WlClient.jar & JAAS authentication Issues

Question

If I run the JAAS example (examples/security/jaas) that comes with
wl8.1 sp1 but use wlclient.jar instead of weblogic.jar, the
LoginContext.login() method returns a Subject even if I pass in an
invalid user/password combination. If weblogic.jar is in the
classpath, a javax.security.auth.login.LoginException is thrown which
is what I want to happen for invalid credentials. When running with
wlclient.jar, the code doesn't fail until it actually attempts to
access the EJB at which point it gets a org.omg.CORBA.NO_PERMISSION.
I am trying to use JAAS to login from a swing app and I want to use
wlclient.jar instead of weblogic.jar, but I need to be able to
determine whether the login was successful without waiting until I
access a secured EJB. Why does wlclient.jar behave differently than
weblogic.jar? How can I determine if my login worked if Weblogic is
going to return a Subject no matter what username/password I pass in?

Answer 1

Hi,
I have a similar problem when using wlclient.jar. I am able to authenticate using
the UsernamePasswordLoginModule (with authOnLogin true), but I get an error when
invoking a secured EJB:
     UsernamePasswordLoginModule.initialize(), debug enabled
     UsernamePasswordLoginModule.initialize(), authOnLogin enabled
     UsernamePasswordLoginModule.login(), username weblogic
     UsernamePasswordLoginModule.login(), URL t3://localhost:7001
     Logged in
     Invoking EJB
     java.rmi.AccessException: CORBA NO_PERMISSION 0 Maybe; nested exception is:
          org.omg.CORBA.NO_PERMISSION: vmcid: 0x0 minor code: 0 completed: Maybe
          at com.sun.corba.se.internal.iiop.ShutdownUtilDelegate.mapSystemException(ShutdownUtilDelegate.java:95)
          at javax.rmi.CORBA.Util.mapSystemException(Util.java:65)
The login is successfull, but I get the org.omg.CORBA.NO_PERMISSION when invoking
the EJB. If I replace wlclient.jar with weblogic.jar it works fine! But we can't
use weblogic.jar in our deployed client, because a) it's HUGE, b) it conflicts
with Ant 1.6.1.
Any ideas?
"Memo S" <[email protected]> wrote:
>
Here is the answer
A UsernamePasswordLoginModule LoginModule was added for use by the IIOP
thin-client.
This class has the same API as that of the weblogic.security.auth.login.UsernamePasswordLoginModule
class, but in this implementation, there is a new property called authOnLogin.
When true, this property forces the login method to perform authentication
(rather
than on the first invocation). The default for this new property is false.
Regards.
Memo S
"Ganapathi" <[email protected]> wrote:
If I run the JAAS example (examples/security/jaas) that comes with
wl8.1 sp1 but use wlclient.jar instead of weblogic.jar, the
LoginContext.login() method returns a Subject even if I pass in an
invalid user/password combination. If weblogic.jar is in the
classpath, a javax.security.auth.login.LoginException is thrown which
is what I want to happen for invalid credentials. When running with
wlclient.jar, the code doesn't fail until it actually attempts to
access the EJB at which point it gets a org.omg.CORBA.NO_PERMISSION.
I am trying to use JAAS to login from a swing app and I want to use
wlclient.jar instead of weblogic.jar, but I need to be able to
determine whether the login was successful without waiting until I
access a secured EJB. Why does wlclient.jar behave differently than
weblogic.jar? How can I determine if my login worked if Weblogic is
going to return a Subject no matter what username/password I pass in?