Retriving the userid from FORM based authentication

Hi All,I am using FORM based authentication against an NDS directory. After I transfer to j_security_check with my action, how do I retreive the userid from weblogic? Just to be clear, the entire application works correctly using form based authentication, I just need to get my hands on the userid.Thanks,Ian

Try this: weblogic.security.acl.Security.getCurrentUser.getName()
"Ian Douglas" <[email protected]> wrote in message
news:3b448970$[email protected]..
Hi All,I am using FORM based authentication against an NDS directory.After I transfer to j_security_check with my action, how do I retreive the
userid from weblogic? Just to be clear, the entire application works
correctly using form based authentication, I just need to get my hands on
the userid.Thanks,Ian

Similar Messages

How to redirect to j_security_check without the form based authentication

Hi,
I am trying to integrate my application authentication to a backend system with the ibm websphere form based authentication. Below is the scenario:
1. when the user clicks on a protected url, the container will redirect the user to the login page.
2. instead of displaying the login page, i would like to automatically redirect the user to j_security_check action. which means that instead of displaying the login.jsp page, the user will automatically be redirected to j_security_check to perform some user authentication, and if successful, the application pages will be displayed.
The reason i want to auto redirect the user to j_security_check is because i am implementing some integration work with a backend system. the user will key in the username/password from another system. once the user is authenticated, the user information will be passed to my system. The login page of my system will not be displayed again, and by using the username value, my system will assume that the user has successfully been authenticated (authentication done by the backend system), and therefore automatically gain authorization to login into my application.
i hope that clarifies my problem.
anyone out there has any solution to my problem?
thanks a lot in advance.

Hi Darren,
Let me explain the whole authentication environment.
There are actually 2 systems in this environment. Let;s call it system A and system B.
System B is actually using the authentication mechanism that i described in my previous message.
A login page will be presented to the user (within system A). User credential is collected and passed to system A to be authenticated. System A will use its own mechanism to authenticate the user.
Once the user is authenticated, system A will pass the user ID to system B. At this point, system B will assume that the user is authenticated and grant authorization to access the application. (system B global security is enabled and implements the form based authentication mechanism) Therefore, at this point, the redirect page (so called login page) will not be displayed to the user, instead it will be automatically redirected to the j_security_check action to execute the customer Ldap Registry class. (ps : eventhough authentication is no longer needed, the flow will still go to Ldap Registry class. A check is done in the Ldap Registry class to skip the authentication, if it is not boot strap login. Only first and only time authentication is done for boot strap login).
In the case a protected url is clicked or invoked by the user directly, the application will redirect the user to the initial login of system A. Otherwise (the url link originates from system A, during the passing of user token to system B), system B will redirect to j_security_check and execute the customer Ldap Registry class.
Based on the above explained scenario, in your opinion, is there any security loopholes? consider that system B no longer perform authentication but only to grant authorization to the user.
Appreciate your advice. Thanks in advance
Anyway, i am using the ibm websphere server. :)

Form-based authentication problem with weblogic

Hi Everyone,
The following problem related to form-based authentication
was posted one week ago and no reponse. Can someone give it
a shot? One more thing is added here. When I try it on J2EE
server and do the same thing, I didn't encounter this error
message, and I am redirected to the homeage.
Thanks.
-John
I am using weblogic5.1 and RDBMSRealm as the security realm. I am having the following problem with the form-based authentication login mechanism. Does anyone have an idea what the problem is and how to solve it?
When I login my application and logout as normal procedure, it is OK. But if I login and use the browser's BACK button to back the login page and try to login as a new user, I got the following error message,
"Form based authentication failed. Could not find session."
When I check the LOG file, it gives me the following message,
"Form based authentication failed. One of the following reasons could cause it: HTTP sessions are disabled. An old session ID was stored in the browser."
Normally, if you login and want to relogin without logout first, it supposes to direct you to the existing user session. But I don't understand why it gave me this error. I also checked my property file, it appears that the HTTP sessions are enabled as follows,
weblogic.httpd.session.enable=true

