[JBoss-user] [JBossWS] - Re: Secure endpoint without secure WSDL

I have a POJO endpoint and in the jboss-web.xml defined | | yourservicename | file:../server/all/deploy/wsdls.war | | These tags are also available in jboss.xml so it should work all the same. wsdls.war is an exploded webapp deployment with empty web.xml and jboss-web.xml

[JBoss-user] [JBossWS] - Re: deploy web services in different connectors please help!

Hi Thomas, Thanks for answering. I need to be able to deploy web services to both connectors, not just the new one, so I think the link you referred (which, by the way, i already knew) is not applicable. I thought that there could be more than meets the eye in your answer, so I reverted the n

[JBoss-user] [JBossWS] - Re: deploy web services in different connectors please help!

any thoughts ? anyone ? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3950087#3950087 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3950087 ___ JBoss-user mailing list JBoss

[JBoss-user] [Tomcat, HTTPD, Servlets & JSP] - Re: web apps(ws) in different tomcat connectors, please help

I posted this question with some further developments in http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3949816#3949816 View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3949818#3949818 Reply to the post : http://www.jboss.com/index.html?module=bb&op=p

[JBoss-user] [Tomcat, HTTPD, Servlets & JSP] - Re: Possible to use two port numbers on one Tomcat?

I seem to have solved this but keep needing help. check http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3949816#3949816 View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3949817#3949817 Reply to the post : http://www.jboss.com/index.html?module=bb&op=

[JBoss-user] [JBossWS] - deploy web services in different connectors please help!!

I was able to setup two differnt connectors like this: | | | | | | | | | | | | | | | | | | | | | | | | | |

[JBoss-user] [Tomcat, HTTPD, Servlets & JSP] - Re: Possible to use two port numbers on one Tomcat?

Hello, Thank you so much for the config info. Do you have any idea of how to setup two webapps to be published via these two different connectors ? That would make webapp A available thru connector X and webapp B available thru connector Y. My webapps are webservices but for now I just want to

[JBoss-user] [Tomcat, HTTPD, Servlets & JSP] - web apps(ws) in different tomcat connectors, please help!!!

Please, can someone help me with setting up two web apps (web services to be more precise) in different tomcat connectors? I need to run two web services in the same container: one that requires client certs and another that doesn't. I've been led (due to some experiences and some forum particip

[JBoss-user] [Tomcat, HTTPD, Servlets & JSP] - Re: Possible to use two port numbers on one Tomcat?

Hello cpaul_it, That's exactly what I'm looking for!!! Can you share some config info ? Most importantly, can you give me some pointers about how to tell jboss that a certain webapp should be published in a certain connector ? Thank you very much View the original post : http://www.jboss.com

[JBoss-user] [Security & JAAS/JBoss] - Re: clientAuth=true disables BASIC AUTH

Hi, thanks for your anser. I perfectly understand what's going on in my example. It's not that I don't agree with your general way of reasoning. I just feel it's missplaced in the context of servlet apps. I feel that there's no point in being able to specify CLIENT-CERT instead of BASIC AUTH, o

[JBoss-user] [Security & JAAS/JBoss] - Re: clientAuth=true disables BASIC AUTH

Hello, thanks for you feedback. Regarding your argument, if I'm not mistaken, there is no distintion bewteen user and client in the servlet spec, so the fact that one web app requiring client certificates forces other clients from other web apps running in completely diferent security domains t

[JBoss-user] [Security & JAAS/JBoss] - Re: clientAuth=true disables BASIC AUTH

sorry forgot to include the part about the server.xml file. here it goes. Cheers View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3949332#3949332 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3949332 ___

[JBoss-user] [Security & JAAS/JBoss] - Re: clientAuth=true disables BASIC AUTH

Had to format it as code to finally show up :( sorry about that. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3949333#3949333 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3949333 _

[JBoss-user] [Security & JAAS/JBoss] - Re: clientAuth=true disables BASIC AUTH

Thank you very much for your answer :) You are correct, but the connector not only allows you to enable server side auth via ssl negotiation, it also allows you to enable client side auth. In fact, there's no point in setting your web app auth-method to CLIENT-CERT unless the connector is enabl

[JBoss-user] [Security & JAAS/JBoss] - clientAuth=true disables BASIC AUTH

I configured the server.xml file in tomcat inside jboss4.0.3sp1 with both keystore and truststore, respective pswds, and clientAuth="true". This enables dual ssl. However, it disables basic auth from any clients towards other web apps that don't require cert based auth. I was expecting that diff

