Bugs item #487071, was opened at 2001-11-29 05:54
You can respond by visiting:
http://sourceforge.net/tracker/?func=detail&atid=376685&aid=487071&group_id=22866
Category: JBossSX
Group: v2.4 (stable)
Status: Closed
>Resolution: Fixed
Priority: 5
Submitted By: Jason Vasquez (jpvasquez)
Assigned to: Scott M Stark (starksm)
Summary: Problem with JAAS authentication modules
Initial Comment:
Environment:
* Solaris 7
* Sun JDK 1.3.1
* JBoss 2.4.3/Jetty Bundle
I have a custom JAAS authentication module, which is
almost
an exact duplicate of the LdapLoginModule that is
delivered
with JBoss 2.4.3. It has some changes to make it work
with
our environment here. The module works fine (binds to
the
directory with the user's credentials, and searches
the roles to
add to the JBoss environment. It adds these roles
with an exact
copy of the original, delivered module code:
//roleName is a String containing the role name
userRoles.addMember(new SimplePrincipal(roleName));
I know that the roles are getting added with some
additional logging
I've added around this code.
When I log into the site via a browser (through
Jetty), I am prompted
for my username/password, but I receive an error about
a ClassCastException.
The JBoss console has much better details as to what
has happened. I will
paste that below.
Any ideas as to what might be going on here?
Thanks,
Jason
Console Output:
[JaasSecurityManagerService] Created
securityMgr=org.jboss.security.plugins.JaasSecurityMana
ger@3b625b
[JaasSecurityManagerService] setCachePolicy, c=null
[JaasSecurityManagerService] Added MyLDAP,
org.jboss.security.plugins.JaasSecurityManager@3b625b
to map
[Jetty] Security- User: rz95127
[Jetty] Security- created JBossUserRealm::User: rz95127
[Default] Logged into LDAP server,
javax.naming.ldap.InitialLdapContext@2d26d2
[Default] ----- got a result -----
[Default] lis_admin
[Default] User 'rz95127' authenticated.
[Jetty] Security- User: rz95127 is authenticated
[Jetty] WARNING: GET /cams/admin/ HTTP/1.1
java.lang.ClassCastException: java.lang.String
at
org.jboss.security.plugins.JaasSecurityManager.doesUser
HaveRole(JaasSecurityManager.java:278)
at
org.jboss.jetty.JBossUserRealm$User.isUserInRole
(JBossUserRealm.java:105)
at
org.mortbay.http.handler.SecurityHandler.authenticatedI
nRole(SecurityHandler.java:360)
at
org.mortbay.http.handler.SecurityHandler.handle
(SecurityHandler.java:286)
at org.mortbay.http.HandlerContext.handle
(HandlerContext.java:1037)
at org.mortbay.http.HandlerContext.handle
(HandlerContext.java:992)
at org.mortbay.http.HttpServer.service
(HttpServer.java:699)
at org.mortbay.http.HttpConnection.service
(HttpConnection.java:745)
at org.mortbay.http.HttpConnection.handleNext
(HttpConnection.java:918)
at org.mortbay.http.HttpConnection.handle
(HttpConnection.java:760)
at
org.mortbay.http.SocketListener.handleConnection
(SocketListener.java:148)
at org.mortbay.util.ThreadedServer.handle
(ThreadedServer.java:287)
at org.mortbay.util.ThreadPool$JobRunner.run
(ThreadPool.java:716)
at java.lang.Thread.run(Thread.java:484)
----------------------------------------------------------------------
>Comment By: Scott M Stark (starksm)
Date: 2001-12-02 14:30
Message:
Logged In: YES
user_id=175228
A new JBoss-2.4.4/Jetty-3.1.3-1 bundle has been released
with a fix for the security problem.
