Weblogic.security.auth.login.UsernamePasswordLoginModule only accepts uid=weblogic & pw=weblogic (Why?)
I am playing (learning) with weblogic.security.auth.login.UsernamePasswordLoginModule
as a LoginModule using JAAS based authentication. Surprisingly, the only userid
and password combination acceptable is uid=weblogic, pw=weblogic combination.
I went through and looked at the example code under
http://e-docs.bea.com/wls/docs70/security/cli_apps.html#1042212. I found that
the UsernamePasswordLoginModule.login calls into
if (url != null) {
Environment env = new Environment();
env.setProviderUrl(url);
env.setSecurityPrincipal(username);
env.setSecurityCredentials(password);
try {
Authenticate.authenticate(env, subject);
Seems like UsernamePasswordLoginModule only is a router, as it instantiates an
instance of Environemt using the userid and password and passes this Environemtn
instance (env) to Authenticate.authenticate along with the empty Subject instance.
I read about that the Subject instance will be filled in with Principals by the
WL Server.
My question is that firstly,
1. As Authenticate.authenticate is not passed in the uid and pw, will it pick
those from the env?
2. Secondly, why does it only accept uid=weblogic & pw=weblogic.
I will appreciate if some one can put me in the right direction.
Khalid R. Rizvi
508-641-1192
[email protected]
Hi,
The authenticate method would take the user and the password details from the environment
(env) that is passed and after successful authentication would populate the subject with
the principals (i.e user, group the user belongs to ..)
It should work with any user that is defined in the WLS not just weblogic/weblogic.
Do you have any other users defined and which group do they belong to?
Vimala
Khalid Rizvi wrote:
I am playing (learning) with weblogic.security.auth.login.UsernamePasswordLoginModule
as a LoginModule using JAAS based authentication. Surprisingly, the only userid
and password combination acceptable is uid=weblogic, pw=weblogic combination.
I went through and looked at the example code under
http://e-docs.bea.com/wls/docs70/security/cli_apps.html#1042212. I found that
the UsernamePasswordLoginModule.login calls into
if (url != null) {
Environment env = new Environment();
env.setProviderUrl(url);
env.setSecurityPrincipal(username);
env.setSecurityCredentials(password);
try {
Authenticate.authenticate(env, subject);
Seems like UsernamePasswordLoginModule only is a router, as it instantiates an
instance of Environemt using the userid and password and passes this Environemtn
instance (env) to Authenticate.authenticate along with the empty Subject instance.
I read about that the Subject instance will be filled in with Principals by the
WL Server.
My question is that firstly,
1. As Authenticate.authenticate is not passed in the uid and pw, will it pick
those from the env?
2. Secondly, why does it only accept uid=weblogic & pw=weblogic.
I will appreciate if some one can put me in the right direction.
Khalid R. Rizvi
508-641-1192
[email protected]
Similar Messages
-
Heap Problem with weblogic.security.auth.login.PasswordCredential
Hello,
I am calling EJB's from a Tomcat 6.0.20. The EJB's are contained on a Weblogic 10 mp2. For getting EJBHome, I'm using the following InitialContext-Call:
EJBHome home = null;
try
Properties initialContextProperties = new Properties();
initialContextProps.put(InitialContext.INITIAL_CONTEXT_FACTORY, initialContextFactory);
initialContextProps.put(InitialContext.SECURITY_PRINCIPAL, username);
initialContextProps.put(InitialContext.SECURITY_CREDENTIALS, password);
initialContextProps.put(InitialContext.PROVIDER_URL, url);
initialContext = new InitialContext(initialContextProps);
Object objref = this.initialContext.lookup(jndiHomeName);
home = (EJBHome) PortableRemoteObject.narrow(objref, narrowClass);
finally
if ( initialContext != null )
try
initialContext.close();
catch(Throwable t)
return home;
The Problem is, that after a bulk test on the tomcat (Xmx=256MB), 200MB are filled with 1.500.000 instances of the following class:
weblogic.security.auth.login.PasswordCredential
Has somebody an idea how to remove these classes from tomcat heap, because now the result is an OutOfMemory?
Best regards,
sebbayHi,
The authenticate method would take the user and the password details from the environment
(env) that is passed and after successful authentication would populate the subject with
the principals (i.e user, group the user belongs to ..)
It should work with any user that is defined in the WLS not just weblogic/weblogic.
Do you have any other users defined and which group do they belong to?
Vimala
Khalid Rizvi wrote:
I am playing (learning) with weblogic.security.auth.login.UsernamePasswordLoginModule
as a LoginModule using JAAS based authentication. Surprisingly, the only userid
and password combination acceptable is uid=weblogic, pw=weblogic combination.
I went through and looked at the example code under
http://e-docs.bea.com/wls/docs70/security/cli_apps.html#1042212. I found that
the UsernamePasswordLoginModule.login calls into
if (url != null) {
Environment env = new Environment();
env.setProviderUrl(url);
env.setSecurityPrincipal(username);
env.setSecurityCredentials(password);
try {
Authenticate.authenticate(env, subject);
Seems like UsernamePasswordLoginModule only is a router, as it instantiates an
instance of Environemt using the userid and password and passes this Environemtn
instance (env) to Authenticate.authenticate along with the empty Subject instance.
