Bugs item #1056596, was opened at 2004-10-29 00:06 Message generated for change (Comment added) made by starksm You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=376685&aid=1056596&group_id=22866
Category: JBossSX Group: v3.2 >Status: Closed >Resolution: Fixed Priority: 5 Submitted By: Michael Lipp (drmlipp) Assigned to: Scott M Stark (starksm) Summary: Username passed to LoginModule from EJB tier Initial Comment: I'm using my own login module since 2.x. One special feature of this module is that the principal returned after successful authentication is not the user name. It is a special id associated with the user name (yes, this does make sense, actually it is common practice: think of Unix, your user id is independant of your login name which allows you to change your name [e.g. marry] without having to change the owner of all your files afterwards; the same applies here: if a user name changes, I do not want to create a new user and copy the role assignments from the "old" to the "new" user). When upgrading from 3.2.5 to 3.2.6, my module didn't work anymore. I tracked things down and found that the result of the name callback issued in my login module now depends on the invocation context. When my login module is invoked by the web tier (step 1), I get the username as it was entered in the browser's username/password prompt. Later, when the web tier (i.e. servlet) tries to invoke ejbs' methods (step 2), the ejb container invokes my login module again. But now I get the name of the principal returned by my login module during step 1, not the user name entered by the user in the authentication dialog. Before 3.2.6, I got the user name here as well. ---------------------------------------------------------------------- >Comment By: Scott M Stark (starksm) Date: 2004-11-07 16:20 Message: Logged In: YES user_id=175228 This has been fixed by maintaining the principal seen for authentication in the web session level cached value and passing this principal as the security context principal on ejb calls. ---------------------------------------------------------------------- Comment By: Scott M Stark (starksm) Date: 2004-11-06 07:47 Message: Logged In: YES user_id=175228 Show how the principal is being modified. Is this the Principal in the Subject principal set, or is it the principal in the 'CallerPrincipal' Group. ---------------------------------------------------------------------- Comment By: Francisco Piragibe (fpiragibe) Date: 2004-11-03 18:46 Message: Logged In: YES user_id=1152172 This has broken my auth procedures, too. And I'm using only standard modules!! In my application, the username is checked against a database, and, upon success, CallerIdentityLoginModule is used to everything else. The first authentication behaves normally, but, after that, all I got is "invalid authentication attempt" error messages, surprisingly stating a correct principal (i.e - invalid authentication attempt - principal: <correct, authenticated, username>). JBoss 4.0 has the same behaviour. I'm stuck on 3.2.5, it seems. I've tried to look into the code for clues, but I couldn't find where to patch it. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=376685&aid=1056596&group_id=22866 ------------------------------------------------------- This SF.Net email is sponsored by: Sybase ASE Linux Express Edition - download now for FREE LinuxWorld Reader's Choice Award Winner for best database on Linux. http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click _______________________________________________ JBoss-Development mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-development
