Weblogic Security(Change Password)

Question

We are implementing “Forgot Password" feature for our web application which is based on Weblogic Portal Server. We are using Spring JMS POJO(http://static.springsource.org/spring/docs/2.5.x/reference/jms.html#jms-asynchronousMessageReception) for anonymous user to recover their password, We have the Spring JMS listener which receives the password reset request, but while doing the password reset we are getting security error
Here is the code where we do the reset onMessage() of MessageListener
com.bea.p13n.security.management.authentication.AtnManagerProxy proxy = AtnProxyHelper.getAtnProxy("SQLAuthenticator");
proxy .setPassword(loginId, newPassword);
Looks like Spring JMS listener is running as a client within the WL server, but even this pair of code does not work too
Subject subject = com.bea.p13n.security.Authentication.authenticate("weblogic","weblogic");
com.bea.p13n.security.management.authentication.AtnManagerProxy proxy = AtnProxyHelper.getAtnProxy("SQLAuthenticator");
proxy .setPassword(loginId, newPassword);
java.lang.SecurityException: The caller is not in the proper role for attempted user operation. Required role(s) [Admin, PortalSystemAdministrator, Self, updateRole]. Caller role(s) Anonymous.
     at com.bea.p13n.security.management.authentication.AtnSecurityMgmtHelper.validateUserCallerRole(AtnSecurityMgmtHelper.java:567)
     at com.bea.p13n.security.management.authentication.internal.UserProvider.setPassword(UserProvider.java:330)
     at com.bea.p13n.security.management.authentication.internal.UserProvider.setPassword(UserProvider.java:314)
     at com.bea.p13n.security.management.authentication.AtnManagerProxy.setPassword(AtnManagerProxy.java:544)
     at com.pics.weblogic.UserManagement.recoverPassword(UserManagement.java:623)
     at com.pics.core.service.ForgotPasswordServiceImpl.changePassword(ForgotPasswordServiceImpl.java:44)
     at com.pics.messaging.MessageQueueReceiver.onMessage(MessageQueueReceiver.java:100)
     at org.springframework.jms.listener.AbstractMessageListenerContainer.doInvokeListener(AbstractMessageListenerContainer.java:505)
     at org.springframework.jms.listener.AbstractMessageListenerContainer.invokeListener(AbstractMessageListenerContainer.java:444)
     at org.springframework.jms.listener.AbstractMessageListenerContainer.doExecuteListener(AbstractMessageListenerContainer.java:414)
     at org.springframework.jms.listener.AbstractPollingMessageListenerContainer.doReceiveAndExecute(AbstractPollingMessageListenerContainer.java:293)
     at org.springframework.jms.listener.AbstractPollingMessageListenerContainer.receiveAndExecute(AbstractPollingMessageListenerContainer.java:239)
     at org.springframework.jms.listener.DefaultMessageListenerContainer$AsyncMessageListenerInvoker.invokeListener(DefaultMessageListenerContainer.java:872)
     at org.springframework.jms.listener.DefaultMessageListenerContainer$AsyncMessageListenerInvoker.run(DefaultMessageListenerContainer.java:812)
     at java.lang.Thread.run(Thread.java:619)

Answer 1

Yes, I agree it is a bad idea, but initially we did the password reset in sync but the e-mail notification in async, but then when doing the password reset we got into trouble of same security exceptions, so we moved that all the reset password and e-mail into same async code block assuming that Spring JMS listener will not ask for authorization since the WL server and JMS listener both are running on the same thread/context, but looks like Spring JMS listener in running on a different thread context. I need to impersonate since user has not logged into the system("forgot password" recovery feature). Looks like it does not matter sync or async I need to impersonate user, Here is the work around that I have put for now
     Subject subject = com.bea.p13n.security.Authentication.authenticate("weblogic","weblogic"); //I need to create a special user for this, Ugly!!
     ResetPassword resetPassword = new ResetPassword ("ForgotUserID","ForgotEmail"); //Now every thing happens here, setPassword API
     weblogic.security.Security.runAs(subject, resetPassword );
If I had used MDB instead of Spring MDB then it would have worked(I have done the same in WL couple years back)
Thanks
Edited by: lbrocks_prn on Nov 19, 2009 10:18 PM
Edited by: lbrocks_prn on Nov 19, 2009 10:19 PM