I read about that the Subject instance will be filled in with Principals by the
WL Server.
My question is that firstly,
1. As Authenticate.authenticate is not passed in the uid and pw, will it pick
those from the env?
2. Secondly, why does it only accept uid=weblogic & pw=weblogic.
I will appreciate if some one can put me in the right direction.
Khalid R. Rizvi
508-641-1192
[email protected] -
Hi All,
I have an critical ssue to be solved on Production environemt :(,
we have oim installed on cluster in production(OIM11g installed on server ), the configuration is as mentioned below
cluster 1--oim1,soa1--server1--holds admin server
cluster 2--oim2,soa2--server2--managed server and no admin server
This instance was working fine, we had to restart the server machine for some reason and i am not able to start OIM server :( after that.
following is the exception i get when i start the OIM server , Please help :(
2011-05-13T13:42:29.585+05:30] [wls_oim1] [NOTIFICATION] [] [oracle.adf.share.weblogic.listeners.ADFApplicationLifecycleListener] [tid: [ACTIVE].ExecuteThread: '6' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 0000IzcQVWHFo2w6wFNa6G1DhbE300075k,0] [APP: oim#11.1.1.3.0] ADFApplicationLifecycleListener.preStop. Cleaning up Application caches.
[2011-05-13T13:42:29.585+05:30] [wls_oim1] [NOTIFICATION] [] [oracle.adf.share.config.ADFConfigFactory] [tid: [ACTIVE].ExecuteThread: '6' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 0000IzcQVWHFo2w6wFNa6G1DhbE300075k,0] [APP: oim#11.1.1.3.0] Clean up Application Caches
[2011-05-13T13:42:29.585+05:30] [wls_oim1] [NOTIFICATION] [] [oracle.adf.share.config.ADFConfigFactory] [tid: [ACTIVE].ExecuteThread: '6' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 0000IzcQVWHFo2w6wFNa6G1DhbE300075k,0] [APP: oim#11.1.1.3.0] ADFConfigFactory.cleanUpApplicationCaches. Calling ADF Config instance implementation: class oracle.adf.share.config.MDSConfigImpl.releaseResources()
[2011-05-13T13:42:29.600+05:30] [wls_oim1] [NOTIFICATION] [] [oracle.adf.share.config.ADFConfigFactory] [tid: [ACTIVE].ExecuteThread: '6' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 0000IzcQVWHFo2w6wFNa6G1DhbE300075k,0] [APP: oim#11.1.1.3.0] ADFConfigFactory.cleanUpApplicationCaches. Calling ADF Config instance implementation: class oracle.adf.share.config.MDSConfigImpl.releaseResources()
[2011-05-13T13:42:29.600+05:30] [wls_oim1] [NOTIFICATION] [] [oracle.adf.share.config.ADFConfigFactory] [tid: [ACTIVE].ExecuteThread: '6' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 0000IzcQVWHFo2w6wFNa6G1DhbE300075k,0] [APP: oim#11.1.1.3.0] ADFConfigFactory.cleanUpApplicationCaches. Calling ADF Config instance implementation: class oracle.adf.share.config.MDSConfigImpl.releaseResources()
[2011-05-13T13:42:29.600+05:30] [wls_oim1] [NOTIFICATION] [] [oracle.adf.share.config.ADFConfigFactory] [tid: [ACTIVE].ExecuteThread: '6' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 0000IzcQVWHFo2w6wFNa6G1DhbE300075k,0] [APP: oim#11.1.1.3.0] ADFConfigFactory.cleanUpApplicationCaches. Calling ADF Config instance implementation: class oracle.adf.share.config.MDSConfigImpl.releaseResources()
[*2011-05-13T13:42:30.193+05:30] [wls_oim1] [ERROR] [] [OIM Authenticator] [tid: [ACTIVE].ExecuteThread: '6' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 0000IzcQVWHFo2w6wFNa6G1DhbE300075k,0] [APP: oim#11.1.1.3.0] Error while retrieving user xelsysadm*
*[2011-05-13T13:42:30.224+05:30] [wls_oim1] [ERROR] [IAM-0020011] [oracle.iam.platform.auth.client] [tid: [ACTIVE].ExecuteThread: '6' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 0000IzcQVWHFo2w6wFNa6G1DhbE300075k,0] [APP: oim#11.1.1.3.0] Login Exception encountered when trying to login as admin {0}[[*
*javax.security.auth.login.LoginException: javax.security.auth.login.LoginException: java.lang.SecurityException: [Security:090304]Authentication Failed: User xelsysadm javax.security.auth.login.FailedLoginException: [Security:090302]Authentication Failed: User xelsysadm denied*
at weblogic.security.auth.login.UsernamePasswordLoginModule.login(UsernamePasswordLoginModule.java:199)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
at javax.security.auth.login.LoginContext$4.run(LoginContext.java:684)
at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
at Thor.API.Security.LoginHandler.weblogicLoginHandler.login(weblogicLoginHandler.java:62)
at oracle.iam.platform.OIMClient.login(OIMClient.java:134)
at oracle.iam.platform.OIMClient.login(OIMClient.java:114)
at oracle.iam.platform.OIMInternalClient.loginAsAdmin(OIMInternalClient.java:69)
at oracle.iam.scheduler.impl.util.SchedulerUtil.getSchedulerService(SchedulerUtil.java:735)
