Policy Agent 2.2 /SJSAS 9.1 EE: security works sporadically

Question

Hi,
Ive been having some trouble getting SSO working between my Sun Portal Server 7.1/Access Manager 7.1 running on my Solaris x86 machine and the Sun Application Server 9.1 EE with a Sun AM Policy Agent 2.2 on it. I'm deploying an Java EE app that uses Spring MVC. The application is protected with declarative security. Here is the web.xml and sun-web.xml
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/applicationContext.xml</param-value>
    </context-param>
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
    <listener>
        <listener-class>util.ConfigPropertiesExposerListener</listener-class>
    </listener>
    <servlet>
        <servlet-name>dispatcher</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>2</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>dispatcher</servlet-name>
        <url-pattern>*.htm</url-pattern>
    </servlet-mapping>
    <session-config>
        <session-timeout>
            30
        </session-timeout>
    </session-config>
    <security-constraint>
        <display-name>All Users</display-name>
        <web-resource-collection>
            <web-resource-name>index</web-resource-name>
            <description/>
            <url-pattern>/index.htm</url-pattern>
            <http-method>GET</http-method>
            <http-method>POST</http-method>
            <http-method>HEAD</http-method>
            <http-method>PUT</http-method>
            <http-method>OPTIONS</http-method>
            <http-method>TRACE</http-method>
            <http-method>DELETE</http-method>
        </web-resource-collection>
        <auth-constraint>
            <description>All</description>
            <role-name>USERS</role-name>
            <role-name>ADMINISTRATORS</role-name>
        </auth-constraint>
    </security-constraint>
    <welcome-file-list>
        <welcome-file>index.jsp</welcome-file>
    </welcome-file-list>
    <filter>
        <filter-name>Agent</filter-name>
        <filter-class> com.sun.identity.agents.filter.AmAgentFilter </filter-class>
    </filter>
    <filter-mapping>
        <filter-name>Agent</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>INCLUDE</dispatcher>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>ERROR</dispatcher>
    </filter-mapping>
    <jsp-config>
        <taglib>
            <taglib-uri>/spring</taglib-uri>
            <taglib-location>/WEB-INF/spring.tld</taglib-location>
        </taglib>
        <taglib>
            <taglib-uri>http://jakarta.apache.org/taglibs/request-1.0</taglib-uri>
            <taglib-location>/WEB-INF/request.tld</taglib-location>
        </taglib>
        <taglib>
            <taglib-uri>http://www.springframework.org/tags/form</taglib-uri>
            <taglib-location>/WEB-INF/spring-form.tld</taglib-location>
        </taglib>
    </jsp-config>
    <security-constraint>
        <display-name>Protected</display-name>
        <web-resource-collection>
            <web-resource-name>Salary Increase</web-resource-name>
            <description/>
            <url-pattern>/salaryincrease.htm</url-pattern>
            <http-method>GET</http-method>
            <http-method>POST</http-method>
            <http-method>HEAD</http-method>
            <http-method>PUT</http-method>
            <http-method>OPTIONS</http-method>
            <http-method>TRACE</http-method>
            <http-method>DELETE</http-method>
        </web-resource-collection>
        <auth-constraint>
            <description>Just Admins</description>
            <role-name>ADMINISTRATORS</role-name>
        </auth-constraint>
    </security-constraint>
    <login-config>
        <auth-method>FORM</auth-method>
        <form-login-config>
            <form-login-page>/login.jsp</form-login-page>
            <form-error-page>/loginerror.jsp</form-error-page>
        </form-login-config>
    </login-config>
    <security-role>
        <description/>
        <role-name>USERS</role-name>
    </security-role>
    <security-role>
        <description/>
        <role-name>ADMINISTRATORS</role-name>
    </security-role>
    <resource-ref>
        <res-ref-name>jdbc/oracle</res-ref-name>
        <res-type>javax.sql.DataSource</res-type>
        <res-auth>Container</res-auth>
        <res-sharing-scope>Shareable</res-sharing-scope>
    </resource-ref>
</web-app>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE sun-web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Application Server 9.0 Servlet 2.5//EN" "http://www.sun.com/software/appserver/dtds/sun-web-app_2_5-0.dtd">
<sun-web-app error-url="">
    <context-root>/accesstest</context-root>
    <class-loader delegate="true"/>
    <security-role-mapping>
        <role-name>ADMINISTRATORS</role-name>
        <group-name>id=Administrators,ou=role,o=EnterpriseSample,ou=services,dc=domain,dc=com</group-name>
    </security-role-mapping>
    <security-role-mapping>
        <role-name>USERS</role-name>
        <group-name>id=Users,ou=role,o=EnterpriseSample,ou=services,dc=domain,dc=com</group-name>
    </security-role-mapping>
    <jsp-config>
        <property name="keepgenerated" value="true">
            <description>Keep a copy of the generated servlet class' java code.</description>
        </property>
    </jsp-config>
    <session-config>
        <session-manager/>
    </session-config>
</sun-web-app>The two roles that I'm working with, Administrators and Users, I created for development purposes to test SSO against the Enterprise Sample.
So the problem is that sometimes SSO works and sometimes it doesn't. When I try to go to my app, sometimes it acts like it's suppose to: It redirects you to the AM login page, you login in, and then it redirects you back to the app. Most of the time, after I redeploy or restart the domain/instance, when I login the redirect back to my app returns an "access denied" page from app server.
Can anyone help me to debug this problem? How can I view what role my app is receiving from Access Manager after login? Where does the Security Audit Module log to? Will it help me debug this problem? There is not much in the documentation on it.
Any help would be appreciated.
-Matt

Answer 1

Hi again MHGL and Sean,
Sorry I didnt explain this last time. My fault.
I looked at:
http://wikis.sun.com/display/OpenSSO/J2EEAgentTrouble#J2EEAgentTrouble-redirecterrors
This appears to be the issue you are talking about MHGL.
My deployment has the AM7.1/AS8.2 instance is on a different server than my Policy Agent 2.2/Spring App/AS8.2 instance. This bug talks about the AM and Agent on the same server.
I attempted both solutions, com.iplanet.am.cookie.encode=true and com.sun.identity.agents.config.sso.decode=false. They caused my request to redirect back and forth between both servers, ending with a page in Firefox that says "Firefox has detected that the server is redirecting the request for this address in a way that will never complete."
Sorry for the confusion. I appreciate all the help. Let me know if you have any other suggestions and Ill continue to update when things get resolved.
-Matt