Hi...
Hehe... I actually did implement the way you implement it. My login.jsp actually checks if the user is authenticated. If yes, then it will forward it to the home page. On the other hand, I used ServletAuthentication to solve the problem mentioned by Cameron where Form Authentication Failed usually occurs for the first login attempt. I'm also getting this error occasionally. Using ServletAuthentication totally eliminates the occurence of this problem.
I'm not using j_security_check anymore. ServletAuthentication does all the works. It also uses RDBMSRealm to authenticate the user. I think the biggest disadvantage I can see when using ServletAuthentication is that the requested resource will not be returned after authentication cause the page returned after authenticating the user is actually hard coded (for my case, it's the home.jsp)
cheers...
Jerson
"John Wang" <[email protected]> wrote:
>
Hi Jerson,
I tried your code this weekend, it didn't work in my case. But
I solved my specific problem other way. The idea behind my problem is that the user tries to relogin when he already logs in. Therefore, I just redirect the user into another page when he is getting the login page by htting the BACK button, rather than reauthenticate the user as the way you did.
But, I think your idea is very helpful if it could work. Problems such multiple concurrence logins can be solved by pre-processing.
In your new code, you solved the problem with a new approach. I am just wondering, do you still implement it with your login.jsp file? In other word, your action in login.jsp is still "Authenticate"? Where do you put the URL "j_security_check"?
Thanks.
-John
"Jerson Chua" <[email protected]> wrote:
I've solved the problem by using ServletAuthentication. So far I'm not getting the error message. One of the side effects is that it doesn't return the requested URI after authentication, it will always return the home page.
Jerson
package com.cyberj.catalyst.web;
import weblogic.servlet.security.*;
import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
public class Authenticate extends HttpServlet {
private ServletAuthentication sa = new ServletAuthentication("j_username", "j_password");
public void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, java.io.IOException {
int authenticated = sa.weak(request, response);
if (authenticated == ServletAuthentication.NEEDS_CREDENTIALS ||
authenticated == ServletAuthentication.FAILED_AUTHENTICATION) {
response.sendRedirect("fail_login.jsp");
} else {
response.sendRedirect("Home.jsp");
public void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, java.io.IOException {
doPost(request, response);
"Jerson Chua" <[email protected]> wrote:
The problem is still there even if I use page redirection. Grrr... My boss wants me to solve this problem so what are the alternatives I can do? Are there any other ways of authenticating the user? In my web tier... I'm using isUserInRole, getRemoteUser and the web tier actually connects to EJBs. If I implement my custom authentication, I wouldn't be able to use this functionalities.
Has anyone solved this problem? I've tried the example itself and the same problem occurs.
Jerson
"Cameron Purdy" <[email protected]> wrote:
Jerson,
First try it redirected (raw) to see if that indeed is the problem ... then
if it works you can "fix" it the way you want.
Peace,
Cameron Purdy
Tangosol, Inc.
http://www.tangosol.com
+1.617.623.5782
WebLogic Consulting Available
"Jerson Chua" <[email protected]> wrote in message
news:[email protected]...
Hi...
Thanks for your suggestion... I've actually thought of that solution. Butusing page redirection will expose the user's password. I'm thinking of
another indirection where I will redirect it to another servlet but the
password is encrypted.
What do you think?
thanks....
Jerson
"Cameron Purdy" <[email protected]> wrote:
Maybe redirect to the current URL after killing the session to let the
request clean itself up. I don't think that a lot of the request (such
as
remote user) will be affected by killing the session until the nextrequest
comes in.
Peace,
Cameron Purdy
Tangosol, Inc.
http://www.tangosol.com
+1.617.623.5782
WebLogic Consulting Available
"Jerson Chua" <[email protected]> wrote in message
news:[email protected]...
Hello guys...
I've a solution but it doesn't work yet so I need your help. Because
one
of the reason for getting form base authentication failed is if an
authenticated user tries to login again. For example, the one mentionedby
John using the back button to go to the login page and when the user logsin
again, this error occurs.
So here's my solution
Instead of submitting the page to j_security_check, submit it to a
servlet
which will check if the user is logged in or not. If yes, invalidates its
session and forward it to j_security_check. But there's a problem in this
solution, eventhough the session.invalidate() (which actually logs theuser
out) is executed before forwarded to j_security_check, the user doesn't
immediately logged out. How did I know this, because after calling
session.invalidate, i tried calling request.RemoteUser() and it doesn't
return null. So I'm still getting the error. What I want to ask you guyis
how do I force logout before the j_security_check is called.
here's the code I did which the login.jsp actually submits to
import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
public class Authenticate extends HttpServlet {
public void doPost(HttpServletRequest request, HttpServletResponseresponse)
throws ServletException, java.io.IOException {
if (request.getRemoteUser() != null) {
HttpSession session = request.getSession(false);
System.out.println(session.isNew());
session.invalidate();
Cookie[] cookies = request.getCookies();
for (int i = 0; i < cookies.length; i++) {
cookies.setMaxAge(0);
getServletContext().getRequestDispatcher("/j_security_check").forward(reques
t, response);
public void doGet(HttpServletRequest request, HttpServletResponseresponse)
throws ServletException, java.io.IOException {
doPost(request, response);
let's help each other to solve this problem. thanks.
Jerson
"Jerson Chua" <[email protected]> wrote:
I thought that this problem will be solved on sp6 but to my
disappointment, the problem is still there. I'm also using RDBMSRealm,same
as John.
Jerson
"Cameron Purdy" <[email protected]> wrote:
John,
1. You are using a single WL instance (i.e. not clustered) on that
NT
box
and doing so without a proxy (e.g. specifying http://localhost:7001),
correct?
2. BEA will pay more attention to the problem if you upgrade to SP6.If
you don't have a reason NOT to (e.g. a particular regression), then
you
should upgrade. That will save you one go-around with support: "Hi,I
am
on SP5 and I have a problem.", "Upgrade to SP6 to see if that fixes
it.
Call back if that doesn't work."
3. Make sure that you are not doing anything special before or after
J_SECURITY_CHECK ... make sure that you have everything configuredand
done
by the book.
4. Email BEA a bug report at [email protected] ... see what they say.
Peace,
Cameron Purdy
Tangosol, Inc.
http://www.tangosol.com
+1.617.623.5782
WebLogic Consulting Available
"John Wang" <[email protected]> wrote in message
news:[email protected]...
Cameron,
It seems to me that the problem I encountered is different a little
from
what you have, evrn though the error message is the same eventually.
Everytime I go through, I always get that error.
I am using weblogic5.1 and sp5 on NT4.0. Do you have any solutions
to
work
around this problem? If it was a BUG as you
pointed out, is there a way we can report it to the Weblogic
technical support and let them take a look?
Thnaks.
-John
"Cameron Purdy" <[email protected]> wrote:
John,
I will verify that I have seen this error now (after having read
about it
here for a few months) and it had the following characteristics:
1) It was intermittent, and appeared to be self-curing
2) It was not predictable, only seemed to occur at the first
login
attempt,
and may have been timing related
3) This was on Sun Solaris on a cluster of 2 Sparc 2xx's; the
proxy
was
Apache (Stronghold)
4) After researching the newsgroups, it appears that this "bug"
may
have gone away temporarily (?) in SP5 (although Jerson Chua
<[email protected]> mentioned that he still got it in SP5)
I was able to reproduce it most often by deleting the tmpwar and
tmp_deployments directories while the cluster was not running,
then
restarting the cluster. The first login attempt would fail(roughly
90%
of
the time?) and that server instance would then be ignored by the
proxy
for a
while (60 seconds?) -- meaning that the proxy would send all
traffic,
regardless of the number of "clients", to the other server in thecluster.
As far as I can tell, it is a bug in WebLogic, and probably has
been
there
for quite a while.
Peace,
Cameron Purdy
Tangosol, Inc.
http://www.tangosol.com
+1.617.623.5782
WebLogic Consulting Available
"John Wang" <[email protected]> wrote in message
news:[email protected]...
Hi Everyone,
The following problem related to form-based authentication
was posted one week ago and no reponse. Can someone give it
a shot? One more thing is added here. When I try it on J2EE
server and do the same thing, I didn't encounter this error
message, and I am redirected to the homeage.
Thanks.
-John
I am using weblogic5.1 and RDBMSRealm as the security realm. I
am
having
the following problem with the form-based authentication login
mechanism.
Does anyone have an idea what the problem is and how to solve it?
When I login my application and logout as normal procedure, it
is
OK.
But
if I login and use the browser's BACK button to back the login
page
and
try
to login as a new user, I got the following error message,
"Form based authentication failed. Could not find session."
When I check the LOG file, it gives me the following message,
"Form based authentication failed. One of the following reasons
could
cause it: HTTP sessions are disabled. An old session ID was stored
in
the
browser."
Normally, if you login and want to relogin without logout first,
it
supposes to direct you to the existing user session. But I don'tunderstand
why it gave me this error. I also checked my property file, it
appears
that
the HTTP sessions are enabled as follows,
weblogic.httpd.session.enable=true

Behavior in form-based authentication

Environment
- WebLogic5.1 with SP8
- WinNT 4.0 with SP5
- JDK1.2.2
When an authenticated user tries to access a resource that the user is not
authorized to access, he/she
is automatically forwarded to login page and WebLogic loses the
authentication information of that user.
Then the user has to re-login to access resources that he/she has
permissions and previously accessed.
My question is:
1. Is there any way to redirect the user who attempts to access unauthorized
resources to an error page, not the login page,
so that the user doesn't have to re-login to access authorized resources?
2. if a user tries to access an unauthrized resource, shouldn't I be
getting a 403 {sc_Forbidden} error back?
Is that correct? If so, I don't see why the following setting wouldn't work.
<error-page>
<error-code>403</error-code>
<location>/errorpages/error.jsp?errorcode=403</location>
</error-page>
<error-page>
<error-code>401</error-code>
<location>/errorpages/error.jsp?errorcode=401</location>
</error-page>
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/errorpages/error.jsp?errorcode=999</form-error-page>
</form-login-config>
</login-config>
Thanks in advance for any help or comment.
Sang