----------------------------------------------------------------------
Comment By: Scott M Stark (starksm)
Date: 2001-11-29 14:38
Message:
Logged In: YES
user_id=175228
The security integration tests fail for this release
bundle, so its not a valid distribution. I'll look at
updating the release to run with the 2.4.4 beta this
weekend.
[starksm@banshee build]$ ant -buildfile run_tests.xml -
Dtestcase=web run-testcase
Buildfile: run_tests.xml
run-testcase:
[junit] Running
org.jboss.test.web.test.TestWebIntegration
[junit] Found warDeployer named: :service=Jetty
[junit] Deploying: jbosstest-web.ear...Done
[junit] Invokded flushAuthenticationCache(other)
[junit] Try #1
[junit] Connecting to:
http://jduke:theduke@localhost:8080/jbosstest/restricted/Sec
ureServlet
[junit] HttpClient.reponse = HTTP/1.1 500 Internal
Server Error
[junit] responseCode=500, response=Internal Server Error
[junit] <HTML>
[junit] <HEAD>
[junit] <TITLE>Error 500 Internal Server Error</TITLE>
[junit] <BODY>
[junit] <H2>HTTP ERROR: 500 Internal Server Error</H2>
[junit] java.lang.ClassCastException:
java.lang.String<P>RequestURI=/jbosstest/restricted/SecureSe
rvlet
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit] </BODY>
[junit] </HTML>
[junit]
[junit] Connecting to:
http://jduke:theduke@localhost:8080/jbosstest/ClientLoginSer
vlet
[junit] HttpClient.reponse = HTTP/1.1 200 OK
[junit] responseCode=200, response=OK
[junit] Connecting to:
http://jduke:theduke@localhost:8080/jbosstest/EJBOnStartupSe
rvlet
[junit] HttpClient.reponse = HTTP/1.1 200 OK
[junit] responseCode=200, response=OK
[junit] Connecting to:
http://jduke:theduke@localhost:8080/jbosstest/EJBServlet
[junit] HttpClient.reponse = HTTP/1.1 200 OK
[junit] responseCode=200, response=OK
[junit] Connecting to:
http://jduke:theduke@localhost:8080/jbosstest/ENCServlet
[junit] HttpClient.reponse = HTTP/1.1 200 OK
[junit] responseCode=200, response=OK
[junit] Connecting to:
http://jduke:theduke@localhost:8080/jbosstest/restricted/inc
lude_ejb.jsp
[junit] HttpClient.reponse = HTTP/1.1 500 Internal
Server Error
[junit] responseCode=500, response=Internal Server Error
[junit] <HTML>
[junit] <HEAD>
[junit] <TITLE>Error 500 Internal Server Error</TITLE>
[junit] <BODY>
[junit] <H2>HTTP ERROR: 500 Internal Server Error</H2>
[junit] java.lang.ClassCastException:
java.lang.String<P>RequestURI=/jbosstest/restricted/include_
ejb.jsp
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit] </BODY>
[junit] </HTML>
[junit]
[junit] Connecting to:
http://jduke:theduke@localhost:8080/jbosstest/restricted/Sec
ureEJBAccess
[junit] HttpClient.reponse = HTTP/1.1 500 Internal
Server Error
[junit] responseCode=500, response=Internal Server Error
[junit] <HTML>
[junit] <HEAD>
[junit] <TITLE>Error 500 Internal Server Error</TITLE>
[junit] <BODY>
[junit] <H2>HTTP ERROR: 500 Internal Server Error</H2>
[junit] java.lang.ClassCastException:
java.lang.String<P>RequestURI=/jbosstest/restricted/SecureEJ
BAccess
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit] </BODY>
[junit] </HTML>
[junit]
[junit] Try #1
[junit] Connecting to:
http://jduke:theduke@localhost:8080/jbosstest/restricted/Sec
ureServlet
[junit] HttpClient.reponse = HTTP/1.1 500 Internal
Server Error
[junit] responseCode=500, response=Internal Server Error
[junit] <HTML>
[junit] <HEAD>
