do to, then, and this is crucial, think of ways you might be able to exploit it.
For example, if you create a multiplayer RPG, one of the obvious ways to exploit it is to allow the players to create their own characters, roll their own dice and so on. There are dozens of solutions that may work, but only you can decide which ones best fit your ideas.
When you have a specific question like "I need to do this and that and these create latency. How can I prevent that?" then we are here and happy to help. :)

HT4854 just finished downloading the new os for mac, but its not installing. My mac still shows 10.7.4 as the current os. what did i miss?

i have already rebooted mac, still at 10.7.4 OS

I had the same problem and was puzzled -- The App Store didn't automatically download/install ML after I purchased it. I had to click on Purchases and THEN on the "install" button.
Wasn't very intuitive.

Recently purchased Adobe CC, all apps are opening in Trial mode asking for a serial. What did I miss? I dont seem to have a serial code.

I recently purchased Adobe CC. Since then, all applications open in Trial mode asking me to basically enter a serial or 'join' when I join, it says I'm already a member. How can I fix this?

Sign in, activation, or connection errors | CC, CS6, CS5.5
Mylenium

HT4913 Added new computer to iTunes Match, but none of my iCloud music shows up. What did I miss?

I added my work laptop to iTunes Match, expecting to have access to my music library in iCloud. How do I get my iCloud library to show up?

Copy it from the other computer or from your backup copy of your other computer.

Identity Asserter is not invoked

Hi,
I am trying to write a custom identity asserter. I deployed the jar file to the MbenTypes directory, added asserter to the providers list under realm, chose correct token. I followed the every step in the document.
But the assertIdentity method is never get called. It always goes into
public AppConfigurationEntry getLoginModuleConfiguration() {
and it seems that wls treats the asserter as an authenticator.
Any clue? At least how can I debug it? I have no idea what happened behinde the scene.
Your help is very much appreciated.
-Wei

Sorry for the intrusion, but how do you verify the token matches the application user?
In my scenario, I have an MS.NET IIS application running as an "sso partner" application. On another j2ee server, I have deployed a set of web services that expose some custom security methods, as well as retrieve information from the SSO/LDAP repository (the user profile and some other attributes). I don't want want the MS app to simply make calls to these services without providing some form of identity information. If they could pass the currently logged in user, that really wouldn't mean much, because they could pass any name. What would validate it?
I don't know how they could pass the username AND password, as that password, I'm assuming, is not accessible as that was posted to the SSO server. I thought about using some of the request headers that the SSO server sets, but I don't know of any APIs that come into play to use these.
Does anyone have any suggestions as to what kind of security might be appropriate for these services?
Thanks a bunch,
Eric

Publisher 11g and Identity Asserter

How do you integrate publisher 11g with a custom weblogic identity asserter? From what I have been told so far, integration cannot be performed via the publisher administrative interfaces. It must be performed via configuration files on the server. There is no documentation on this subject yet. Has anyone performed the configuration that would be willing to share their experiences and configurations?
FYI, any attempt to utilize the identity asserter in the default publisher configuration will result in java errors in the server log and a 500 error in the browser.

Any security configuration must be under certified products so you can be confident they should work 100%. Otherwise
any issues you find under NOT certified products may not work and Oracle Support will not be able to help you.
As you describe the configuration you are trying to set is not certified and therefore the issues you find will probably
never be resolved.
References:
1. Setting Security in BIEE 11g:
http://download.oracle.com/docs/cd/E14571_01/bi.1111/e10543/intromartin.htm#CJHFBCBA
2. List of Certified products for BIEE11g:
http://www.oracle.com/technetwork/middleware/bi-enterprise-edition/bi-11gr1certmatrix-166168.xls
(Non Oracle ID and Access Mgmt tab)
If you configure BI Publisher 11g as Standalone then the list of Security Modes are:
- Oracle DB
- Siebel
- EBusiness Suite
- BI Publisher
- LDAP
- Fusion Middleware
regards
Jorge