[JBoss-user] [JBossWS] - static stub client inside jboss

Hello, I need to program a client for a web service running outside jboss 4.03sp1. The client will be a POJO included in a deployed ejb-jar. For performance reasons I think it would be better to use static clients, instead of dynamic ones. However, I'm anaware of any jboss tool that allows the

[JBoss-user] [JBossWS] - Re: use jbossws.sar from 4.0.4 in 4.0.3sp1

Not an option, unfortunately :( 09:30:35,571 ERROR [MainDeployer] Could not create deployment: file:/export/home/user01/jboss-4.0.3SP1/server/all/deploy/jmx-console.war/ java.lang.NoSuchMethodError: org.jboss.metadata.WebMetaData.getServletClassMap()Ljava/util/Map; at org.jboss.ws.serv

[JBoss-user] [JBossWS] - where to get jbossws 1.0.0GA ?

Where can I find the jbossws.sar 1.0.0GA refered to in this link http://wiki.jboss.org/wiki/Wiki.jsp?page=WebServiceStacks ? The latest downloadable version of the AS is the 4.0.4RC2, which according to this link does not include it. I guess I have to locate AS version 4.0.4GA. Where ? Thank yo

[JBoss-user] [JBossWS] - use jbossws.sar from 4.0.4 in 4.0.3sp1

Hello, In my project there's a lot of distributed commitment towards jboss4.0.3sp1 which makes it unfeasible to move to the 4.0.4 version. It's too late for that now. Still I'm facing problems with deserialization of complex arrays types that, according with some forum threads, would be solved

[JBoss-user] [JBossWS] - Re: EJB unreachable from POJO endpoint

Solved it like described in http://www.jboss.com/?module=bb&op=viewtopic&p=3882728 View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3922318#3922318 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3922318 -

[JBoss-user] [JBossWS] - Re: EJB unreachable from POJO endpoint

Anyone ? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3921932#3921932 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3921932 --- This SF.net email is sponsored by: S

[JBoss-user] [JBossWS] - Re: securing JAR-RPC 1.1 endpoints

Thanks for answering Thomas, but I've already been through that link. It only applies to SLSB though, which is not my problem. Are you saying that to have declarative security in a ws4ee portable way , I should use SLSB endpoints instead of JAX-RPC ones ? Thanks View the original post : htt

[JBoss-user] [JBossWS] - EJB unreachable from POJO endpoint

I have the following setup: 1. EJB1 <- POJOWS <- standalone ws client(outside the container) 2. EJB1 <- EJB2 <- <- standalone RMI-IIOP client (outside the container) 3. EJB1 <- standalone RMI-IIOP client (outside the container) Only the last 2 scenarios are working. The first is returning "EJB1

[JBoss-user] [JBossWS] - securing JAR-RPC 1.1 endpoints

Hello, I've searched but found no reference on how to specify declarative access control for POJO endpoints. Apparently, authorization would be specified at the url level as in normal servlets, but that would involve knowing how the wsdl operation map to the urls, which I don't know. Furthemore

[JBoss-user] [JBossWS] - WSSecurity

In the link http://wiki.jboss.org/wiki/Wiki.jsp?page=WSSecurity, under "Core features" there's a mention to "Username tokens with JBossSX/JAAS integration" but no corresponding statement about X.509 tokens, which are also supported. So I would just ask someone to confirm that this isn't a typo

[JBoss-user] [Security & JAAS/JBoss] - Re: WSSecurity

Anyone ? Should I post this question in the web service forum ? Thanks. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3917302#3917302 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3917302 -

[JBoss-user] [Security & JAAS/JBoss] - Re: WSSecurity

In that link, under "Core features" there's a mention to "Username tokens with JBossSX/JAAS integration" but no corresponding statement about X.509 tokens, which are also supported. So I would just ask someone to confirm that this isn't a typo and that there is indeed no integration with JBossS

[JBoss-user] [Clustering/JBoss] - Re: https through load balancer breaks declarative security

1) Nope. Most major hardware load balancer may act in an SSL offloader role wher they route traffic with server affinity based on layer3-4 info. 2) Still don't know this, posted a question in the tomcat forum but no answer either 3) Haven't found any that doesn't use proprietary mechanisms

[JBoss-user] [Security & JAAS/JBoss] - Re: support to certificate revocation verify

Check this http://www.jboss.com/index.html?module=bb&op=viewtopic&t=74954 and this http://mail-archives.apache.org/mod_mbox/tomcat-users/200512.mbox/[EMAIL PROTECTED] View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=391#391 Reply to the post : http:

[JBoss-user] [Security & JAAS/JBoss] - Re: restricting SSL ciphersuites

Yes there is :) Tomcat as a connector flag named "cipher" (or something like that) for that purpose. see the SSL connector docs for details. Furthermore, JBoss 4.0.3 was enhanced with exporting of all the SSL Socket Factory api configuration parameters, ciphersuite being one of them. check ht