Tom,
Thanks for you comment. I appreciate it.
I've tried what you suggested but there is still a problem.
When a user is forwarded to the page specified as a login page in the xml,
the identity of the user is already lost in the container.
If you print the current user in the login.jsp by calling
"Request.getRemoteUser()", you'll get a NULL.
Although you go back to the JSP page you have already accessed, you have to
go through the authentication over again.
Is this correct authentication behavior?
The following is an abstract of form-based authentication processes from
Servlet v2.2 spec.
============================================================================
When a user attempts to access a protected web resource, the container
checks if the user has been
authenticated. If so, and dependent on the user's authority to access the
resource, the requested web
resource is activated and returned. If the user is not authenticated, all of
the following steps occur:
1. The login form associated with the security constraint is returned to the
client. The URL path
which triggered the authentication is stored by the container.
2. The client fills out the form, including the username and password
fields.
3. The form is posted back to the server.
4. The container processes the form to authenticate the user. If
authentication fails, the error page is
returned.
5. The authenticated principal is checked to see if it is in an authorized
role for accessing the origi-nal
web request.
6. The client is redirected to the original resource using the original
stored URL path.
If the user is not successfully authenticated, the error page is returned to
the client. It is
recommended that the error page contains information that allows the user to
determine that the
authorization failed.
============================================================================
Although the procedures of form based authentication is well-specified,
behavior of authorization is quite unclear.
It doesn't specify what should be done and what happens to the state of the
current identity in case of authorization failure.
Is there any workaround solution for this problem?
Thanks again.
Sang
Tom Mitchell <[email protected]> wrote in message
news:[email protected]...
Sang,
The behavior you are seeing seems to be correct. You are logged in andtry to
hit a resource that you do not have access to. So, as far as thecontainer
knows, it is supposed to give you a chance to reauthenticate as someonewho can
access the new resource.
If you have rights to both resources, you will not get prompted again.
If I understand your desired behavior, you could have login to take place
"manually" - meaning you will have an explicit login button or link.
Then could have your login page, defined in the xml, actually be an errorpage
that would not affect the current identity.
Hope this helps.
Tom Mitchell
[email protected]
Very Current Stoneham, MA Weather
http://www.tom.org
"Sang Y. Sung" wrote:
Environment
- WebLogic5.1 with SP8
- WinNT 4.0 with SP5
- JDK1.2.2
When an authenticated user tries to access a resource that the user is
not
authorized to access, he/she
is automatically forwarded to login page and WebLogic loses the
authentication information of that user.
Then the user has to re-login to access resources that he/she has
permissions and previously accessed.
My question is:
1. Is there any way to redirect the user who attempts to accessunauthorized
resources to an error page, not the login page,
so that the user doesn't have to re-login to access authorizedresources?
>>
2. if a user tries to access an unauthrized resource, shouldn't I be
getting a 403 {sc_Forbidden} error back?
Is that correct? If so, I don't see why the following setting wouldn'twork.
>>
<error-page>
<error-code>403</error-code>
<location>/errorpages/error.jsp?errorcode=403</location>
</error-page>
<error-page>
<error-code>401</error-code>
<location>/errorpages/error.jsp?errorcode=401</location>
</error-page>
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/errorpages/error.jsp?errorcode=999</form-error-page>
</form-login-config>
</login-config>
Thanks in advance for any help or comment.
Sang

Form Based Authentication in SharePoint 2013: Getting The remote server returned an error: (500) Internal Server Error

Hi
I configured forms based authentication mode in Sharepoint 2013 site. When i tried to log in with windows authentication prompt it throws the following error
The remote server returned an error: (500) Internal Server Error
[WebException: The remote server returned an error: (500) Internal Server Error.] System.Net.HttpWebRequest.GetResponse() +8548300 System.ServiceModel.Channels.HttpChannelRequest.WaitForReply(TimeSpan timeout) +111 [ProtocolException:
The content type text/html; charset=utf-8 of the response message does not match the content type of the binding (application/soap+msbin1). If using a custom encoder, be sure that the IsContentTypeSupported method is implemented properly. The first
1024 bytes of the response were: '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
How to fix this issue?
Regards,
Siva

Did you create a new web application or modify an existing web application?
I would start by checking the ULS logs, maybe there is an incorrect setting within one of the web.config files, or SQL permissions.
Also, as suggested above, check application pools are running.
This blog post is a great guide for setting up FBA, check it through to make sure you haven't missed any steps:
http://blogs.technet.com/b/ptsblog/archive/2013/09/20/configuring-sharepoint-2013-forms-based-authentication-with-sqlmembershipprovider.aspx

I have a task, that is i want to retrive the details from active directory based on name and i want show that details into grid view.

Hi All,
I have a task, that is i want to retrive the details from active directory based on name and i want show that details into grid view.
Can any one help how to start.
Thanks in advance!

Hi AnilKarthik,
You can get user details by name using DirectoryService namespace. Then you can create a DataTable to restore the information and then bind to the SharePoint GridView.
Here are some deatiled code demos for your reference:
how to get userdetails from Active Directory based on username using asp.net:
http://www.aspdotnet-suresh.com/2011/03/how-to-get-userdetails-from-active.html
How to get User Data from the Active Directory:
http://www.codeproject.com/Articles/6778/How-to-get-User-Data-from-the-Active-Directory
Using SPGridView to bound to list data in SharePoint:
http://nishantrana.me/2009/03/23/using-spgridview-to-bound-to-list-data-in-sharepoint/
Best Regards
Zhengyu Guo
TechNet Community Support

Form-based authentication stores the username/password pair in the session

Hello,
I am following the SR Demo and the authentication method followed is
Form-based authentication stores the username/password pair in the session
In the URl, the username and password is in clear text format.
What is the best way of doing the authentication. How can I eliminate the username and password being shown in the URL?
Any help is highly appreciable.
Thanks

Hi,
this is how form based authentication works according the specs. You can use SSL to protect the communication, use BASIC authentication (though not much better), certificate based auhentication or SSO
Frank

Form based authentication -- control URGENT PLS.

I am following Form based authentication. I have a login page. I have specified the security constraints in the web.xml.
I would like to know after the execution of login where will the controller go to?? will it go the controller servlet, followed by an action class??
For any typical event (such as create customer)---the following has been the flow:
controller servlet--> createAction-->createUserBD (business delegate) --> customerManagerEJB --> customerDAO;
Now in case of login..
After the execution of login (authentication is by form based authentication ) where will the controll go to?
My requirement is to store the logged in userID details in Stateful Session bean. how will the flow look like?

