Principal(s) present in a Subject not propagated to EJBs

We are a team of students developing a J2EE web application and want to provide for security using JAAS and a combination of programmatic and declarative security.
Development Environment:
Sun Java System Application Server 1.4
J2EE 1.4, J2SE 1.4.2, Eclipse 2.1, Struts 1.1, MySQL
We have developed a custom LoginModule (along the lines of the article http://www.javaworld.com/javaworld/jw-09-2002/jw-0913-jaas.html)
User Id and password are taken from a jsp page and authenticated using passwords in a MySQL db.
After authentication, a Subject object (javax.security.auth.Subject) containing appropriate principals (com.sun.enterprise.deployment.PrincipalImpl) is put into the user session.
Declarative security (roles, role references, principal mappings, method permissions) are defined for EJBs in the ejb-jar.xml, sun-ejb-jar.xml, application.xml and sun-application.xml. A call to an EJB method is done by creating a PrivilegedAction wrapper, obtaining the subject from the session and executing the statement:
Subject.doAsPrivileged(subject, new PrivilegedAction() {
public Object run() {
myEjb.methodA();
return null;
}, null);
The Problem:
In the EJB method the PrincipalCollection returned by SessionContext.getCallerPrincipal() shows the caller to be ANONYMOUS (I got this after commenting out the ejb method permissions and letting the method be accessed unchecked). The identity with which the call is made is not being propagated.
I have been banging my head on the problem for around 2 weeks and still no breakthrough. Could you please provide some guidance or comments as to what might be the problem.
Thanks
Best Regards
Rajat Agrawal
SSN School of Advanced Software Engineering
Kalavakkam, Tamil Nadu
India

Hi
To plugin a custom login mechanism - you will need to do the following:
http://developers.sun.com/prodtech/appserver/reference/techart/as8_authentication/index.html
We support custom login modules - but for the subject to have the principals that you want from your loginmodule - you will have to hook your LoginModule through the realms infrastructure.
- thanks
Harpreet

Similar Messages

ESB errors not propagating to BPEL process

I am working in SOA Suite 10.1.3.3. I have an asynchronous BPEL process that is orchestrating a number of ESB services, most of which perform database operations. Occasionally an attempt is made to insert a record into a table which results in an error (e.g., null value inserted into a non-null field, record already exists, non-existent record in parent table upon which current table depends, etc.). This correctly results in an error in the ESB service that shows up in the ESB Control console.
The problem is that the error is NOT propagated upward to the invoking BPEL process (which contains all manner of fault catching branches to process the error, log it, send email notifications, and perform other database operations dependent upon the success or failure of the ESB operations). The BPEL process is therefore left "hanging" and never appears in the BPEL Control console as an instance. It shows up in the Manual Recovery queue as an essentially unrecoverable process.
I am assuming that this change in behavior (such errors formerly propagated to the calling BPEL) is a direct result of the new Fault Handling Framework. My question is: what do I have to do in order to restore the original behavior of the system (ESB service encounters an error and propagates the fault to the async BPEL process, which catches it and does whatever it needs to do to fulfill the requirements of the overall system)? Is this something that can be handled by changes to the BPEL/ESB system configuration, the BPEL process definition, the ESB service definitions, or some combination thereof?
Thanks for your time.
Paul Camann