at oracle.iam.scheduler.webapp.SchedulerStartupServlet.resetRunningJobStatus(SchedulerStartupServlet.java:247)
at oracle.iam.scheduler.webapp.SchedulerStartupServlet.stopScheduler(SchedulerStartupServlet.java:123)
at oracle.iam.scheduler.webapp.SchedulerStartupServlet.destroy(SchedulerStartupServlet.java:261)
at weblogic.servlet.internal.StubSecurityHelper$ServletDestroyAction.run(StubSecurityHelper.java:303)
at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:121)
at weblogic.servlet.internal.StubSecurityHelper.destroyServlet(StubSecurityHelper.java:81)
at weblogic.servlet.internal.StubLifecycleHelper.destroyOneInstance(StubLifecycleHelper.java:144)
at weblogic.servlet.internal.StubLifecycleHelper.destroy(StubLifecycleHelper.java:134)
at weblogic.servlet.internal.ServletStubImpl.destroy(ServletStubImpl.java:438)
at weblogic.servlet.internal.WebAppServletContext.destroyServlets(WebAppServletContext.java:3232)
at weblogic.servlet.internal.WebAppServletContext.destroy(WebAppServletContext.java:3192)
at weblogic.servlet.internal.ServletContextManager.destroyContext(ServletContextManager.java:241)
at weblogic.servlet.internal.HttpServer.unloadWebApp(HttpServer.java:461)
at weblogic.servlet.internal.WebAppModule.destroyContexts(WebAppModule.java:1540)
at weblogic.servlet.internal.WebAppModule.deactivate(WebAppModule.java:513)
at weblogic.application.internal.flow.ModuleStateDriver$2.previous(ModuleStateDriver.java:389)
at weblogic.application.utils.StateMachineDriver.previousState(StateMachineDriver.java:167)
at weblogic.application.utils.StateMachineDriver.previousState(StateMachineDriver.java:160)
at weblogic.application.internal.flow.ModuleStateDriver.deactivate(ModuleStateDriver.java:141)
at weblogic.application.internal.flow.ScopedModuleDriver.deactivate(ScopedModuleDriver.java:207)
at weblogic.application.internal.flow.ModuleListenerInvoker.deactivate(ModuleListenerInvoker.java:261)
at weblogic.application.internal.flow.DeploymentCallbackFlow$2.previous(DeploymentCallbackFlow.java:538)
at weblogic.application.utils.StateMachineDriver.previousState(StateMachineDriver.java:167)
at weblogic.application.utils.StateMachineDriver.previousState(StateMachineDriver.java:160)
at weblogic.application.internal.flow.DeploymentCallbackFlow.deactivate(DeploymentCallbackFlow.java:182)
at weblogic.application.internal.flow.DeploymentCallbackFlow.deactivate(DeploymentCallbackFlow.java:175)
at weblogic.application.internal.BaseDeployment$2.previous(BaseDeployment.java:1281)
at weblogic.application.utils.StateMachineDriver.previousState(StateMachineDriver.java:167)
at weblogic.application.utils.StateMachineDriver.previousState(StateMachineDriver.java:160)
at weblogic.application.internal.BaseDeployment.deactivate(BaseDeployment.java:453)
at weblogic.application.internal.EarDeployment.deactivate(EarDeployment.java:58)
at weblogic.application.internal.DeploymentStateChecker.deactivate(DeploymentStateChecker.java:199)
at weblogic.deploy.internal.targetserver.AppContainerInvoker.deactivate(AppContainerInvoker.java:98)
at weblogic.deploy.internal.targetserver.BasicDeployment.deactivate(BasicDeployment.java:263)
at weblogic.deploy.internal.targetserver.BasicDeployment.deactivateFromServerLifecycle(BasicDeployment.java:458)
at weblogic.management.deploy.internal.DeploymentAdapter$1.doDeactivate(DeploymentAdapter.java:74)
at weblogic.management.deploy.internal.DeploymentAdapter.deactivate(DeploymentAdapter.java:215)
at weblogic.management.deploy.internal.AppTransition$6.transitionApp(AppTransition.java:67)
at weblogic.management.deploy.internal.ConfiguredDeployments.transitionApps(ConfiguredDeployments.java:240)
at weblogic.management.deploy.internal.ConfiguredDeployments.deactivate(ConfiguredDeployments.java:199)
at weblogic.management.deploy.internal.ConfiguredDeployments.undeploy(ConfiguredDeployments.java:191)
at weblogic.management.deploy.internal.DeploymentServerService.shutdownApps(DeploymentServerService.java:195)
at weblogic.management.deploy.internal.DeploymentServerService.shutdownHelper(DeploymentServerService.java:127)
at weblogic.application.ApplicationShutdownService.stop(ApplicationShutdownService.java:106)
at weblogic.t3.srvr.ServerServicesManager.stopInternal(ServerServicesManager.java:495)
at weblogic.t3.srvr.ServerServicesManager.stop(ServerServicesManager.java:316)
at weblogic.t3.srvr.T3Srvr.shutdown(T3Srvr.java:1036)
at weblogic.t3.srvr.T3Srvr.gracefulShutdown(T3Srvr.java:939)
at weblogic.t3.srvr.GracefulShutdownRequest.run(GracefulShutdownRequest.java:41)
at weblogic.work.ContextWrap.run(ContextWrap.java:41)
at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerImpl.java:528)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
Thanks in advanceAgreed with all above pointers.