If the access is through a web invocation, control will go to whichever portion of the web app triggered
the security constraint. The ejb has no knowledge of the authentication. If you want to provide the
login details to the ejb you'll have to explicitly pass them from the web tier.
--ken

Performing form based authentication with entities

Hey everyone,
Im in a major dilemma.Im trying to perform form-based authentication using entities.I have created the entity class from the database,and I used a SLSB to access the bean method via JNDI(when I tried using dependency injection,there was an exception).I also cannot use hibernate as a persistent provider.I used toplink since it is the default in netbeans 5.5.1 and it did not raise any issues.But then,I noticed that toplink is most compatible with the oracle application server,and I use sun java system application server 9.1.I have not been able to successfully perform the authentication.
here's the code:note,there are still bugs as ive been going back and forth trying to find a solution and also because Ive been working with preexisting code.
model:
SLSB
* userValidationBean.java
* Created on 26 March 2008, 18:25
* To change this template, choose Tools | Template Manager
* and open the template in the editor.
package Entities;
import javax.ejb.Stateless;
import javax.ejb.Remote;
import java.util.List;
import javax.persistence.PersistenceContext;
import javax.persistence.EntityManager;
import javax.persistence.Query;
import Entities.UserTable;
import javax.transaction.UserTransaction;
import javax.annotation.Resource;
//the reason for the many comments is that im still debugging and there are still some bugs.Ive also been trying to go back and forth just
//to get a solution.
//the other accompanying classes had preexisting code i wrote earlier.
* @author Ayo
@Stateless
@Remote(userValidationRemote.class)
public class userValidationBean implements Entities.userValidationRemote {
@PersistenceContext private EntityManager manager;
@Resource private javax.transaction.UserTransaction tran;
/** Creates a new instance of userValidationBean */
public userValidationBean() {
//"SELECT u.username,u.password FROM UserTable u WHERE u.username =?1 and u.password=?2"
public boolean checkUser()
try
tran.begin();
UserTable user=new UserTable();
Query query=manager.createQuery("select u.username,u.password from u.user_table where u.username=:username and u.password=:password");
/*query.set("username",user.getUsername());
query.setParameter("password",user.getPassword());*/
query.setParameter("username",user.getUsername());
query.setParameter("password",user.getPassword());
userValidationBean ubean=(userValidationBean)query.getSingleResult();
boolean result=ubean==null?true:false;
tran.commit();
catch(Exception e)
System.out.println("Error:"+e);
// boolean result=ubean==null?true:false;
return result;
remote interface
package Entities;
import javax.ejb.Remote;
import Entities.UserTable;
* This is the business interface for userValidation enterprise bean.
@Remote
public interface userValidationRemote {
public boolean checkUser();
controller:servlet
* userCheck.java
* Created on 15 March 2008, 22:41
package servlets;
import Entities.UserTable;
import Entities.userValidationBean;
import javax.annotation.*;
import Entities.userValidationRemote;
import java.io.*;
import java.net.*;
import java.sql.*;
import javax.servlet.*;
import javax.servlet.http.*;
import javax.ejb.*;
import javax.naming.*;
import javax.persistence.*;
* @author Ayo
* @version
public class userCheck extends HttpServlet {
//@EJB userValidationRemote userRemote;
boolean checkUser;
String username,password;
/** Processes requests for both HTTP <code>GET</code> and <code>POST</code> methods.
* @param request servlet request
* @param response servlet response
protected void processRequest(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
/*con=null;
ps=null;
rs=null;
s=null;
*/response.setContentType("text/html;charset=UTF-8");
PrintWriter out = response.getWriter();
username=request.getParameter("username");
password=request.getParameter("password");
if(username==""||password=="")
//RequestDispatcher de=request.getRequestDispatcher("admin_error.jsp");
//de.forward(request,response);
//showError("<b><font color=\"red\">Invalid Login details!</font></b>",request,response);
showError("<b><font color=\"red\">Please fill in the required blanks.</font></b>",request,response);
else
try
Context ctx=new InitialContext();
userValidationRemote userRemote=(userValidationRemote)ctx.lookup("Entities.userValidationRemote");
checkUser= userRemote.checkUser();
//checkUser= userRemote.checkUser();
//return;
//checkUser(UserTable user);
catch(Exception e)
out.println("Error:"+e);
//userValidation.checkUser(UserTable user);
if(checkUser==true)
RequestDispatcher d=request.getRequestDispatcher("blah.jsp");
d.forward(request,response);
else if(checkUser==false)
// RequestDispatcher d=request.getRequestDispatcher("admin_error.jsp");
//d.forward(request,response);
showError("<b><font color=\"red\">Invalid Login details!</font></b>",request,response);
//call bean(stateless or stateful)which access method on entity that validates.
// checkUser(request,response);
/* TODO output your page here
out.println("<html>");
out.println("<head>");
out.println("<title>Servlet userCheck</title>");
out.println("</head>");
out.println("<body>");
out.println("<h1>Servlet userCheck at " + request.getContextPath () + "</h1>");
out.println("</body>");
out.println("</html>");
//out.close();
/* public synchronized void checkUser(HttpServletRequest request,HttpServletResponse response)throws ServletException,IOException
if(username==""&&password=="")
showError("<b><font color=\"red\">Please fill in the required blanks.</font></b>",request,response);
else
try
Class.forName("com.mysql.jdbc.Driver");
con=DriverManager.getConnection("jdbc:mysql://localhost:3306/Health_Management_System","root","");
ps=con.prepareStatement("select username,password from user_table where username=?and password=?");
ps.setString(1,username);
ps.setString(2,password);
rs=ps.executeQuery();
if(rs.next())
user=rs.getString(1);
pass=rs.getString(2);
//check user type,wether super admin,user or the other subadmins or a regular user.
checkType(request,response);
else
//redirect to admin error page,then close the connection.
showError("<b><font color=\"red\">Invalid Login details.</font></b>",request,response);
con.close();
catch(Exception e)
private synchronized void checkType(HttpServletRequest request,HttpServletResponse response)throws ServletException,IOException
try
Class.forName("com.mysql.jdbc.Driver");
con=DriverManager.getConnection("jdbc:mysql://localhost:3306/Health_Management_System","root","");
ps=con.prepareStatement("select user_type,user_id,access_level from user_table where username=? and password=?");
ps.setString(1,user);
ps.setString(2,pass);
rs=ps.executeQuery();
if(rs.next())
user_type=rs.getString(1);
user_id=""+rs.getInt(2);
access_level=rs.getString(3);
if(user_type.equals("super")&&(access_level.equals("all")))
//create admin user session,add to the username and the user_id.
//redirect to super admin page,with access rights to create
//health admin,insurance admin and HMO admin.
//pretty cool stuff!
HttpSession session=request.getSession(true);
