Thanks a lot. I was able to successfully create a custom tomcat valve (code attached below). This even allowed automatic login to my user and displayed the default page as "User logged in: ". However I think this user is still not authorized to access anything that is below the /auth access.
When I call the this.container.getRealm().authenticate method in the valve I am forwarded to the JBossSecurityMgrRealm.authenticate method. In this method, the securityCtx object is null and so I just get a null from the function. I think this is the problem why my users are not being authorized. Can you please shed some light as to where I could be going wrong. So in short all I have changed in the Jboss AS code is adding this custom valve and changing the server.xml I have not changed anything in the Jboss Portal code at all. /* | * JBoss, Home of Professional Open Source. | * Copyright 2006, Red Hat Middleware LLC, and individual contributors | * as indicated by the @author tags. See the copyright.txt file in the | * distribution for a full listing of individual contributors. | * | * This is free software; you can redistribute it and/or modify it | * under the terms of the GNU Lesser General Public License as | * published by the Free Software Foundation; either version 2.1 of | * the License, or (at your option) any later version. | * | * This software is distributed in the hope that it will be useful, | * but WITHOUT ANY WARRANTY; without even the implied warranty of | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | * Lesser General Public License for more details. | * | * You should have received a copy of the GNU Lesser General Public | * License along with this software; if not, write to the Free | * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA | * 02110-1301 USA, or see the FSF site: http://www.fsf.org. | */ | package org.jboss.web.tomcat.security; | | import java.io.IOException; | import java.security.Principal; | import java.security.acl.Group; | import java.util.ArrayList; | import java.util.List; | | import javax.security.auth.Subject; | import javax.servlet.ServletException; | | import org.apache.catalina.connector.Request; | import org.apache.catalina.connector.Response; | import org.apache.catalina.Context; | import org.apache.catalina.Session; | | import org.apache.catalina.realm.GenericPrincipal; | import org.apache.catalina.valves.ValveBase; | import org.jboss.logging.Logger; | import org.jboss.security.SecurityAssociation; | import org.jboss.security.SimpleGroup; | | //import com.sun.security.auth.UserPrincipal; | | //import com.sun.security.auth.UserPrincipal; | | /** A valve that provides information on the jaas login exception seen in the | SecurityAssociation exception data. The useExceptionAsMsg flag indicates if | the exception message should be set as the http response message. The | exceptionHeader attribute if set is the header name that should be populated | with the exception message. | | @author [EMAIL PROTECTED] | @version $Revision: 57206 $ | */ | public class BasicAuthValve | extends ValveBase | { | private static Logger log = Logger.getLogger(BasicAuthValve.class); | private static boolean trace = log.isTraceEnabled(); | | /** Should the exception message be used as the request status message */ | private boolean useExceptionAsMsg = false; | /** A flag indicating if the auth exception thread local should be cleared */ | private boolean clearAuthException = true; | /** The name of the reply header to use to return the exception message */ | private String exceptionHeader = null; | | public boolean isUseExceptionAsMsg() | { | return useExceptionAsMsg; | } | public void setUseExceptionAsMsg(boolean useExceptionAsMsg) | { | this.useExceptionAsMsg = useExceptionAsMsg; | } | | public String getExceptionHeader() | { | return exceptionHeader; | } | public void setExceptionHeader(String exceptionHeader) | { | this.exceptionHeader = exceptionHeader; | } | | public void invoke(Request request, Response response) | throws IOException, ServletException | { | // TODO Auto-generated method stub | List roles = new ArrayList(); | roles.add("Authenticated"); | roles.add("User"); | roles.add("Admin"); | roles.add("CustomRole"); | | String password = "user"; | String username = "user"; | | Principal p = this.getContainer().getRealm().authenticate(username, (String)null); | request.setAuthType("FORM"); | request.setUserPrincipal(new GenericPrincipal(request.getContext().getRealm(), username, password, roles)); | | this.getNext().invoke(request, response); | | } | | } | View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4135811#4135811 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4135811 _______________________________________________ jboss-user mailing list [email protected] https://lists.jboss.org/mailman/listinfo/jboss-user