Hello. We applied 10.1.3.3.1 MLR14 in late October 2008.
We are seeing large numbers of errors like this in the ESB log ($ORACLE_HOME/j2ee/oc4j_soa/log/oc4j_soa_default_group_1/oc4j/log.xml):
<MESSAGE>
<HEADER>
<TSTZ_ORIGINATING>2009-01-26T13:11:15.497-05:00</TSTZ_ORIGINATING>
<COMPONENT_ID>tip</COMPONENT_ID>
<MSG_TYPE TYPE="ERROR"></MSG_TYPE>
<MSG_LEVEL>1</MSG_LEVEL>
<HOST_ID>biwsvlbat027.gdbiw.com</HOST_ID>
<HOST_NWADDR>1.2.3.4</HOST_NWADDR>
<MODULE_ID>esb.server.service.impl.soap</MODULE_ID>
<THREAD_ID>98</THREAD_ID>
<USER_ID>oracle</USER_ID>
<SUPPL_ATTRS>
<ATTR NAME="J2EE_MODULE.name">provider-war</ATTR>
<ATTR NAME="J2EE_APP.name">esb-rt</ATTR>
<ATTR
NAME="WEBSERVICE_PORT.name">__soap_Router_ODS_STAGE_Insert_ODS_STAGE_I_PortType</ATTR>
<ATTR NAME="WEBSERVICE.name">ESB_Router_ODS_STAGE_Insert_Service</ATTR>
</SUPPL_ATTRS>
</HEADER>
<CORRELATION_DATA>
<EXEC_CONTEXT_ID><UNIQUE_ID>1232993475:1.2.3.4:7097:0:307</UNIQUE_ID><SEQ>5</SEQ></EXEC_CONT
EXT_ID>
</CORRELATION_DATA>
<PAYLOAD>
<MSG_TEXT>Exception while print response</MSG_TEXT>
<SUPPL_DETAIL><![CDATA[java.lang.NullPointerException
at oracle.tip.esb.server.service.impl.soap.EventOracleSoapProvider.processMessage
(EventOracleSoapProvider.java:215)
at oracle.j2ee.ws.server.provider.ProviderProcessor.doEndpointProcessing
(ProviderProcessor.java:956)
at oracle.j2ee.ws.server.WebServiceProcessor.invokeEndpointImplementation
(WebServiceProcessor.java:349)
at oracle.j2ee.ws.server.provider.ProviderProcessor.doRequestProcessing
(ProviderProcessor.java:466)
at oracle.j2ee.ws.server.WebServiceProcessor.processRequest
(WebServiceProcessor.java:114)
at oracle.j2ee.ws.server.WebServiceProcessor.doService(WebServiceProcessor.java:96)
at oracle.j2ee.ws.server.WebServiceServlet.doPost(WebServiceServlet.java:177)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:763)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:856)
at com.evermind.server.http.ServletRequestDispatcher.invoke
(ServletRequestDispatcher.java:713)
at com.evermind.server.http.ServletRequestDispatcher.forwardInternal
(ServletRequestDispatcher.java:370)
at com.evermind.server.http.HttpRequestHandler.doProcessRequest
(HttpRequestHandler.java:871)
at com.evermind.server.http.HttpRequestHandler.processRequest
(HttpRequestHandler.java:453)
at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:302)
at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:190)
at oracle.oc4j.network.ServerSocketReadHandler$SafeRunnable.run
(ServerSocketReadHandler.java:260)
at com.evermind.util.ReleasableResourcePooledExecutor$MyWorker.run
(ReleasableResourcePooledExecutor.java:303)
at java.lang.Thread.run(Thread.java:595)
]]></SUPPL_DETAIL>
</PAYLOAD>
</MESSAGE>
which is possibly the message that would come back from ESB to BPEL failing?
Thank you.

Document Set shared columns not propagated to documents newly added

I have a Document Set with shared Managed Metadata and Person fields.
I have found that sometimes some managed metadata fields are not propagated to newly added documents using drag and drop with Windows Explorer.
[ Note : Sharepoint 2013 with SP1 ]
Example
Field A = Person or group (optional)
Field B = Managed Metadata (optional)
Step 1 :
I create a new Document Set (lets call this one docset X), with field A empty and field B with a value.
I save this docset then open the document library in Windows Explorer and finaly, drag and drop a document inside the folder of this newly created docset.
When I look at the properties of the document, I found that there is no value in the field B even if it's not the case of the docset.
Step 2 :
I create another Document Set (lets call this one docset Z), and add a value inside field A and field B.
Again, I save this docset then open the document library in Windows Explorer and finaly, drag and drop a document inside the folder of this newly created docset.
When I look at the properties of the document, I found that there is a value in the field B and in the field A.
Conclusion
So it seems that the propagation of field B depends on if there is a value inside field A.
It does not make sense.
Any ideas ?

Hi vinz,
I tried many times and couldn't reproduce your issue in my environment(SP 2013+SP1), manged metadata field value in Docuemnt Set content item always could be propagated to documents dragged/dropped in this doc set folder via Windows Explorer regarding
other fields value.
You may try to test on other lists, site collections or web applications (may also test with new manged metada term store), see if this issue could be reproduced or isolate, the manged metada column value shouldn't be depend on other column value.
Also check ULS log, see if there is any related error message generated when the document is dragged to the library windows explorer with this issue.
http://blogs.msdn.com/b/opal/archive/2009/12/22/uls-viewer-for-sharepoint-2010-troubleshooting.aspx
Thanks
Daniel Yang
TechNet Community Support
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
[email protected]