session.setAttribute("user",user);
session.setAttribute("user_id",user_id);
RequestDispatcher dispatcher=request.getRequestDispatcher("admin_user_page.jsp");
dispatcher.forward(request,response);
//session.setAttribute(user_id);
//remember to create a hidden field if you need to pass this information
//to another page and retrieve the super admin id to track his activities.
else if(user_type.equals("health administrator")&&(access_level.equals("Health")))
HttpSession session=request.getSession(true);
session.setAttribute("user",user);
session.setAttribute("user_id",user_id);
RequestDispatcher des=request.getRequestDispatcher("health_admin_user_page.jsp");
des.forward(request,response);
//check for other user types,health admin,hmo admin and insurance admin.
else if(user_type.equals("hmo administrator")&&(access_level.equals("HMO")))
HttpSession session=request.getSession(true);
session.setAttribute("user",user);
session.setAttribute("user_id",user_id);
RequestDispatcher d=request.getRequestDispatcher("hmo_admin_user_page.jsp");
d.forward(request,response);
showError("<b><font color=\"red\">Invalid Login details.</font></b>",request,response);
else if(user_type.equals("insurance administrator")&&(access_level.equals("insurance")))
HttpSession session=request.getSession(true);
session.setAttribute("user",user);
session.setAttribute("user_id",user_id);
RequestDispatcher de=request.getRequestDispatcher("insurance_admin_user_page.jsp");
de.forward(request,response);
else if(user_type.equals("user")&&(access_level.equals("health")))
try
Class.forName("com.mysql.jdbc.Driver");
con=DriverManager.getConnection("jdbc:mysql:http://localhost:3306/Health_Management_System","root","");
ps=con.prepareStatement("select staff_id from user_table where username=?and password=?");
ps.setString(1,username);
ps.setString(2,password);
rs=ps.executeQuery();
if(rs.next())
String staff_id=""+rs.getInt(1);
Class.forName("com.mysql.jdbc.Driver");
con=DriverManager.getConnection("jdbc:mysql://localhost:3306/Health_Management_System","root","");
ps=con.prepareStatement("select * from health_staff_table where staff_id=?");
ps.setString(1,staff_id);
rs=ps.executeQuery();
if(rs.next())
//retrieve the values from health staff and store them in variables.
//store important variables in user sessions e.g.staff_id,username,place of work for display in the web page.
//redirect to required page.
String first_name=rs.getString("first_name");
String last_name=rs.getString("last_name");
String work_place=rs.getString("place_of_work");
HttpSession session=request.getSession(true);
session.setAttribute("first_name",first_name);
session.setAttribute("last_name",last_name);
session.setAttribute("work_place",work_place);
session.setAttribute("staff_id",staff_id);
//redirect to user page.
else
showError("<b><font color=\"red\">Invalid Login details.</font></b>",request,response);
else
showError("<b><font color=\"red\">Invalid Login details.</font></b>",request,response);
catch(Exception e)
//catch exception and redirect to page.
else if(user_type.equals("user")&&(access_level.equals("HMO")))
try
Class.forName("com.mysql.jdbc.Driver");
con=DriverManager.getConnection("jdbc:mysql:http://localhost:3306/Health_Management_System","root","");
ps=con.prepareStatement("select staff_id from user_table where username=?and password=?");
ps.setString(1,username);
ps.setString(2,password);
rs=ps.executeQuery();
if(rs.next())
String staff_id=""+rs.getInt(1);
Class.forName("com.mysql.jdbc.Driver");
con=DriverManager.getConnection("jdbc:mysql://localhost:3306/Health_Management_System","root","");
ps=con.prepareStatement("select * from hmo_staff_table where staff_id=?");
ps.setString(1,staff_id);
rs=ps.executeQuery();
if(rs.next())
//retrieve the values from HMO staff and store them in variables.
//store important variables in user sessions e.g.staff_id,username,place of work for display in the web page.
//redirect to required page.
String first_name=rs.getString("first_name");
String last_name=rs.getString("last_name");
String work_place=rs.getString("place_of_work");
HttpSession session=request.getSession(true);
session.setAttribute("first_name",first_name);
session.setAttribute("last_name",last_name);
session.setAttribute("work_place",work_place);
session.setAttribute("staff_id",staff_id);
else
showError("<b><font color=\"red\">Invalid Login details.</font></b>",request,response);
else
showError("<b><font color=\"red\">Invalid Login details.</font></b>",request,response);
catch(Exception e)
//catch exception and redirect to page.
else if(user_type.equals("user")&&(access_level.equals("insurance")))
try
Class.forName("com.mysql.jdbc.Driver");
con=DriverManager.getConnection("jdbc:mysql:http://localhost:3306/Health_Management_System","root","");
ps=con.prepareStatement("select staff_id from user_table where username=?and password=?");
ps.setString(1,username);
ps.setString(2,password);
rs=ps.executeQuery();
if(rs.next())
String staff_id=""+rs.getInt(1);
Class.forName("com.mysql.jdbc.Driver");
con=DriverManager.getConnection("jdbc:mysql://localhost:3306/Health_Management_System","root","");
ps=con.prepareStatement("select * from insurance_staff_table where staff_id=?");
ps.setString(1,staff_id);
rs=ps.executeQuery();
if(rs.next())
//retrieve the values from insurance staff and store them in variables.
//store important variables in user sessions e.g.staff_id,username,place of work for display in the web page.
//redirect to required page.
String first_name=rs.getString("first_name");
String last_name=rs.getString("last_name");
String work_place=rs.getString("place_of_work");
HttpSession session=request.getSession(true);
session.setAttribute("first_name",first_name);
session.setAttribute("last_name",last_name);
session.setAttribute("work_place",work_place);
session.setAttribute("staff_id",staff_id);
else
showError("<b><font color=\"red\">Invalid Login details.</font></b>",request,response);
else
showError("<b><font color=\"red\">Invalid Login details.</font></b>",request,response);
catch(Exception e)
//catch exception and redirect to page.
else
//invalid login details.After all else fails.
showError("<b><font color=\"red\">Invalid Login details.</font></b>",request,response);
catch(Exception e)
private void showError(String errorMsg,HttpServletRequest request,HttpServletResponse response)throws ServletException,IOException
request.setAttribute("error_msg",errorMsg);
RequestDispatcher dispatcher=request.getRequestDispatcher("admin_error.jsp");
dispatcher.forward(request,response);
// <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code.">
/** Handles the HTTP <code>GET</code> method.
* @param request servlet request
* @param response servlet response
protected void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
/** Handles the HTTP <code>POST</code> method.
* @param request servlet request
* @param response servlet response
protected void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
/** Returns a short description of the servlet.
public String getServletInfo() {
return "Short description";
// </editor-fold>
view
<%@ page contentType="text/html; charset=utf-8" language="java" import="java.sql.*" errorPage="" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Login</title>
<style type="text/css">

