[JBoss-user] [Security JAAS/JBoss] - Re: JAAS bug or tomcat integration?
The ClientLoginModule does not restore any existing identity when its logout is called. It simply clears the identity it established. I'll add a option to restore any previous identity in 3.2.4RC2. View the original post : http://www.jboss.org/index.html?module=bbop=viewtopicp=3832287#3832287 Reply to the post : http://www.jboss.org/index.html?module=bbop=postingmode=replyp=3832287 --- This SF.net email is sponsored by: The Robotic Monkeys at ThinkGeek For a limited time only, get FREE Ground shipping on all orders of $35 or more. Hurry up and shop folks, this offer expires April 30th! http://www.thinkgeek.com/freeshipping/?cpg=12297 ___ JBoss-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-user
[JBoss-user] [Security JAAS/JBoss] - Re: JAAS bug or tomcat integration?
Thank you Scott!!! View the original post : http://www.jboss.org/index.html?module=bbop=viewtopicp=3831155#3831155 Reply to the post : http://www.jboss.org/index.html?module=bbop=postingmode=replyp=3831155 --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470alloc_id=3638op=click ___ JBoss-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-user
[JBoss-user] [Security JAAS/JBoss] - Re: JAAS bug or tomcat integration?
Please, tell me: is it real to restore previous login principals after lc.logout()? It seems that ClientLoginModule clearing up all Security Associations after logout. We need to have principal stacking possibility. View the original post : http://www.jboss.org/index.html?module=bbop=viewtopicp=3831157#3831157 Reply to the post : http://www.jboss.org/index.html?module=bbop=postingmode=replyp=3831157 --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470alloc_id=3638op=click ___ JBoss-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-user
[JBoss-user] [Security JAAS/JBoss] - Re: JAAS bug or tomcat integration?
You have modified the example to use the my-domain login configuration instead of the client-login. As described in the JAAS howto the name passed to the LoginContext maps to the server side login-config.xml login module configuration entry that will be used for authentication. The preconfigured entry which includes the org.jboss.security.ClientLoginModule is named client-login. The ClientLoginModule must be included in any configuration called by code doing a JAAS login that wants the security context to propagate with the thread. View the original post : http://www.jboss.org/index.html?module=bbop=viewtopicp=3830636#3830636 Reply to the post : http://www.jboss.org/index.html?module=bbop=postingmode=replyp=3830636 --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470alloc_id=3638op=click ___ JBoss-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-user
[JBoss-user] [Security JAAS/JBoss] - Re: JAAS bug or tomcat integration?
It seems that your example don't work (JBOSS 3.2.3 +Tomcat 4). Code from unsecured page: | %@ page import=javax.security.auth.login.LoginContext, | org.jboss.security.auth.callback.UsernamePasswordHandler, | org.jboss.security.SecurityAssociation, | javax.security.auth.Subject, | java.security.PrivilegedAction, | java.io.IOException, | XXX.core.DBHelper, | XXX.ejb.core.XXXObjectHome% | %=SecurityAssociation.getPrincipal()% | % | LoginContext lc = new LoginContext(my-domain,new UsernamePasswordHandler(internal,internal)); | lc.login(); | % | %=request.getUserPrincipal()% | %=SecurityAssociation.getPrincipal()% | % | XXXObjectHome XXObjectHome = DBHelper.getInstance().getXXXObjectHome(); | XXXObjectHome.findByPath(system/object).getName(); | lc.logout(); | % | returns me in logs: | 2004-04-05 17:10:30,835 ERROR [org.jboss.ejb.plugins.LogInterceptor] EJBExceptio | n, causedBy: | java.lang.SecurityException: Authentication exception, principal=null | at org.jboss.ejb.plugins.SecurityInterceptor.checkSecurityAssociation(Se | curityInterceptor.java:164) | at org.jboss.ejb.plugins.SecurityInterceptor.invokeHome(SecurityIntercep | tor.java:81) | at org.jboss.ejb.plugins.LogInterceptor.invokeHome(LogInterceptor.java:1 | 20) | at org.jboss.ejb.plugins.ProxyFactoryFinderInterceptor.invokeHome(ProxyF | actoryFinderInterceptor.java:93) | at org.jboss.ejb.EntityContainer.internalInvokeHome(EntityContainer.java | :483) | at org.jboss.ejb.Container.invoke(Container.java:720) | at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) | at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl. | java:39) | at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces | sorImpl.java:25) | at java.lang.reflect.Method.invoke(Method.java:324) | at org.jboss.mx.capability.ReflectedMBeanDispatcher.invoke(ReflectedMBea | nDispatcher.java:284) | at org.jboss.mx.server.MBeanServerImpl.invoke(MBeanServerImpl.java:546) | at org.jboss.invocation.local.LocalInvoker.invoke(LocalInvoker.java:101) | at org.jboss.invocation.InvokerInterceptor.invoke(InvokerInterceptor.jav | a:90) | at org.jboss.proxy.TransactionInterceptor.invoke(TransactionInterceptor. | java:46) | at org.jboss.proxy.SecurityInterceptor.invoke(SecurityInterceptor.java:4 | 5) | at org.jboss.proxy.ejb.HomeInterceptor.invoke(HomeInterceptor.java:173) | at org.jboss.proxy.ClientContainer.invoke(ClientContainer.java:85) | at $Proxy43.findByPath(Unknown Source) | at org.apache.jsp.sec_jsp._jspService(sec_jsp.java:64) | at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:137) | at javax.servlet.http.HttpServlet.service(HttpServlet.java:853) | | But I have user internal/internal! Please help me! View the original post : http://www.jboss.org/index.html?module=bbop=viewtopicp=3829211#3829211 Reply to the post : http://www.jboss.org/index.html?module=bbop=postingmode=replyp=3829211 --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470alloc_id=3638op=click ___ JBoss-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-user
[JBoss-user] [Security JAAS/JBoss] - Re: JAAS bug or tomcat integration?
Sorry, but may be I'm a fool, but I didn't find how I can execute some particular code under different principal:-( I found method SecurityAssociation.pushRunAsRole(), but it seems that this method doesn't have a effect: SecurityAssociation.getPrincipal before and after returns the same principal. Or please help me to resolve such problem: I want to use my entity EJBs in my particular LoginModule? Question is: when I try to invoke some method of ent.ejb from LoginModule I get SecurityException. And there is no surprise because I don't authentificate yet. To resolve this problem I used Subject.doAs methodology in weblogic server, but after switching to JBOSS server this method don't work and I'm confused and I can't find any approapriate method in JBOSS. Please help me! I read a lot of information regarding this problem in JBOSS, but I don't see a solution:( View the original post : http://www.jboss.org/index.html?module=bbop=viewtopicp=3828310#3828310 Reply to the post : http://www.jboss.org/index.html?module=bbop=postingmode=replyp=3828310 --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470alloc_id=3638op=click ___ JBoss-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-user
[JBoss-user] [Security JAAS/JBoss] - Re: JAAS bug or tomcat integration?
Are you sure that there is information on role substitution in the HOWTO? Unfortunately, I couldn't find it there. I've implemented basic login in my system (this is described in the howto), but I can't get know how should I substitute internal user (if I can't use doAs). Can you post a simple example of solving this problem? View the original post : http://www.jboss.org/index.html?module=bbop=viewtopicp=3828419#3828419 Reply to the post : http://www.jboss.org/index.html?module=bbop=postingmode=replyp=3828419 --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470alloc_id=3638op=click ___ JBoss-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-user