I think you have to raise SR with oracle, because it is prod environment.
If you still want to do some R&D.
1. Also check this URL might help, but not sure.
http://download.oracle.com/docs/cd/E21764_01/doc.1111/e14308/handlinglcm.htm#CIAJCEEF
http://download.oracle.com/docs/cd/E21764_01/doc.1111/e14308/handlinglcm.htm#CIAEFAGF
2. Restart all servers (along with Admin server and DB). -
Hi
The advantage of JAAS is that you can specify different login modules to utilise
different types of authentication. However authentication to a weblogic server
will only work by calling weblogic.security.auth.Authenticate.authenticate (due
to weblogic's own implementation of the javax.security.auth. classes), thus only
one loginmodule is available.
Regards
rangaHi jerry
i already got that problem solved by removing jaas.jar file
from class path.
i don'nt how it is working with out in classpath...?
Jerry <[email protected]> wrote:
Hi Nivas,
I think that the problem you are seeing has something to do with the
placement of jaas.jar in your classpath
On WebLogic server, put jaas.jar in the classpath after weblogic.jar.
I would bet that you have it placed before weblogic.jar right now.
I don't think the exception that you're seeing right now has anything
to do with your weblogic.policy file right now, so I think it is
safe to not worry about it right now.
Hope this helps,
Joe Jerry -
Hi All,
I am using JBOSS 4.0.5 GA Application Server. Eclipse3.0 IDE. Using JAAS 1.0 for authentication in login module.
While it is running under command prompt it was running successfully as below.......................
F:\Sample_Jaas1>java myapp.SomeStandAloneClient
Logging in user: testUser
Inside initialize method of SampleLoginModule
Inside login method of SampleLoginModule
Before call to callback handler
After call to call back handler
[SampleLoginModule] user entered username: testUser
[SampleLoginModule] user entered password: testPassword
[SampleLoginModule] authentication succeeded
[SampleLoginModule] added SamplePrincipal to Subject
Successfully logged in user: testUser
User logged in successfull
//Login.java
final String authFile = "Some.config";
System.out.println("Before setting system properties");
System.setProperty("java.security.auth.login.config", authFile);
System.out.println("After setting system properties");
MyCallbackHandler handler = new MyCallbackHandler(username,password);
try {
LoginContext lc = new LoginContext("someXYZLogin",handler);
System.out.println("Instantiate Login Context");
lc.login();
//*****when i am calling lc.login() method it is throwing the exceptions***
System.out.println("After calling login method");
System.out.println("Successfully logged in user: " + username);
} catch (LoginException le) {
System.out.println("Login failed");
le.printStackTrace();
//Some.config ---Config file
someXYZLogin{
dao.SampleLoginModule required debug=true;
//SampleLoginModule.java
public boolean login() throws LoginException {
System.out.println("Inside login method of SampleLoginModule");
if (callbackHandler == null)
throw new LoginException("Error: no CallbackHandler available " +
"to garner authentication information from the user");
Callback[] callbacks = new Callback[2];
callbacks[0] = new NameCallback("SampleModule username: ");
callbacks[1] = new PasswordCallback("SampleModule password: ", false);
try {
System.out.println("Before call to callback handler");
callbackHandler.handle(callbacks);
username = ((NameCallback)callbacks[0]).getName();
char[] tmpPassword = ((PasswordCallback)callbacks[1]).getPassword();
System.out.println("After call to call back handler");
if (tmpPassword == null) {
// treat a NULL password as an empty password
tmpPassword = new char[0];
password = new char[tmpPassword.length];
System.arraycopy(tmpPassword, 0,
password, 0, tmpPassword.length);
((PasswordCallback)callbacks[1]).clearPassword();
} catch (java.io.IOException ioe) {
throw new LoginException(ioe.toString());
} catch (UnsupportedCallbackException uce) {
throw new LoginException("Error: " + uce.getCallback().toString() +
" not available to garner authentication information " +
"from the user");
When it was running with JBOSS Server it is throwing the following exception:
09:45:21,484 ERROR [STDERR] javax.security.auth.login.FailedLoginException: Pass
word Incorrect/Password Required
09:45:21,484 ERROR [STDERR] at org.jboss.security.auth.spi.UsernamePasswordL
oginModule.login(UsernamePasswordLoginModule.java:213)
09:45:21,500 ERROR [STDERR] at org.jboss.security.auth.spi.UsersRolesLoginMo
dule.login(UsersRolesLoginModule.java:152)
09:45:21,500 ERROR [STDERR] at sun.reflect.NativeMethodAccessorImpl.invoke0(
Native Method)
09:45:21,500 ERROR [STDERR] at sun.reflect.NativeMethodAccessorImpl.invoke(U
nknown Source)
09:45:21,500 ERROR [STDERR] at sun.reflect.DelegatingMethodAccessorImpl.invo
ke(Unknown Source)
09:45:21,500 ERROR [STDERR] at java.lang.reflect.Method.invoke(Unknown Sourc
e)
09:45:21,500 ERROR [STDERR] at javax.security.auth.login.LoginContext.invoke
(Unknown Source)
09:45:21,500 ERROR [STDERR] at javax.security.auth.login.LoginContext.access
$000(Unknown Source)
09:45:21,500 ERROR [STDERR] at javax.security.auth.login.LoginContext$4.run(
Unknown Source)
09:45:21,500 ERROR [STDERR] at java.security.AccessController.doPrivileged(N
ative Method)
09:45:21,500 ERROR [STDERR] at javax.security.auth.login.LoginContext.invoke
Module(Unknown Source)
09:45:21,500 ERROR [STDERR] at javax.security.auth.login.LoginContext.login(
Unknown Source)
Please tell me any body what might be the problem.....