</style>
</head>
<body>
<table width="564" border="0" align="center">
<tr>
<td width="558" bgcolor="#CCCCCC" class="style1"><div align="center">
<p> </p>
<h1 class="style7">Welcome to HealthPort</h1>
<p>HealthPort Login</p>
<p><span class="style8">Today's date is:<%= new java.util.Date() %></span></p>
<form id="form1" name="form1" method="post" action="userCheck">
<p align="right" class="style3">Username
<label></label>
<input type="text" name="username" id="username" />
</p>
<p align="right" class="style3">Password
<input type="password" name="password" id="password" />
</p>
<p align="right" class="style3">
<span class="style6">
<label></label>
<label></label>
</span>
<span class="style5">
<label></label>
</span>
<label>
<input type="submit" name="button" id="button" value="Login" />
</label>
</p>
<div align="right">
</div></form>
<div align="right"><div align="left"><p align="right"> </p>
</div></div></div></td>
</tr>
<tr>
<td bgcolor="#CCCCCC" class="style1"> </td>
</tr>
</table>
</body>
</html>
so,that's about it.I'd appreciate it.I know this is a lot.I'm grateful
Ayo.

Hi.Im still having issues trying to perform form based authenticatin with entities.I tried this method but im getting errors on the marked lines.
controller servlet
* userCheck.java
* Created on 15 March 2008, 22:41
package servlets;
import Entities.UserTable;
import Entities.userValidationBean;
import javax.annotation.*;
import Entities.userValidationRemote;
import java.io.*;
import java.net.*;
import java.sql.*;
import javax.servlet.*;
import javax.servlet.http.*;
import javax.ejb.*;
import javax.naming.*;
import javax.persistence.*;
* @author Ayo
* @version
public class userCheck extends HttpServlet {
//@EJB userValidationRemote userRemote;
boolean checkUser;
String username,password;
/** Processes requests for both HTTP <code>GET</code> and <code>POST</code> methods.
* @param request servlet request
* @param response servlet response
protected void processRequest(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
/*con=null;
ps=null;
rs=null;
s=null;
*/response.setContentType("text/html;charset=UTF-8");
PrintWriter out = response.getWriter();
username=request.getParameter("username");
password=request.getParameter("password");
if(username==""||password=="")
showError("<b><font color=\"red\">Please fill in the required blanks.</font></b>",request,response);
else
try
Context ctx=new InitialContext();
userValidationRemote userRemote=(userValidationRemote)ctx.lookup("Entities.userValidationRemote");
(error on this line-saying ')' expected and no matter if i add ) there is still erro)userRemote.authenticate(String p_user,String p_password);
catch(Exception e)
out.println("Error:"+e);
if(checkUser==true)
RequestDispatcher d=request.getRequestDispatcher("blah.jsp");
d.forward(request,response);
else if(checkUser==false)
showError("<b><font color=\"red\">Invalid Login details!</font></b>",request,response);
private void showError(String errorMsg,HttpServletRequest request,HttpServletResponse response)throws ServletException,IOException
request.setAttribute("error_msg",errorMsg);
RequestDispatcher dispatcher=request.getRequestDispatcher("admin_error.jsp");
dispatcher.forward(request,response);
// <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code.">
/** Handles the HTTP <code>GET</code> method.
* @param request servlet request
* @param response servlet response
protected void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
/** Handles the HTTP <code>POST</code> method.
* @param request servlet request
* @param response servlet response
protected void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
/** Returns a short description of the servlet.
public String getServletInfo() {
return "Short description";
// </editor-fold>
view
<%@ page contentType="text/html; charset=utf-8" language="java" import="java.sql.*" errorPage="" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Login</title>
<style type="text/css">

</style>
</head>
<body>
<table width="564" border="0" align="center">
<tr>
<td width="558" bgcolor="#9DACBF" class="style1"><div align="center">
<p> </p>
<h1 class="style7">Welcome to HealthPort</h1>
<p>HealthPort Login</p>
<p><span class="style8">Today's date is:<%= new java.util.Date() %></span></p>
<form id="form1" name="form1" method="post" action="userCheck">
<p align="right" class="style3">Username
<label></label>
<input type="text" name="username" id="username" />
</p>
<p align="right" class="style3">Password
<input type="password" name="password" id="password" />
</p>
<p align="right" class="style3">
<span class="style6">
<label></label>
<label></label>
</span>
<span class="style5">
<label></label>
</span>
<label>
<input type="submit" name="button" id="button" value="Login" />
</label>
</p>
<div align="right">
</div></form>
<div align="right"><div align="left"><p align="right"> </p>
</div></div></div></td>
</tr>
<tr>
<td bgcolor="#CCCCCC" class="style1"> </td>
</tr>
</table>
</body>
</html>
SLSB (implements userValidationRemote)
* userValidationBean.java
* Created on 26 March 2008, 18:25
* To change this template, choose Tools | Template Manager
* and open the template in the editor.
package Entities;
import javax.ejb.Stateless;
import javax.ejb.Remote;
import javax.persistence.PersistenceContext;
import javax.persistence.EntityManager;
import javax.persistence.Query;
import Entities.UserTable;
import javax.annotation.*;
//import javax.transaction.UserTransaction;
* @author Ayo
@Stateless(mappedName="ejb/facade/userValidationBean")
@Remote(userValidationRemote.class)
(error on this line saying can't find class TransactionManagement)@TransactionManagement(value=TransactionManagementType.CONTAINER)
public class userValidationBean implements Entities.userValidationRemote {
@PersistenceContext(unitName="HealthInsuranceApp-ejbPU") private EntityManager manager;
/** Creates a new instance of userValidationBean */
public userValidationBean() {
//"SELECT u.username,u.password FROM UserTable u WHERE u.username =?1 and u.password=?2"
public boolean authenticate(String p_user,String p_password)
UserTable m_user=manager.find(UserTable.class,p_user);
if(m_user!=null)
return m_user.getPassword().equals(p_password);
return false;
Entity
* UserTable.java
* Created on 29 March 2008, 13:24
* To change this template, choose Tools | Template Manager
* and open the template in the editor.
package Entities;
import java.io.Serializable;
import javax.persistence.Column;
import javax.persistence.Entity;
import javax.persistence.Id;
import javax.persistence.Table;
* Entity class UserTable
* @author Ayo
@Entity(name="qs_UserPwd")
@Table(name = "user_table")
public class UserTable implements Serializable {
@Id
@Column(name = "user_id", nullable = false)
private Integer userId;
@Column(name = "username")
private String username;
@Column(name = "password")
private String password;
@Column(name = "user_type")
private String userType;
@Column(name = "access_level")
private String accessLevel;
@Column(name = "staff_id")
private Integer staffId;
@Column(name = "staff_type", nullable = false)
private String staffType;
@Column(name = "time_created")
private String timeCreated;
@Column(name = "time_modified")
private String timeModified;
@Column(name = "time_logged_in")
private String timeLoggedIn;
@Column(name = "time_logged_out")
private String timeLoggedOut;
@Column(name = "created_by")
private String createdBy;
/** Creates a new instance of UserTable */
public UserTable() {
* Creates a new instance of UserTable with the specified values.
* @param userId the userId of the UserTable
public UserTable(Integer userId) {
this.userId = userId;
* Creates a new instance of UserTable with the specified values.
* @param userId the userId of the UserTable
* @param staffType the staffType of the UserTable
public UserTable(Integer userId, String staffType) {
this.userId = userId;
this.staffType = staffType;
public UserTable(String p_user,String p_password)
setUsername(p_user);
setPassword(p_password);
* Gets the userId of this UserTable.
* @return the userId
public Integer getUserId() {
return this.userId;
* Sets the userId of this UserTable to the specified value.
* @param userId the new userId
public void setUserId(Integer userId) {
this.userId = userId;
* Gets the username of this UserTable.
* @return the username
public String getUsername() {
return this.username;
* Sets the username of this UserTable to the specified value.
* @param username the new username
public void setUsername(String p_user) {
p_user = username;
* Gets the password of this UserTable.
* @return the password
public String getPassword() {
return this.password;
* Sets the password of this UserTable to the specified value.
* @param password the new password
public void setPassword(String p_password) {
p_password=password;
* Gets the userType of this UserTable.
* @return the userType
public String getUserType() {
return this.userType;
* Sets the userType of this UserTable to the specified value.
* @param userType the new userType
public void setUserType(String userType) {
this.userType = userType;
* Gets the accessLevel of this UserTable.
* @return the accessLevel
public String getAccessLevel() {
return this.accessLevel;
* Sets the accessLevel of this UserTable to the specified value.
* @param accessLevel the new accessLevel
public void setAccessLevel(String accessLevel) {
this.accessLevel = accessLevel;
* Gets the staffId of this UserTable.
* @return the staffId
public Integer getStaffId() {
return this.staffId;
* Sets the staffId of this UserTable to the specified value.
* @param staffId the new staffId
public void setStaffId(Integer staffId) {
this.staffId = staffId;
* Gets the staffType of this UserTable.
* @return the staffType
public String getStaffType() {
return this.staffType;
* Sets the staffType of this UserTable to the specified value.
* @param staffType the new staffType
public void setStaffType(String staffType) {
this.staffType = staffType;
* Gets the timeCreated of this UserTable.
* @return the timeCreated
public String getTimeCreated() {
return this.timeCreated;
* Sets the timeCreated of this UserTable to the specified value.
* @param timeCreated the new timeCreated
public void setTimeCreated(String timeCreated) {
this.timeCreated = timeCreated;
* Gets the timeModified of this UserTable.
* @return the timeModified
public String getTimeModified() {
return this.timeModified;
* Sets the timeModified of this UserTable to the specified value.
* @param timeModified the new timeModified
public void setTimeModified(String timeModified) {
this.timeModified = timeModified;
* Gets the timeLoggedIn of this UserTable.
* @return the timeLoggedIn
public String getTimeLoggedIn() {
return this.timeLoggedIn;
* Sets the timeLoggedIn of this UserTable to the specified value.
* @param timeLoggedIn the new timeLoggedIn
public void setTimeLoggedIn(String timeLoggedIn) {
this.timeLoggedIn = timeLoggedIn;
* Gets the timeLoggedOut of this UserTable.
* @return the timeLoggedOut
public String getTimeLoggedOut() {
return this.timeLoggedOut;
* Sets the timeLoggedOut of this UserTable to the specified value.
* @param timeLoggedOut the new timeLoggedOut
public void setTimeLoggedOut(String timeLoggedOut) {
this.timeLoggedOut = timeLoggedOut;
* Gets the createdBy of this UserTable.
* @return the createdBy
public String getCreatedBy() {
return this.createdBy;
* Sets the createdBy of this UserTable to the specified value.
* @param createdBy the new createdBy
public void setCreatedBy(String createdBy) {
this.createdBy = createdBy;
* Returns a hash code value for the object. This implementation computes
* a hash code value based on the id fields in this object.
* @return a hash code value for this object.
@Override
public int hashCode() {
int hash = 0;
hash += (this.userId != null ? this.userId.hashCode() : 0);
return hash;
* Determines whether another object is equal to this UserTable. The result is
* <code>true</code> if and only if the argument is not null and is a UserTable object that
* has the same id field values as this object.
* @param object the reference object with which to compare
* @return <code>true</code> if this object is the same as the argument;
* <code>false</code> otherwise.
@Override
public boolean equals(Object object) {
// TODO: Warning - this method won't work in the case the id fields are not set
if (!(object instanceof UserTable)) {
return false;
UserTable other = (UserTable)object;
if (this.userId != other.userId && (this.userId == null || !this.userId.equals(other.userId))) return false;
return true;
* Returns a string representation of the object. This implementation constructs
* that representation based on the id fields.
* @return a string representation of the object.
@Override
public String toString() {
return "Entities.UserTable[userId=" + userId + "]";
please what do I do? or is there a better way? seems like my appserver(sun java system app server 9.1)doesnt support dependency injection as
there's always an exception in the server log when i try it.i use the default transaction provider toplink because use of any of the others raises an exception and my application index page never shows. please i need help? I want to be able to succesfully perform this authentication as its the only way i can move to the next level
Ayo.