[JBoss-user] [Clustering/JBoss] - Re: clustered statefull ejbs require HA-JNDI in colocated sc

Well, does it make sense or not ? Anyone ?... View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3916658#3916658 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3916658 ---

[JBoss-user] [Security & JAAS/JBoss] - restricting SSL ciphersuites

Hi Is there some way of configuring JBoss AS SSL server to only accept a specific subset of cipher suites ? Thanks View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3916289#3916289 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=r

[JBoss-user] [Security & JAAS/JBoss] - Re: proprietary authentication mechanisms

Also found this: http://jira.jboss.com/jira/browse/JBAS-2283 The definite NO... View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3915902#3915902 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3915902 -

[JBoss-user] [Security & JAAS/JBoss] - Re: proprietary authentication mechanisms

Thanks for your help but I've been through all of that already. I finally found an answer (unfortunately a negative one) in the thread http://www.jboss.com/index.html?module=bb&op=viewtopic&t=73966 Thanks View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3915899

[JBoss-user] [Security & JAAS/JBoss] - Re: proprietary authentication mechanisms

Thanks for your help but I've been through all of that already. I finally found an answer (unfortunately a negative one) in the thread http://www.jboss.com/index.html?module=bb&op=viewtopic&t=73966 Thanks View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3915898

[JBoss-user] [Security & JAAS/JBoss] - Re: proprietary authentication mechanisms

I really need help on this. Maybe a litle background info helps you helping me :) This question fits in the context of a project where the possibility of using a load balancer working as a SSL acelerator (aka "SSL offloader") is being weighted against the power to leverage J2EE native HTTP auth

[JBoss-user] [Tomcat, HTTPD, Servlets & JSP] - tomcat version 5.5.12 + CRL

Hello, I read that starting with version 5.5.12 there's an aditional tomcat ssl connector paramater called "crlFile" that enables tomcat to handle CRLs. It has to be compiled with jdk 1.5 though. Has JBoss already incorporated this behaviour ? Thank you View the original post : http://www.jb

[JBoss-user] [Clustering/JBoss] - Re: clustered statefull ejbs require HA-JNDI in colocated sc

Hi Ultimately, the bean is clustered to support clustering of an HTTPSession carrying a remote reference to it. Does this make any sense ? Thanks View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3915787#3915787 Reply to the post : http://www.jboss.com/index.h

[JBoss-user] [Security & JAAS/JBoss] - proprietary authentication mechanisms

Does JBoss allows the insertion of proprietay authentication mechanisms, (eg. a message that embedds the credentials in some proprietary format). How ? Through a Callback handler ??...how do I access the message from there ? Thanks View the original post : http://www.jboss.com/index.html?modu

[JBoss-user] [Security & JAAS/JBoss] - support to certificate revocation verify

Does JBoss SSL support include the ability to verify a client's certificate revocation ? If so, is there any tutorial on configuring it ? Thanks in advance View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3915471#3915471 Reply to the post : http://www.jboss.co

[JBoss-user] [Security & JAAS/JBoss] - WSSecurity

Does JBoss accept WS security, namely the user token as an authentication mechanism ? Thanks View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3915320#3915320 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3915320 --

[JBoss-user] [Security & JAAS/JBoss] - powerfull/flexible => role per method ????

Hello, I'm working in a project where there?s a requirement that the user must be able to assign users to dynamically defined groups. These groups are constituted in terms of the actions they may perform in the system. The most flexible way of doing this and still leverage ejb declarative secur

[JBoss-user] [Clustering/JBoss] - Re: clustered statefull ejbs require HA-JNDI in colocated sc

Thanks for answering. Interesting. I had this (wrong) idea that cluster aware stubs would only be available via HA-JNDI and that plain JNDI servers would still have old non-cluster aware stubs. This raises another problem. In this colocated scenario, it makes no sense to redirect the request

[JBoss-user] [JBossWS] - WSSecurity interoperability

Given the current draft status of the Basic Security Profile 1.0, would anyone recomend the use of JBoss's WSSecurity from an interoperability point of view (with .NET for instance) or is that spec totally irrelevant in the current state of affairs ? Thanks in advance View the original post :

[JBoss-user] [Clustering/JBoss] - clustered statefull ejbs require HA-JNDI in colocated scenar

I have colocated web and business layers in each Jboss server and want to replicate HTTPSession instances throughout the cluster (to enable HTTP session fail-over). Furthermore, the session holds a statefull (clustered) ejb remote reference. In this scenario must the remote reference be fetche

