subject:"JAAS"


Hi,

I haven't found anywhere a step-by-step instructions or reference code on how 
to set up jaas. Please help me with this as I'm very much lost.


What I need:
- authentication vs a DB
- a ROOT webapp
- tomcat 5.5
- where to put the 'Realm' element (can it be in 
conf/Catalina/localhost/ROOT.xml?)
- what to put inside jaas.config
- where to get an implementation of a login module. tagish isn't good for me 
since they require a specific db schema (i'm porting an existing application). 
Is there a standalone package with jboss's implementations?


Thanx,
Ittay


--
===
Ittay Dror ([EMAIL PROTECTED])
Application Team Leader, RD
Qlusters Inc.
+972-3-6081994 Fax: +972-3-6081841

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: instructions for setting up jaas over db in tomcat

2005-08-29 Thread Robert Taylor


I used the following link:

http://jakarta.apache.org/tomcat/tomcat-5.5-doc/realm-howto.html#JAASRealm

It tooks some research, but I finally got it to work.

/robert


Ittay Dror wrote:

Hi,

I haven't found anywhere a step-by-step instructions or reference code 
on how to set up jaas. Please help me with this as I'm very much lost.


What I need:
- authentication vs a DB
- a ROOT webapp
- tomcat 5.5
- where to put the 'Realm' element (can it be in 
conf/Catalina/localhost/ROOT.xml?)

- what to put inside jaas.config
- where to get an implementation of a login module. tagish isn't good 
for me since they require a specific db schema (i'm porting an existing 
application). Is there a standalone package with jboss's implementations?


Thanx,
Ittay





-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: instructions for setting up jaas over db in tomcat




Robert Taylor wrote:

I used the following link:

http://jakarta.apache.org/tomcat/tomcat-5.5-doc/realm-howto.html#JAASRealm


doesn't contain whether i can put 'Realm' in ROOT.xml

doesn't say anything about where to get a LoginModule implementation, or how to 
config jaas.config.




It tooks some research, but I finally got it to work.


my point exactly. i believe every person setting up tomcat does this research 
and i wondered if anyone created a guide.




/robert


Ittay Dror wrote:


Hi,

I haven't found anywhere a step-by-step instructions or reference code 
on how to set up jaas. Please help me with this as I'm very much lost.


What I need:
- authentication vs a DB
- a ROOT webapp
- tomcat 5.5
- where to put the 'Realm' element (can it be in 
conf/Catalina/localhost/ROOT.xml?)

- what to put inside jaas.config
- where to get an implementation of a login module. tagish isn't good 
for me since they require a specific db schema (i'm porting an 
existing application). Is there a standalone package with jboss's 
implementations?


Thanx,
Ittay





-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]





--
===
Ittay Dror ([EMAIL PROTECTED])
Application Team Leader, RD
Qlusters Inc.
+972-3-6081994 Fax: +972-3-6081841

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: instructions for setting up jaas over db in tomcat


btw, i also need authentication vs an ldap server

thanx,
ittay

Ittay Dror wrote:



Robert Taylor wrote:


I used the following link:

http://jakarta.apache.org/tomcat/tomcat-5.5-doc/realm-howto.html#JAASRealm 




doesn't contain whether i can put 'Realm' in ROOT.xml

doesn't say anything about where to get a LoginModule implementation, or 
how to config jaas.config.




It tooks some research, but I finally got it to work.



my point exactly. i believe every person setting up tomcat does this 
research and i wondered if anyone created a guide.




/robert


Ittay Dror wrote:


Hi,

I haven't found anywhere a step-by-step instructions or reference 
code on how to set up jaas. Please help me with this as I'm very much 
lost.


What I need:
- authentication vs a DB
- a ROOT webapp
- tomcat 5.5
- where to put the 'Realm' element (can it be in 
conf/Catalina/localhost/ROOT.xml?)

- what to put inside jaas.config
- where to get an implementation of a login module. tagish isn't good 
for me since they require a specific db schema (i'm porting an 
existing application). Is there a standalone package with jboss's 
implementations?


Thanx,
Ittay





-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]








--
===
Ittay Dror ([EMAIL PROTECTED])
Application Team Leader, RD
Qlusters Inc.
+972-3-6081994 Fax: +972-3-6081841

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: instructions for setting up jaas over db in tomcat

2005-08-29 Thread Robert Taylor


Have you read anything here?
http://java.sun.com/j2se/1.4.2/docs/guide/security/jaas/tutorials/GeneralAcnOnly.html

/robert

Ittay Dror wrote:



Robert Taylor wrote:


I used the following link:

http://jakarta.apache.org/tomcat/tomcat-5.5-doc/realm-howto.html#JAASRealm 




doesn't contain whether i can put 'Realm' in ROOT.xml

doesn't say anything about where to get a LoginModule implementation, or 
how to config jaas.config.




It tooks some research, but I finally got it to work.



my point exactly. i believe every person setting up tomcat does this 
research and i wondered if anyone created a guide.




/robert


Ittay Dror wrote:


Hi,

I haven't found anywhere a step-by-step instructions or reference 
code on how to set up jaas. Please help me with this as I'm very much 
lost.


What I need:
- authentication vs a DB
- a ROOT webapp
- tomcat 5.5
- where to put the 'Realm' element (can it be in 
conf/Catalina/localhost/ROOT.xml?)

- what to put inside jaas.config
- where to get an implementation of a login module. tagish isn't good 
for me since they require a specific db schema (i'm porting an 
existing application). Is there a standalone package with jboss's 
implementations?