ADF JDeveloper 10.1.3.4.0 Entity Attribute validation not propagated to UI

Hi,
I'm trying to use entity attribute validation in an ADF Faces / ADFm / ADF BC application. However the validation error
is not propagated through the BindingContainer to my ADF Faces Page. When I customize and override the DCErrorHandler that
is registered on the BindingContext the reportException() method doesn't fire.
Anyone have an idea how to debug this Validation error gone lost ?.
Thanks,
Kenneth

Hi,
is it getting propagated without your custom error handler ?
Frank

Report with data that is present in cube and not in ODS from a multiprovide

Hi Friends,
I have a multiprovider with one cube and one ODS. I have a requirement to create a exception report. This exception report should have records that are present in cube but not in ODS. If cube has a record which is present in both infoproviders then report should not display that.
I hope I am clear on my question.
Thanks and regards,
Balaraj

Thanks Timur,
But this is going to give me all the data present in that selected cube. I want to the report to display data only if it is present in cube but not in ODS.
ODS data
Material............Component...........Amount
10001.................30001................100
10001.................30002................200
Cube Data
Material....................Amount
10001.......................100
20002.......................200
My report should display
Material................Amount
20002...................200
It should not display 10001 as it is present in ODS.
I hope I am clear this time.
Thanks and regards,
Balaraj

Does Master data presents in ODS or not?

Dear One's..........
Does Master data presents in ODS or not? if yes, how ? and where can we see?
Thanks,
Raj

Hi,
Master data is not present in ods.
check the link .
http://www.bridgeport.edu/sed/projects/cs597/Fall_2003/vijaykse/extended_star_schema.htm
Regards,
Krishna.

I just completed a keynote presentation, but it will not "play"...I just get a blank slide (probably the final slide) when I hit the play button, even though I can see all the slides are in the list and will open as I click on them. HELP!

I just completed a keynote presentation but it will not "Play". I can see the slides are in place, but all that comes to the screen when I hit the play arrow is the last, blank, slide. HELP!

At the risk of stating the obvious, is your first slide highlighted before you hit play? You mentioned the last blank slide shows up which could mean you have that last slide highlighted. If the last slide is highlighted and you hit play then that is the slide that will show up and if it's your last slide that is all you will see.
Make sense?

Bounds are not propagated in extended class

Have a look on this small example, 3 classes A, B and C.
B and A are generics class,
B herits of A and there is a lower bounds on the class T in B (T extends C)
public class A<T> {
     public A() {}
     public T foo()
public class B<T extends C> extends A<T> {
     public B() {}
     public static void main(String[] args) {
          B inst = new B();
          C cInst = inst.foo3(); //problem : it does'nt work !!
public class C {
     public C() {}
}The problem is in the main of the class B, the compiler says : "Cannot convert from Object to C".
My reasoning :
There is a type constraint (a lower bound) on T in the class B, so "T extends C" in the class B, so "T extends C" in the class A for an instance of the class B. The call to the method foo() does answer an object which class extends class C !!
Someone has an explanation, it's abnormal or I should set the parameters of javac.
thank you.

Ok my examples were wrong !!
Have a look on this example (smaller and better !)
B and A are generics class,
B herits of A and there is a lower bounds on the class T in A "T extends C"
public class A<T extends C> {
     public A() {}
     public T foo()
     public void foo2() {
          C cinst = foo(); //no problem : it works
public class B<T> extends A<T> {
     public B() {...}
     public void foo3() {
          C cinst = foo(); //error : "cannot convert T to C"
}The type constraint "<T extends C>" of the class "A" is not propagated to the class "B" !!
I have to add the constraint <T extends C> to the class B like this
public class B<T extends C> extends A<T> {...}However, it's inevitably like this !

How can I save my iWeb site as an interactive doco for a presentation? It is not published to the net.

How can I save my iWeb site as an interactive doco for a presentation? It is not published to the net.

mashett wrote:
By interactive document I meant to function as a website with pages that are linked through what would be the hyperlink.
That's exactly what you would get. Create a folder with a suitable name: publish to it. Zip it; email it. Tell them to start with the 'index.html' file inside the folder. The rest will follow - they will see it exactly as they would see an online site, links and all.
Note that there is usually a 20MB limit on email attachments so if your site is image-heavy you might have a problem. An alternative is to post it to your webspace - you could post the zipped file and give them a link to it - that will download it (and it's a preferable way of handing a large file anyway, as they can download it at their convenience rather than being forced to in order to get their other mail).