[JBoss-user] [Tomcat, HTTPD, Servlets & JSP] - Re: security before/after AJP1.3

can someone please help me ? Maybe I should rephrase my question to " Does ajp1.3 leverages the declarative security mechanisms or does it force applicational security ? Thanks in advance View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3914771#3914771 Reply

[JBoss-user] [JBoss jBPM] - jbpm in a cluster

Can anyone please confirm the following statement ? "JBPM workflow process descriptions and runtime status are persisted to a database but in a cluster they are not automatically failed-over, which makes sense once you realize that some processing steps may not be idempotent. Therefore, while t

[JBoss-user] [Clustering/JBoss] - cluster aware Timers

I have an ejb that uses the ctx.getTimerService() call to schedule notifications as defined by the EJB 2.1 spec. Are Timers cluster-aware, in the sense of fail-over and if so, starting with what JBoss version ? Thank you View the original post : http://www.jboss.com/index.html?module=bb&op=vie

[JBoss-user] [Tomcat, HTTPD, Servlets & JSP] - security before/after AJP1.3

I have a web app with declarative security setup in the deployment descriptor in a way to force ssl with client authentication. If I insert an apache node in the middle talking AJP1.3 with the server, do the deployment descriptors have to change in any way to maintain the same behavior regarding

[JBoss-user] [Security & JAAS/JBoss] - ssl client auth through load balancer breaks declarative sec

Hello, I posted this question 2 days ago in the clustering forum but after having received no answer I decided that this forum may be a better place to post it. Please forgive me if that isn't the case but I'm desperate for an answer:( My desired setup is for a Jboss cluster serving requests be

[JBoss-user] [Clustering/JBoss] - https through load balancer breaks declarative security

Hello, My desired setup is for a Jboss cluster serving requests behind a load balancer. Also I intend to use declarative security on the deployed units and have ssl client side authentication. I need someone to please confirm/deny the following statements: 1) ssl has to be negotiated by the lo

[JBoss-user] [Clustering/JBoss] - Re: HTTPSession replication => serializable

Thanks for your answer. If possible I would like to refine my knowedge about JBoss's HTTPSession replication. Will Replication just not work if there is non-serializable content or it works just for the serializable part ? Thank you View the original post : http://www.jboss.com/index.html?mo

[JBoss-user] [Clustering/JBoss] - sticky sessions break declarative https ?

I'm in a bit of a dilema If I need sticky HTTP sessions, then my hardware load balancer needs to have a ssl decoder to handle the https requests. However by doing that, how can I enforce container security for my web app when the request arriving at the servlet container is plain http ? How can

[JBoss-user] [Clustering/JBoss] - load balancing per client ?

Hello Just asking to confirm that there's no attempt from JBoss clustering architecture to centralize the client requests load balancing. It seems to me that the idea of dynamic proxies, being scoped to the client, may originate some perverse global effectes like all the clients happening to be

[JBoss-user] [Clustering/JBoss] - HTTPSession replication => serializable

Hello, I read that JBoss's HTTPSession replication demands the session contents to be serializable and that using local EJB references would not respect that because local EJB references where not serializable. Is there any truth to any of this ? Thanks View the original post : http://www.jbo

[JBoss-user] [Persistence,JBoss/CMP, Hibernate, Database] - Oracle9i connection down => 1rst entity EJB request hangs

Hello I am experiencing a strange behaviour with an entity bean and Oracle 9i. Whenever I disconnect the network cable leading from JBoss to the DB, the first client request just hangs. However, subsequent requests immediately complain with a SQLException about a network adapter being down. I

[JBoss-user] [Security & JAAS/JBoss] - Re: CONFIDENTIAL not working ?

Please ignore my question. The problem was that the web-resource-collection identification didn't match the servlet name. silly typing mistake :( View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=3879960#3879960 Reply to the post : http://www.jboss.org/index.htm

[JBoss-user] [Security & JAAS/JBoss] - CONFIDENTIAL not working ?

Hello, The following is not preventing me from accessing the associated servlet by plain HTTP. CONFIDENTIAL I was hopping that this would make only https available for this web applicaton (which by the way, is working). Am i interpreting the meaning of this flag wrongly or there's somet

[JBoss-user] [Security & JAAS/JBoss] - specifying sll cyphersuite

Hello, How do you specify the ssl cyphersuite in jboss ? Thanks. View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=3879727#3879727 Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=3879727 --

[JBoss-user] [Security & JAAS/JBoss] - ejb-ssl with client authentication ?

Hello Is it possible to force client-authentication when using ssl to conect to an ejb ? If so can anyone describe the procedure or point me to some info repository ? Thank you. View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=3879728#3879728 Reply to the pos