Webgate : problem in Form based authentication

I have configured a WebGate to protect an web application hosted on Sun WebServer 6.1.
It works fine, If I use the basic authentication mechanism. If I access the application, it challenges me uid/pwd thru a small pop up window; after successful authentication I am redirected to the requested application.
However, the same does not work for Form based authentication. The webgate plugin doe not look like picking the userid/ pwd field from the login.html. Also it redirect to the mentioned action "/access/dummy" in the html.
My login.html for looks like this :
<html>
<form name="myloginform" action="/access/dummy" method="post">
     UserID <input type="text" name="userid" size="20">
     Password <input type="password" name="password" size="20">
     <input type="submit" name="submit" value="Login">
</form>
</html>
Pls help me out, I have spent several hours debugging this. surprisingly, I have a different machine with exactly same set up works fine.
Thanks

Hi Eric,
It may be a problem in your web.xml, I missed the "/" slash character
in the web.xml's in <form-login-page> element. So your web.xml
must look like

Cannot create dataset from claims based authentication sharepoint site in report builder 3.0

I have a sharepoint site, which is configured as claims based authentication (ref:
http://ashrafhossain.wordpress.com/2011/05/25/how-to-configure-claim-based-authentication-for-sharepoint-project-server-2010/) . both AD and asp.net members can log in to the site successfully. My user need to use the report build to create report
on this sharepoint site. As a result, the site is also integrated with reporting service. I try to create a report in the sharepoint site by clicking "New Document" -> "Report builder Report". The report builder will comes out and ask for credential to
connect to the report server. I use asp.net member to login and it can let me to create a data source which connect to a the list of the sharepoint site with credential option "Use current Windows user. Kerberos delegation might be required". However, when
I try to create a data set and click the query designer, error "Server was unable to process request. ---> Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))" appear as below:
Besides, non of my AD account can be used to login to the report builder. Errors below found in the ULS log:
09/26/2012 14:47:27.75 w3wp.exe (0x116C)
0x11F4 SharePoint Foundation
Claims Authentication fo1t
Monitorable SPSecurityTokenService.Issue() failed: System.ServiceModel.FaultException`1[Microsoft.IdentityModel.Tokens.FailedAuthenticationException]: The security token username and password could not be validated.
(Fault Detail is equal to Microsoft.IdentityModel.Tokens.FailedAuthenticationException: The security token username and password could not be validated.).
09/26/2012 14:47:27.76 w3wp.exe (0x140C)
0x0F38 SharePoint Foundation
Claims Authentication fsq7
High Request for security token failed with exception: System.ServiceModel.FaultException: The security token username and password could not be validated. at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.ReadResponse(Message
response) at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.Issue(RequestSecurityToken rst, RequestSecurityTokenResponse& rstr) at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.Issue(RequestSecurityToken
rst) at Microsoft.SharePoint.SPSecurityContext.SecurityTokenForContext(Uri context, Boolean bearerToken, SecurityToken onBehalfOf, SecurityToken actAs, SecurityToken delegateTo)
524a2f96-f5ff-4c96-80d1-f08d3c7ef14f
09/26/2012 14:47:27.76 w3wp.exe (0x140C)
0x0F38 SharePoint Foundation
Claims Authentication 8306
Critical An exception occurred when trying to issue security token: The security token username and password could not be validated..
524a2f96-f5ff-4c96-80d1-f08d3c7ef14f