Propagation Issue - Workflows are not propagating

Hi All,
I am working on Weblogic Portal 10.2 and using MySql 5.0.
I am propagating data from Windows env to Linux server Using Ant Tool.
Destination environment having only initial data , means data created during domain creation.
But Custom workflows are not moving from source to destination during propagation.
Pls suggest what changes to be done to propagate workflows succesfully
Thanks & Regards,
Srinivas
Edited by: SrinivasJ on Dec 4, 2008 9:47 PM

Hi Srinivas,
I'm not aware of any issues with propagating workflow definitions, but I know that the workflow status of content items is not propagated. If that is the only issue you are having then perhaps the bulk update tool would be of use?
http://download-llnw.oracle.com/docs/cd/E13155_01/wlp/docs103/cm/libraryServicesCM.html#wp1084746
It allows you to change the status of several content items in a single operation. The docs only show the bulk update tool being used in the "Assigned Items" folder, but it is also available in the "Checked-Out Items" folder.
If that tool is not flexible enough to do what you need to do then it is possible to use the Content Management APIs to develop a simple JSP or portlet that changes the workflow status of whatever items you want. I know that some people did this before the bulk update tool became available in version 10.2.

Webparts and user in source variation site's page not propagating target site's page

Hi ,
I have issue with variation.
1) User in people picker field in source page not propagating in target page
2) Webparts in source page are not propagating in target page
No error in ULS log.
Thanks,
Dinesh

Hi Dinesh,
Please provide some screenshots about your issue.
Please make sure you have selected "Update Target Page Web Parts" under Site Collection Administartion->Variations.
In addition, please check if the link is useful:
http://technet.microsoft.com/en-US/library/ff628966(v=office.15).aspx
Best Regards,
Wendy
Wendy Li
TechNet Community Support

AXIS AxisFault not propagated

Hi,
my Eclipse Ganymede generated AXIS Client throws a SAX Exception if the service I am calling returns a soap:Fault.
That means that the application exception info is gone once the AXIS stuff returns to my client, leaving only the SAX Exception.
How can I configure AXIS, so that it can cope with application exceptions.
The only thing I found was to implement my own handler, and making it throw an AxisFault with the desired exception info.
But thats not propagated to my client code either.
Thanks
Matthias

fd1380 wrote:
my Eclipse Ganymede generated AXIS Client throws a SAX Exception if the service I am calling returns a soap:Fault.
That means that the application exception info is gone once the AXIS stuff returns to my client, leaving only the SAX Exception.
How can I configure AXIS, so that it can cope with application exceptions.
The only thing I found was to implement my own handler, and making it throw an AxisFault with the desired exception info.
But thats not propagated to my client code either.Thats the right way to go. Writing your handlers for exceptions is the only way I see to cope with application exceptions. Your handlers should be configured in your project using module.xml, services.xml, and also axis2.xml, which is global, meaning it affects all the other applications. Here is the guide for handlers.

I keep getting an "SSL has not propagated yet" message on secure websites

On any secure website, I get a message in Firefox warning "SSL has not propagated yet." Nothing seems to be affected, I can still access the sites (this one for example), but the message keeps popping up.
This all started this morning when 11.0 was installed, I went back to 10.0 but that did not resolve the problem.

Did you check your security software (firewall)?
A possible cause is security software (firewall) that blocks or restricts Firefox or the plugin-container process without informing you, possibly after detecting changes (update) to the Firefox program.
S
Remove all rules for Firefox and the plugin-container from the permissions list in the firewall and let your firewall ask again for permission to get full unrestricted access to internet for Firefox and the plugin-container process and the updater process.
See:
*https://support.mozilla.org/kb/Server+not+found
*https://support.mozilla.org/kb/Firewalls

User and group field values not propagating in Sharepoint 2013 variation

Hi,
I have a issue, we have a User and group field in my Content type and this content type is attach to Pages library.
I created one Page in source variation site and fill User and Group field with two user one is domain user and another is sharepoint\system account user.
After variation work and page propagate to target variation , there is only sharepoint\system account and no domain user in user and group field.
*****The main issue is domain user are not propagating in target variation site's fields.
Thanks,
dinesh