[junit] <TITLE>Error 500 Internal Server Error</TITLE>
[junit] <BODY>
[junit] <H2>HTTP ERROR: 500 Internal Server Error</H2>
[junit] java.lang.ClassCastException:
java.lang.String<P>RequestURI=/jbosstest/restricted/SecureSe
rvlet
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit] </BODY>
[junit] </HTML>
[junit]
[junit] Connecting to:
http://jduke:badpass@localhost:8080/jbosstest/restricted/Sec
ureServlet
[junit] HttpClient.reponse = HTTP/1.1 401 Unauthorized
[junit] responseCode=401, response=Unauthorized
[junit] <HTML>
[junit] <HEAD>
[junit] <TITLE>Error 401 Unauthorized</TITLE>
[junit] <BODY>
[junit] <H2>HTTP ERROR: 401 Unauthorized</H2>
[junit]
<P>RequestURI=/jbosstest/restricted/SecureServlet
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit] </BODY>
[junit] </HTML>
[junit]
[junit] Connecting to:
http://localhost:8080/jbosstest/restricted/SecureServlet
[junit] HttpClient.reponse = HTTP/1.1 401 Unauthorized
[junit] responseCode=401, response=Unauthorized
[junit] <HTML>
[junit] <HEAD>
[junit] <TITLE>Error 401 Unauthorized</TITLE>
[junit] <BODY>
[junit] <H2>HTTP ERROR: 401 Unauthorized</H2>
[junit]
<P>RequestURI=/jbosstest/restricted/SecureServlet
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit] </BODY>
[junit] </HTML>
[junit]
[junit] Connecting to:
http://jduke:theduke@localhost:8080/jbosstest/snoop.jsp
[junit] HttpClient.reponse = HTTP/1.1 200 OK
[junit] responseCode=200, response=OK
[junit] Connecting to:
http://jduke:theduke@localhost:8080/jbosstest/UnsecureEJBAcc
ess
[junit] HttpClient.reponse = HTTP/1.1 200 OK
[junit] responseCode=200, response=OK
[junit] Try #1
[junit] Connecting to:
http://jduke:theduke@localhost:8080/jbosstest/other/restrict
ed/test
[junit] HttpClient.reponse = HTTP/1.1 500 Internal
Server Error
[junit] responseCode=500, response=Internal Server Error
[junit] <HTML>
[junit] <HEAD>
[junit] <TITLE>Error 500 Internal Server Error</TITLE>
[junit] <BODY>
[junit] <H2>HTTP ERROR: 500 Internal Server Error</H2>
[junit] java.lang.ClassCastException:
java.lang.String<P>RequestURI=/jbosstest/other/restricted/te
st
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit]
[junit] </BODY>
[junit] </HTML>
[junit]
[junit] Tests run: 14, Failures: 5, Errors: 0, Time
elapsed: 10.602 sec
[junit] TEST org.jboss.test.web.test.TestWebIntegration
FAILED
BUILD SUCCESSFUL
Total time: 13 seconds
[starksm@banshee build]$
----------------------------------------------------------------------
Comment By: Jason Vasquez (jpvasquez)
Date: 2001-11-29 12:02
Message:
Logged In: YES
user_id=639
This is the JBoss-2.4.3_Jetty-3.1.3-1.zip downloaded from
http://www.jboss.org/binary.jsp
----------------------------------------------------------------------
Comment By: Scott M Stark (starksm)
Date: 2001-11-29 11:33
Message:
Logged In: YES
user_id=175228
Describe the versions being used more clearly. This appears
to be an old Jetty bundle where the
org.jboss.jetty.JBossUserRealm$User class is passing a
String representation of a role rather than a Principal as
required.
----------------------------------------------------------------------
You can respond by visiting:
http://sourceforge.net/tracker/?func=detail&atid=376685&aid=487071&group_id=22866
_______________________________________________
Jboss-development mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/jboss-development
