Hello again!
Sorry about repeating this request for help but I'm really stuck. Here's my
post again:
---
I'm trying to implement JAAS based security in accordans with the document
"JAAS Based Security in JBoss" at the JBoss site and I've followed and
implemented every step of the tutorial. But although the login doesn't
signal failure, my beans are no longer accessible. When I'm trying to access
an ordinary session bean, I get the following exception:
"...
User is logged in.
...
javax.naming.ServiceUnavailableException: Operation timed out: connect.
Root exception is java.net.ConnectException: Operation timed out: connect"
My guess is that the login procedure doesn't work as it should. I've tried
logins that should fail but every combination of user name and password is
accepted. I start the client as follows:
java -classpath
... -Djava.security.auth.login.config=file:///config/auth.conf ClassName
The auth.conf file looks like this
srp {
...
};
other {
org.jboss.security.ClientLoginModule required;
};
On the server side, I have a similar auth.conf file but with three entries:
simple, other and roles:
simple {
org.jboss.security.plugins.samples.SimpleServerLoginModule required;
};
other {
org.jboss.security.plugins.samples.JaasServerLoginModule required;
};
roles {
org.jboss.security.plugins.samples.JaasServerLoginModule required;
password-stacking="useFirstPass";
org.jboss.security.plugins.samples.RolesLoginModule required;
};
I've amended the standardjboss.xml file so that my entity and session beans
will use the RolesLoginModule:
<jboss>
<secure>false</secure>
<security-domain>java:/jaas/other</security-domain>
<container-configurations>
<container-configuration>
<container-name>Standard CMP EntityBean</container-name>
<role-mapping-manager>java:/jaas/roles</role-mapping-manager>
...
In the jboss.jcml file, there are three entries that applies to security:
<!-- JAAS security manager and realm mapping -->
<mbean code="org.jboss.security.plugins.JaasSecurityManagerService"
name="DefaultDomain:service=JaasSecurityManager">
<attribute
name="SecurityManagerClassName">org.jboss.security.plugins.JaasSecurityManag
er</attribute>
<attribute
name="SecurityProxyFactoryClassName">org.jboss.security.SubjectSecurityProxy
Factory</attribute>
</mbean>
<!-- Direct implementation of realm mapping (sample) -->
<mbean code="org.jboss.security.plugins.samples.SimpleRealmMappingService"
name="DefaultDomain:service=SimpleRealmMappingFactory" />
<!-- Direct implementation of security manager (sample) -->
<mbean code="org.jboss.security.plugins.samples.EJBSecurityManagerService"
name="DefaultDomain:service=EJBSecurityManager" />
I've also added a users.properties and roles.properties in the conf/tomcat
directory (as I'm using the tomcat config). And I've changed the ejb-jars of
my beans so that every method now requires the caller to have a certain
role.
All this according to http://www.jboss.org/documentation/HTML/ch11s78.html
(as far as I can see at least).
I'm using JBOSS 2.2.1 on Win2000.
Please advice!
Regards,
Pelle Poluha
_______________________________________________
JBoss-user mailing list
[EMAIL PROTECTED]
http://lists.sourceforge.net/lists/listinfo/jboss-user