can any one hep me on this

Identity propagation with EJB

How to propagation identity to Remote EJB if client application is not deployed on WLS, but just standalone application.
I found some document on the web in regards to identity propagation with remote EJB ( EJB security mechanisms)
I follow it and have the following code:
package oracle.bpel.services.workflow.samples;
import java.security.Principal;
import java.security.PrivilegedExceptionAction;
import java.util.List;
import javax.security.auth.Subject;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.NameCallback;
import javax.security.auth.callback.PasswordCallback;
import javax.security.auth.callback.UnsupportedCallbackException;
import javax.security.auth.login.LoginContext;
import weblogic.security.auth.callback.URLCallback;
import oracle.bpel.services.workflow.client.WorkflowServiceClientFactory;
import oracle.security.jps.util.SubjectUtil;
public class RemoteWFClientWithIdentityPropagationSample {
public void runRemoteClient() {
try {
PrivilegedExceptionAction<List> privilegedExceptionAction = new PrivilegedExceptionAction<List>() {
public List run() throws Exception {
for (Principal pr : SubjectUtil.getCurrentSubject().getPrincipals()) {
System.out.println("Current Principals: " + pr.getName());
return RemoteWFClientSample.runWithUserPropagation(WorkflowServiceClientFactory.REMOTE_CLIENT); // it calls Remote EJB
SampleCallbackHandler handler = new SampleCallbackHandler("jcooper", "welcome1", "t3://stapj73.us.oracle.com:7001");
LoginContext loginContext = new LoginContext("Sample",handler);
loginContext.login();
Subject subject = loginContext.getSubject();
List result = (List) Subject.doAs(subject, privilegedExceptionAction);
System.out.println("runRemoteClient is " + result);
} catch (Exception e) {
System.out.println("Error occur");
e.printStackTrace();
class SampleCallbackHandler implements CallbackHandler {
private String uname = null;
private String passwd = null;
private String url = null;
public SampleCallbackHandler(String uname, String passwd, String url) {
this.uname = uname;
this.passwd = passwd;
this.url = url;
public void handle(Callback[] callbacks) throws
java.io.IOException, UnsupportedCallbackException {
for (int i = 0; i < callbacks.length; i++) {
if (callbacks[i] instanceof NameCallback) {
NameCallback nc = (NameCallback) callbacks;
nc.setName(uname);
} else if (callbacks[i] instanceof URLCallback) {
URLCallback uc = (URLCallback) callbacks[i];
uc.setURL(url);
} else if (callbacks[i] instanceof PasswordCallback) {
PasswordCallback pc = (PasswordCallback) callbacks[i];
pc.setPassword(passwd.toCharArray());
} // for
} // handle()
public static void main(String args[]) {
RemoteWFClientWithIdentityPropagationSample sample = new RemoteWFClientWithIdentityPropagationSample();
sample.runRemoteClient();
I run test with JVM system option : -Djava.security.auth.login.config=C:\Work\JavaTry\login.conf
where C:\Work\JavaTry\login.conf has the following lines:
Sample {
weblogic.security.auth.login.UsernamePasswordLoginModule required
debug=false;
Client shows pincipals in the Subject:
But still, on server side sessionContext.getCallerPrincipal() returns '<anonymous>' instead of 'jcooper'
What is wrong now?

OK I have got a little further.
code snippetString contextServiceURL = "corbaloc:iiop:10.230.180.69:7002/NameService";
Hashtable table = new Hashtable();
table.put(InitialContext.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.cosnaming.CNCtxFactory");
table.put(InitialContext.PROVIDER_URL, contextServiceURL);
InitialContext context = new InitialContext(table);
Object ref = context.lookup("ejb.myejbRemoteHome");
myejbRemoteHome home = (myejbRemoteHome)PortableRemoteObject.narrow(ref, myejbRemoteHome.class);
myejbRemote obj = home.create();
obj.testUnsecureMethod();
obj.testSecureMethod();
<<<<<<<<
The unsecure call works fine, the secure call gives me:
java.rmi.AccessException: CORBA NO_PERMISSION 0 Maybe; nested exception is:
org.omg.CORBA.NO_PERMISSION: vmcid: 0x0 minor code: 0 completed: Maybe
If i set defaultiiop username and password in WebLogic under Environment -> Server -> protocals -> IIOP to weblogic/password then the secure call works. This makes me think that the Subject is not propagating properly.
In the request in Tomcat I have a GenericPrincipal with user and group info. In the Session i have a Subject with only WLSUserImpl, but not the WLSGroupImpl's that I expect. They are there when the login happes, I see the weblogic Authenticate method populate the subject with the groups okay.
Any help much appreicated.
Edited by lnoton at 04/24/2008 2:56 AM
Edited by lnoton at 04/24/2008 2:57 AM

Principal(s) present in a Subject not propagated to EJBs

Similar Messages

Maybe you are looking for