Thanks in AdvanceFranky Ronald D'Souza wrote:
I am trying to connect to SQL Server 2000 from a JSP (Weblogic 7.0) using a
connection pool. (Without datasource etc). I am getting the above mentioned
exception.
If i connect through sun.jdbc.odbc it works fine. I dont know what i am
doing wrong. Can anyone help out with this problem.Whose SQLServer drier are you using? Can you connect to the DBMS using the
driver in a simple standalone program?
Joe
>
>
thnx in advance.
Franky -
NotSerializableException: javax.security.auth.login.LoginContext
Hi,
I'm using the JAAS-API for a JDBC-based user login procedure.
Although it worked fine for months, suddenly it doesn't work anymore (i.e., after user enters name+password and clicks login-button, nothing happens besides the browser bottom line 'waiting for localhost'). I tried to debug this, but then Creator always crashed.
I just looked inside the server-log-files and found the following exception stack trace. It was stored in the files during every login procedure.
Because it worked fine before, this issue probably is not critical and could be solved by reinstalling Creator, but anyway I would greatly appreciate, if someone would have an idea what the problem is.
Regards,
Felix
[#|2006-07-10T17:41:50.494+0200|INFO|sun-appserver-pe8.2|org.apache.catalina.session.ManagerBase|_ThreadID=17;|Cannot serialize session attribute SessionBean1 for session 5918037189ed39ffffffffc4ba0330aded7d1
java.io.NotSerializableException: javax.security.auth.login.LoginContext
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1075)
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java:1369)
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java:1341)
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java:1284)
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1073)
at java.io.ObjectOutputStream.writeObject(ObjectOutputStream.java:291)
at org.apache.catalina.session.StandardSession.writeObject(StandardSession.java:1775)
at org.apache.catalina.session.StandardSession.writeObjectData(StandardSession.java:985)
at org.apache.catalina.session.StandardManager.doUnload(StandardManager.java:543)
at org.apache.catalina.session.StandardManager.unload(StandardManager.java:482)
at org.apache.catalina.session.StandardManager.stop(StandardManager.java:711)
at org.apache.catalina.core.StandardContext.stop(StandardContext.java:4675)
at org.apache.catalina.core.ContainerBase.removeChild(ContainerBase.java:956)
at com.sun.enterprise.web.WebContainer.unloadWebModule(WebContainer.java:2122)
at com.sun.enterprise.server.WebModuleDeployEventListener.moduleUndeployed(WebModuleDeployEventListener.java:198)
at com.sun.enterprise.server.WebModuleDeployEventListener.moduleUndeployed(WebModuleDeployEventListener.java:278)
at com.sun.enterprise.admin.event.AdminEventMulticaster.invokeModuleDeployEventListener(AdminEventMulticaster.java:920)
at com.sun.enterprise.admin.event.AdminEventMulticaster.handleModuleDeployEvent(AdminEventMulticaster.java:905)
at com.sun.enterprise.admin.event.AdminEventMulticaster.processEvent(AdminEventMulticaster.java:427)
at com.sun.enterprise.admin.event.AdminEventMulticaster.multicastEvent(AdminEventMulticaster.java:139)
at com.sun.enterprise.admin.server.core.DeploymentNotificationHelper.multicastEvent(DeploymentNotificationHelper.java:288)
at com.sun.enterprise.deployment.phasing.DeploymentServiceUtils.multicastEvent(DeploymentServiceUtils.java:155)
at com.sun.enterprise.deployment.phasing.ServerDeploymentTarget.sendStopEvent(ServerDeploymentTarget.java:283)
at com.sun.enterprise.deployment.phasing.StopPhase.runPhase(StopPhase.java:126)
at com.sun.enterprise.deployment.phasing.DeploymentPhase.executePhase(DeploymentPhase.java:71)
at com.sun.enterprise.deployment.phasing.PEDeploymentService.executePhases(PEDeploymentService.java:639)
at com.sun.enterprise.deployment.phasing.PEDeploymentService.stop(PEDeploymentService.java:409)
at com.sun.enterprise.deployment.phasing.PEDeploymentService.stop(PEDeploymentService.java:444)
at com.sun.enterprise.admin.mbeans.ApplicationsConfigMBean.stop(ApplicationsConfigMBean.java:725)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at com.sun.enterprise.admin.MBeanHelper.invokeOperationInBean(MBeanHelper.java:305)
at com.sun.enterprise.admin.config.BaseConfigMBean.invoke(BaseConfigMBean.java:360)
at com.sun.jmx.mbeanserver.DynamicMetaDataImpl.invoke(DynamicMetaDataImpl.java:213)
at com.sun.jmx.mbeanserver.MetaDataImpl.invoke(MetaDataImpl.java:220)