Need Help with Identity Asserter and Authenticator

First I have build custom authentication provider and configured in Web logic without Assertion and deployed as MBean --
Then I build one Custom Identity Assertion separately and deployed on Web Logic with below configuration. Now my problem is that even though I pass TOKEN in header , but still weblogic prompts for username / password . Though it successfully prints Token on console inside Asserter.
Also I have set below in config.xml to avoid
<enforce-valid-basic-auth-credentials>false</enforce-valid-basic-auth-credentials>
Web.xml
<security-constraint>
          <display-name></display-name>
          <web-resource-collection>
               <web-resource-name>anything</web-resource-name>
               <url-pattern>/*</url-pattern>
               <http-method>GET</http-method>
               <http-method>PUT</http-method>
               <http-method>HEAD</http-method>
               <http-method>POST</http-method>
          </web-resource-collection>
          <auth-constraint>
               <description>user </description>
               <role-name>myuser</role-name>
          </auth-constraint>
     </security-constraint>
     <login-config>
          <auth-method>CLIENT-CERT</auth-method>
          <realm-name>myrealm</realm-name>
     </login-config>
     <security-role>
          <role-name>myuser</role-name>
     </security-role>
where do I need to define myuser in weblogic admin console ?

hello!
I've been trying to find a working example for creating
a custom Identity Assert...but the links to such resources in the old BEA
docs are now broken...
can you point me towards a source of working code examples
for an Identity Asserter?
thank you!

Turned domain server into DC. Groups did not translate over. Share permissions changed. What did I do?

I have two servers that are on a 2008 Active Directory Domain. Server 1 was originally the main DC, while server 2 was just a domain member. I upgraded the second server by adding DNS and Active Directory to the roles, and then used Server Manager
to do the DC Promo thing.
For some reason, the shares on this second server now are seeing some of the groups that had were controlling access to the shares on this server showing up as Account Unknown. My users can't get into the shares anymore. Errors suggest they
no longer have permissions.
What did I miss? Those groups exist on the first server, and have the right users in them.
Thanks

Hi Christoffer,
You are right that my last reply only applies to the first Domain Controller in the domain.
I added a additional DC into the domain, its local users didn't show in ADUC, then I demoted it, and its local users were gone.
Thank you for the reminding!
Regards,
Amy
I agree with Christoffer. I'm happy to hear your lab results provided you the same information.
If the original poster did see the local users and groups appear in ADUC after the promotion, it's telling me that it was promoted into a brand new domain/forest and not as a replica.
The shares should show up, and I understand that if any of the local users and groups were in the ACL that they should now show up as Unknown User, but if the users and groups showed up in ADUC, then something went wrong.
If the original poster, Emmette, can provide us a specific step by step on how the second DC was promoted, along with an ipconfig /all from each DC,
that will better help us understand what occurred, and help us provide assistance to fix it.
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.

NT User Extensible Policy - what am I missing ?

Hi,
NT4SP6a Workstation, NW Client 4.83
Zen 3.2 on NW6SP3 server.
I have created one simple user.
Then I created a User Policy Package, including a DLU policy and a User
Extensible Policy, in which I disabled "Registry editing tools".
I have assigned my policy to my user :
- the DLU policy works fine, my user is created at login, in the user group
I've chosen
- unfortunately, the user has access to regedit, and the parameters I
modifiy in the common.adm policy does not seem to be applied.
What did I miss ?

I once noticed a strange behaviour you might want to check.
When working in the policy package, I associated the policy package directly
to users.
It failed to apply.
I looked at the user for associated policies and it was empty. I can't
really remember whether or not the new policy association showed up in
effective policies or not. I suspect not.
So I worked from the user screen and associated the policy and it worked.
Maybe that will work for you.
Chris Denby
IT Coordinator
Rainy River District School Board
Fort Frances, Ontario
Canada
<[email protected]> wrote in message
news:CfvHd.655$[email protected]..
> Hi,
>
> NT4SP6a Workstation, NW Client 4.83
> Zen 3.2 on NW6SP3 server.
>
> I have created one simple user.
>
> Then I created a User Policy Package, including a DLU policy and a User
> Extensible Policy, in which I disabled "Registry editing tools".
>
> I have assigned my policy to my user :
>
> - the DLU policy works fine, my user is created at login, in the user
group
> I've chosen
> - unfortunately, the user has access to regedit, and the parameters I
> modifiy in the common.adm policy does not seem to be applied.
>
> What did I miss ?

My custom identity asserter is ignored - what did I miss?

Similar Messages

Maybe you are looking for