Hi Foxvito,
Claims authentication types supported by SharePoint 2010 are Windows Claims, forms-based authentication Claims, and SAML Claims. In SAML-Claims mode, SharePoint Server accepts SAML tokens from a trusted external Security Token Provider (TST). From the
blog you referenced, it seems to use the SAML Claims authentication.
However, the Reporting Services client applications: Report Builder, the Report Designer in Business Intelligence Development Studio, and Management Studio do not support connecting and authenticating with LiveID or SAML Claims based SharePoint Web applications.
That's because the SAML Claims don't use the Reporting Services authentication endpoint. So, you have to change the Claims authentication type to use Report Builder on the SharePoint site.
References:
Overview of Kerberos authentication for Microsoft SharePoint 2010 Products
Claims Authentication and Reporting Services
Regards,
Mike Yin
Mike Yin
TechNet Community Support

Forcing specific clients or groups to use forms based authentication (FBA) instead of windows based authentication (WIA) with ADFS

Hi,
We are have a quite specific issue. The problem is most likely by design in ADFS 3.0 (running on Windows Server 2012 R2) and we are trying to find a "work-around".
Most users in the organization is using their own personal computer and everything is fine and working as expected, single sign-on (WIA) internally to Office 365 and forms based (FBA) externally (using Citrix NetScaler as reverse proxy and load
balancing with the correct rewrites to add client-ip, proxy header and URL-transformation).
The problem occurs for a few (50-100) users where they are sharing the same computer, automatically logged on to the computer using a generic AD-user (same for all of them). This AD-user they are logged on with does not have any access to Office365
and if they try to access SharePoint Online they receive an error that they can't login (from SharePoint Online, not ADFS).
We can't change this, they need to have this generic account logged on to these computers. The issue occurs when a user that has access to SharePoint Online tries to access it when logged on with a generic account.
They are not able to "switch" from the generic account in ADFS / SharePoint Online to their personal account.
The only way I've found that may work is removing IE as a WIA-capable agent and deploy a User-Agent version string specific to most users but not the generic account.
My question to you: Is there another way? Maybe when ADFS sees the generic user, it forces forms based authentication or something like that?
Best regards,
Simon

I'd go with your original workaround using the user-agent and publishing a GPO for your normal users that elects to use a user-agent string associated with Integrated Windows Auth.. for the generic accounts, I'd look at using a loopback policy that overwrites
that user agent setting, so that forms logon is preferred for that subset of users. I don't think the Netscaler here is useful in this capacity as it's a front-end proxy and you need to evaluate the AuthZ rules on the AD FS server after the request has been
proxied. The error pages in Windows Server 2012 R2 are canned as the previous poster mentioned and difficult to customize (Javascript only)...
http://blog.auth360.net

J_security_check in form-based authentication - not checking for blank passwords

I am using the LDAP Security Realm to authenticate against an iPlanet
Directory Server. All works as expected when a user-id and password
are entered for form-based authentication.
However, when a userid is entered but no password, j_security_check
logs the user in successfully. Aparently, this is correct LDAP
behaviour as anonymous login to the LDAP server is permitted. It seems
that the j_security_check servlet should check for blank passwords
before trying to authenticate against the LDAP server and fail
authentication if this is the case.
Has anyone else experienced this problem?

Hi Brian,
I do not believe it is j_security_check's job to check for blank
passwords.
In many security realms, it is "legal" for a user to have a blank
password. j_security_check forwards whatever password was entered so that
even users with blank passwords can be authenticated by the realm on the
backend. For this reason I believe that j_security_check is "doing the
right thing" by just forwarding whatever is presented to it, rather than
having its own logic. It is best if j_security_check just acts as a very
dumb middle man.
If behavior was altered, it is true that your particular problem would be
solved, but then many other people would have a problem with their users
with blank passwords authenticating properly...
Try looking into how to disable anonymous logins on the LDAP end of
things. Hope this helps.
Cheers,
Joe Jerry
brian wrote:
I am using the LDAP Security Realm to authenticate against an iPlanet
Directory Server. All works as expected when a user-id and password
are entered for form-based authentication.
However, when a userid is entered but no password, j_security_check
logs the user in successfully. Aparently, this is correct LDAP
behaviour as anonymous login to the LDAP server is permitted. It seems
that the j_security_check servlet should check for blank passwords
before trying to authenticate against the LDAP server and fail
authentication if this is the case.
Has anyone else experienced this problem?

Big problem :anything is accepted by form-based authentication on Jboss

Hi there
I'm new to form-based authentication. I've been stuck on this problem for one and a half day. I set up the form-based authentication(with JDBC realm) on JBoss 3.2/Tomcat 5.0. When I visit the protected area, it did ask me for password. But it accepts whatever I input and forwards the desired page, even when I input nothing and just click on submit, it allows me to go through. No error message at all. I am in desperate need for help.
Here is my configuration. The web.xml is like this
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
<display-name>LoginTest</display-name>
<security-constraint>
<display-name>Example Security Constraint</display-name>
<web-resource-collection>
<web-resource-name>Protected Area</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>DELETE</http-method>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>manager</role-name>
</auth-constraint>
<user-data-constraint><transport-guarantee>NONE</transport-guarantee></user-data-constraint>
</security-constraint>

<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/error.jsp</form-error-page>
</form-login-config>
</login-config>
<security-role>
<description>Manager security role</description>
<role-name>manager</role-name>
</security-role>
</web-app>
I also add the following JDBC realm definition into the server.xml which is under jboss/server/default/deploy/jbossweb-tomcat50.sar
<Realm
className="org.apache.catalina.realm.JDBCRealm" debug="1"
driverName="org.gjt.mm.mysql.Driver"
connectionURL="jdbc:mysql://myipdadress:3306/field_bak"
connectionName="plankton"
connectionPassword="plankton"
userTable="users"
userNameCol="user_name"
userCredCol="user_pass"
userRoleTable="user_roles"
roleNameCol="role_name"
/>
The JDBC realm is enclosed by the <engine> element. I checked the server log file, when the jboss server is started, it does load the mysql driver correctly and connect to mysql database fine. If I changed the IP of the mysql server to a non-existing one, then when I start jboss server, the server boot process will complain about connection to mysql faiure.
I guess maybe the server doesn't do the authentication by connecting to mysql and verify it when I submit the log in form. It seems the JDBC realm authentication is bypassed. I notice that even I get rid of the JDBC realm definition from the server.xml file, and test the web application. It behaves exactly the same way. It asks me for password but anything will go through even nothing.
Can anybody help me about this? I'm really stuck on this.
Thanks a lot!

By the way, I did create database"field_bak" and the tables for the JDBC realm verification.
I also created the users and the roles.
But it seems like Tomcat container doesn't do the JDBC realm authentication.

How to get username from Form-based login

I am using form-based login in my web.xml file.
When I attempt to access a protected .jsp page, I get sent to my login page as expected.
When I enter my username/password successfully it forwards me to the .jsp page I was trying to go to, as expected.
From that .jsp page, how do I get the username/password info from the login form? I looked at the session attributes, request attributes, and request parameters, but I don't see anything. Does the form-based authentication remove these variables?
I need the username that is filled out in the login form, so that I can do custom work with it. I cannot ask the user for it again after they login, as that is inefficient and sloppy.

Found it.
request.getUserPrincipal().getName()

Retriving the userid from FORM based authentication

Similar Messages

Maybe you are looking for