at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.invoke(DefaultMBeanServerInterceptor.java:815)
at com.sun.jmx.mbeanserver.JmxMBeanServer.invoke(JmxMBeanServer.java:784)
at sun.reflect.GeneratedMethodAccessor25.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at com.sun.enterprise.admin.util.proxy.ProxyClass.invoke(ProxyClass.java:54)
at $Proxy1.invoke(Unknown Source)
at com.sun.enterprise.admin.server.core.jmx.SunoneInterceptor.invoke(SunoneInterceptor.java:272)
at com.sun.enterprise.admin.jmx.remote.server.callers.InvokeCaller.call(InvokeCaller.java:38)
at com.sun.enterprise.admin.jmx.remote.server.MBeanServerRequestHandler.handle(MBeanServerRequestHandler.java:92)
at com.sun.enterprise.admin.jmx.remote.server.servlet.RemoteJmxConnectorServlet.processRequest(RemoteJmxConnectorServlet.java:69)
at com.sun.enterprise.admin.jmx.remote.server.servlet.RemoteJmxConnectorServlet.doPost(RemoteJmxConnectorServlet.java:94)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:767)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:860)
at sun.reflect.GeneratedMethodAccessor82.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:249)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:517)
at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:282)
at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:165)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:257)
at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:55)
at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:161)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:157)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:263)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:551)
at org.apache.catalina.core.StandardContextValve.invokeInternal(StandardContextValve.java:225)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:173)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:551)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:551)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:132)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:551)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:933)
at org.apache.coyote.tomcat5.CoyoteAdapter.service(CoyoteAdapter.java:189)
at com.sun.enterprise.web.connector.grizzly.ProcessorTask.doProcess(ProcessorTask.java:604)
at com.sun.enterprise.web.connector.grizzly.ProcessorTask.process(ProcessorTask.java:475)
at com.sun.enterprise.web.connector.grizzly.ReadTask.executeProcessorTask(ReadTask.java:371)
at com.sun.enterprise.web.connector.grizzly.ReadTask.doTask(ReadTask.java:264)
at com.sun.enterprise.web.connector.grizzly.TaskBase.run(TaskBase.java:281)
at com.sun.enterprise.web.connector.grizzly.WorkerThread.run(WorkerThread.java:83)
|#]just to make it clearer, the important Exception seems to be the following line:
java.io.NotSerializableException: javax.security.auth.login.LoginContext
The first thought of mine was to add an implements Serializable to the class, but that's not possible, because the class is read-only.
So does anyone know, how this could be solved? -
ERROR,11 Feb 2009 15:39:42,453,[XELLERATE.JBOSSLOGINHANDLER],Error in creating l
ogin context
javax.security.auth.login.LoginException: java.lang.NoSuchFieldError: TRACE
at org.jboss.logging.Log4jLoggerPlugin.isTraceEnabled(Log4jLoggerPlugin.
java:85)
at org.jboss.logging.Logger.isTraceEnabled(Logger.java:122)
at org.jboss.security.ClientLoginModule.initialize(ClientLoginModule.jav
a:96)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.
java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces
sorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at javax.security.auth.login.LoginContext.invoke(LoginContext.java:756)
at javax.security.auth.login.LoginContext.access$000(LoginContext.java:1
86)
at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:6
80)
at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
at Thor.API.Security.LoginHandler.jbossLoginHandler.login(Unknown Source
at Thor.API.Security.ClientLoginUtility.login(Unknown Source)
at com.thortech.xl.client.base.tcAppWindow.internalLogin(Unknown Source)
at com.thortech.xl.client.base.tcAppWindow.login(Unknown Source)
at com.thortech.xl.client.base.tcAppWindow.<init>(Unknown Source)
at com.thortech.xl.client.base.tcAppWindow.main(Unknown Source)Backup the original file log4j-1.2.8.jar in oimclient/xlclient/ext
copy the log4j.jar from JBOSS folder - JBOSS/server/default
Paste the file in client folder with original log4j-1.2.8.jar
Rename log4j.jar file to log4j-1.2.8.jar
start ur JBOSS.. this shd work.
AKSHAY
Edited by: user640639 on Feb 11, 2009 12:20 PM -
I'm trying to sign my messages between client & webservice using X509 certificates. I've created a keystore and imported:
privatekey1, certificate1(public key) and trustedCertAuthority that published certificates.
I've configured webservice & client to use that keystore and privatekey1 to sign request/response, but web service keeps throwing following exception:
javax.security.auth.login.LoginException: Cannot authenticate X509 certificate, User EMAILADDRESS=[email protected], CN=testUser, ... does not exist in our system
How can I configure web service to find that certificate?
Thnx for help.Yes, I did. I found the problem..
I had also checked to Authenticate with X509 certificate... and obviously I should somehow set the Securtiy provider, although, I don't know how (but it's not so important right now).
But I do have another question - how can I use private key & public key in certificate X509 to encrypt messages. In the sample you mentioned, it's written that there shoud be separate key for signature & encryption, but I have separate keystores for client (with client private key & server public certificate) and for server (with server private key & client certificate). But I can't get it to work... It seems to me that in that case signature key alias at service should be the same as key needed to decrypt the message?
Am i missing something again?
Thanks. -
Javax.security.auth.login.LoginException:
Hi,
I am trying to set Windows Desktop SSO.
I am configuring kerberos and i got the following in the kdc.log:
PREAUTH_FAILED: HTTP/[email protected] for kadmin/[email protected], Preauthentication failed
and from the amAuthWindowsSSO the following:
javax.security.auth.login.LoginException: Pre-authentication information was invalid (24) - Preauthentication failed
Can anyone help me to get this fixed?
Thanks,
Scottynobody knows?
-
Alternative to set "java.security.auth.login.config" ?
In all examples of using JASS, it uses the following way.
System.setProperty("java.security.auth.login.config", fileName)
Is there a way I can specify the policies in code, not in a file? That way I don't have to worry about file permissions.
p.s. Thanks for Seema-1 who anwsered my last question.
Message was edited by:
maqiang9111Has anyone done the same thing for the java.security.krb5.conf setting? I tried setting it using the same form of URL that I use for java.security.auth.login.config, and I get this error when the kerberos code attempts to use it:
Could not load configuration file jar:file:\C:\dev\workspace\myapp\client-data.jar!\krb5.ini (The filename, directory name, or volume label syntax is incorrect)
The corresponding login context conf file in the same jar loads fine. -
Hello,
Currently am working with Java SDK BI 4.1 to create stand alone application.
I have Authentication problem though secWnAD for the below code.
ISessionMgr sessionMgr = CrystalEnterprise.getSessionMgr();
enterpriseSession = sessionMgr.logon("xxxxx","xxxxx", "xxxxxxx", "secWinAD");
Error:
Caused by: java.io.IOException: Unable to locate a login configuration
at com.sun.security.auth.login.ConfigFile.init(Unknown Source)
when I tried to implement the same through VBA I am not getting any error for authentication.
Kindly help me.
Regards
ArunNow I have created the two files and
added the below content
krb5.ini
[libdefaults]
default_realm = xx.COM
dns_lookup_kdc = true
dns_lookup_realm = true
[realms]
XX.com = {
default_domain = xxxx.xx.COM
kdc = xx.COM
bscLogin.conf
com.businessobjects.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required;
Now am getting
KrbException: Cannot get kdc for realm XX.COM
at sun.security.krb5.KrbKdcReq.send(Unknown Source)
at sun.security.krb5.Credentials.sendASRequest(Unknown Source)
at sun.security.krb5.Credentials.acquireTGT(Unknown Source)
Regards
Arun -
Oracle 9I JAAS problem: javax.security.auth.login.LoginException
I have problem with Oracle 9IAS JAAS. I got "javax.security.auth.login.LoginException: unable to find LoginModule class" no matter where I put the classfile, either on JVM options(-cp), WAR file, or add it on the Web Admin, or manually edit 9iAS's configuration file.
None works, any one can help, I am using JDK1.3
I had the same problem on Tomcat, but I solved the problem by put the Class in the the JVM's classpath. But for 9iAS, it just ain't work.
Thank you for the helpBet you have solved this, but
the right place for jaas related stuff is
as installed extension i.e:
jre/lib/ext
where jaas.jar and jars containing login modules should be located.
/Kullervo -
Hi all,
I am trying out the implementation of custom login module with a j2ee web application.
I followed this<a href="http://help.sap.com/saphelp_nw04/helpdata/en/b9/9482887ddb3e47bd1a738c3e900195/frameset.htm">link</a>to create the login module.
When i run the application i get the error-
javax.security.auth.login.LoginException: No LoginModules configured for MyLoginModule.
This exception is pointing to my servlet where i've written the code-
LoginContext lc = new LoginContext("MyLoginModule");
try {
// start authentication
lc.login();
// user authenticated successfully
} catch (LoginException le) {
throw new Exception("Error authenticating user");
where <i>MyLoginModule</i> is the name of the custom login module i have implemented and registered in the security provider!
Message was edited by:
swarnadeepika subramanianHi,
this is the code in my login module class-
public void initialize(Subject subject, CallbackHandler callbackHandler,
Map sharedState, Map options)
this.callbackHandler = callbackHandler;
this.subject = subject;
this.sharedState = sharedState;
this.options = options;
this.successful = false;
this.nameSet = false;
public boolean login() throws LoginException {
Callback[] callbacks = new Callback[1];
callbacks[0] = new HttpGetterCallback();
((HttpGetterCallback) callbacks[0]).setType(HttpCallback.REQUEST_PARAMETER);
((HttpGetterCallback) callbacks[0]).setName("username");
try {
callbackHandler.handle(callbacks);
} catch (UnsupportedCallbackException e) {
return false;
} catch (IOException e) {
throwUserLoginException(e, LoginExceptionDetails.IO_EXCEPTION);
//Returns an array of all request parameters with name "user_name".
String[] requestParameters = (String[]) ((HttpGetterCallback) callbacks[0]).getValue();
if ((requestParameters != null) && requestParameters.length > 0) {
userName = requestParameters[0];
if (userName == null) {
throwNewLoginException("No user name provided.");
try {
refreshUserInfo(userName);
} catch (SecurityException e) {
throwUserLoginException(e);
String prefix = (String) options.get("user_name_prefix");
if ((prefix != null) && !userName.startsWith(prefix))
throwNewLoginException("The user is not trusted.");
if (sharedState.get(AbstractLoginModule.NAME) == null) {
sharedState.put(AbstractLoginModule.NAME, userName);
nameSet = true;
successful = true;
return true;
public boolean commit() throws LoginException {
if (successful)
Principal principal = new Principal(userName);
subject.getPrincipals().add(principal);
if (nameSet)
sharedState.put(AbstractLoginModule.PRINCIPAL, principal);
else
userName = null;
return true;
public boolean abort() throws LoginException
if (successful)
userName = null;
successful = false;
return true;
public boolean logout() throws LoginException
if (successful)
subject.getPrincipals(Principal.class).clear();
successful = false;
return true;
From my understanding, this module gets the value that i enter in the(basic authentication) window and compares it with the prefix tat is set in the visual admin
am i right?
Can you elaborate about the HttpCallBackHandler? without understanding the code i dont think debugging is possible!
Regards
Deepika. -
Hi,
Iam implementing the JAAS API for the application security. I am getting the "javax.security.auth.login.LoginException: No LoginModules configured for "example"" exception.
The exception is thrown from the line -
LoginContext lc = new LoginContext("example", cbh);
I tried to debug by getting the config entry -
AppConfigurationEntry[] entries = config.getAppConfigurationEntry("example");
and "entries" is returning null.
the contents of jaas.config are -
example {
login.model.security.RdbmsLoginModule required debug="true" url="jdbc:oracle:thin://ha9-webdbs4:1528/OD40?user=xxx&password=xxx" driver="oracle.jdbc.driver.OracleDriver";
the entry for the jaas.config in the java.security file- (Tried both)
login.config.url.1=file:${java.home}/lib/security/jaas.config
java.security.auth.login.config=file:${java.home}/lib/security/jaas.config
The solutions I tried till now -
1. Hardcoding the value of "java.security.auth.login.config".
2. Starting the app server with the arguments
"-Djava.security.auth.login.config={PATH OF JAAS CONF}"
Nothing is working.
If anyone knows the solution, please share your ideas.
Thanks In Advance.
SR.Hi,
the following worked for me
-Djava.security.auth.login.config=src//oracle//sample//jaastester//jaasTestConfig.txt
where the policy file is located in the SRC folder of the JDeveloper project
Frank -
Dear All,
System.setProperty("java.security.auth.login.config","rajesh.txt");
Is this a right way to define system property. Since I am not able to set this property. Even from cmd prompt also
I have tried. But no use. Please suggest me, what elseI have to do to set this property.
Thanks,
Rajeshhi,
Thanks for your response, finally i got solution. As you told I just check with file path, it works.
regards
rajesh
Maybe you are looking for
-
When small letters or emails are downloaded on thunderbird from our Yahoo email address, They download just fine. but when it comes to downloading messages with attachments of a large size, like 500kbs or bigger, then it will stop downloading any oth
-
I have hp 430 laptop,how can i re install the windows 7, if i not have original windows on my laptop. i have oem number, But i have troubol to finishing installation of window.
-
Airport Express Bridge Mode Cutting Out?
I recently wasn't able to bring internet to my bedroom, so I bought an Airport Express. I didn't want to have to buy a modem, so I threw it in another room where I could get internet with my Airport Extreme. Then, I put bridge mode on my Express so
-
Opening RoboHelp HTML ver. 9.0 Projects - Out of memory error
I have just updated to Technical Communication Suite 3 which includes RoboHelp HTML 9. I have installed all of the latest updates as of 6/20/2011. I am running Windows 7 Ultimate 64-bit OS, 6GB RAM. Note that I still have RoboHelp HTML 7 installed on
-
I keep having this same issue happening every couple of weeks where the scheduled workflow job SAPCONNECT ALL SEND will start canceling out with the error "Job canceled due to system shutdown". Usually when this happens there will be an RFC connectio