Thanx,
Ittay





-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]








-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: instructions for setting up jaas over db in tomcat

2005-08-29 Thread Wendy Smoak


From: Ittay Dror [EMAIL PROTECTED]


btw, i also need authentication vs an ldap server


I recently got JAASRealm and Sun's Krb5LoginModule (Kerberos Authentication) 
to work for the JSP examples that ship with Tomcat... this may save you some 
pain:


  http://wiki.wsmoak.net/cgi-bin/wiki.pl?TomcatJspExamples

You'll have to figure out what to put in jaas.conf and find a LoginModule 
for LDAP, but other than that the pieces should fit together the same way.


--
Wendy Smoak 



-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE: instructions for setting up jaas over db in tomcat

2005-08-29 Thread Guy Katz

tomcat website has a server configuration link and it states for every element 
in the server.xml which sub elements are possible. along with knowledge of JAAS 
you have to acuire alone and the JAAS Realm configuration link you have been 
given, i would say you are set.

-Original Message-
From: Ittay Dror [mailto:[EMAIL PROTECTED]
Sent: Monday, August 29, 2005 10:48 PM
To: Tomcat Users List
Subject: Re: instructions for setting up jaas over db in tomcat

Robert Taylor wrote:
 I used the following link:

 http://jakarta.apache.org/tomcat/tomcat-5.5-doc/realm-howto.html#JAASRealm

doesn't contain whether i can put 'Realm' in ROOT.xml

doesn't say anything about where to get a LoginModule implementation, or how to 
config jaas.config.

 It tooks some research, but I finally got it to work.

my point exactly. i believe every person setting up tomcat does this research 
and i wondered if anyone created a guide.

 /robert

 Ittay Dror wrote:

 Hi,

 I haven't found anywhere a step-by-step instructions or reference code 
 on how to set up jaas. Please help me with this as I'm very much lost.

 What I need:
 - authentication vs a DB
 - a ROOT webapp
 - tomcat 5.5
 - where to put the 'Realm' element (can it be in 
 conf/Catalina/localhost/ROOT.xml?)
 - what to put inside jaas.config
 - where to get an implementation of a login module. tagish isn't good 
 for me since they require a specific db schema (i'm porting an 
 existing application). Is there a standalone package with jboss's 
 implementations?

 Thanx,
 Ittay

 -
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]

-- 
===
Ittay Dror ([EMAIL PROTECTED])
Application Team Leader, RD
Qlusters Inc.
+972-3-6081994 Fax: +972-3-6081841

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: instructions for setting up jaas over db in tomcat




Guy Katz wrote:

tomcat website has a server configuration link and it states for every element 
in the server.xml which sub elements are possible. along with knowledge of JAAS 
you have to acuire alone and the JAAS Realm configuration link you have been 
given, i would say you are set.


can i put the Realm statement in Catalina/localhost/ROOT.xml?



-Original Message-
From: Ittay Dror [mailto:[EMAIL PROTECTED]
Sent: Monday, August 29, 2005 10:48 PM
To: Tomcat Users List
Subject: Re: instructions for setting up jaas over db in tomcat




Robert Taylor wrote:


I used the following link:

http://jakarta.apache.org/tomcat/tomcat-5.5-doc/realm-howto.html#JAASRealm



doesn't contain whether i can put 'Realm' in ROOT.xml

doesn't say anything about where to get a LoginModule implementation, or how to 
config jaas.config.




It tooks some research, but I finally got it to work.



my point exactly. i believe every person setting up tomcat does this research 
and i wondered if anyone created a guide.




/robert


Ittay Dror wrote:



Hi,

I haven't found anywhere a step-by-step instructions or reference code 
on how to set up jaas. Please help me with this as I'm very much lost.


What I need:
- authentication vs a DB
- a ROOT webapp
- tomcat 5.5
- where to put the 'Realm' element (can it be in 
conf/Catalina/localhost/ROOT.xml?)

- what to put inside jaas.config
- where to get an implementation of a login module. tagish isn't good 
for me since they require a specific db schema (i'm porting an 
existing application). Is there a standalone package with jboss's 
implementations?


Thanx,
Ittay





-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]









--
===
Ittay Dror ([EMAIL PROTECTED])
Application Team Leader, RD
Qlusters Inc.
+972-3-6081994 Fax: +972-3-6081841

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE: instructions for setting up jaas over db in tomcat

2005-08-29 Thread Guy Katz

if the Realm element can reside inside the elements in the root.xml 
(specifically the Context element) then yes.
you can check this in the server.xml configuration docs on the tomcat website.

-Original Message-
From: Ittay Dror [mailto:[EMAIL PROTECTED]
Sent: Tuesday, August 30, 2005 7:49 AM
To: Tomcat Users List
Subject: Re: instructions for setting up jaas over db in tomcat

Guy Katz wrote:
 tomcat website has a server configuration link and it states for every 
 element in the server.xml which sub elements are possible. along with 
 knowledge of JAAS you have to acuire alone and the JAAS Realm configuration 
 link you have been given, i would say you are set.

can i put the Realm statement in Catalina/localhost/ROOT.xml?

 -Original Message-
 From: Ittay Dror [mailto:[EMAIL PROTECTED]
 Sent: Monday, August 29, 2005 10:48 PM
 To: Tomcat Users List
 Subject: Re: instructions for setting up jaas over db in tomcat

 Robert Taylor wrote:

I used the following link:

http://jakarta.apache.org/tomcat/tomcat-5.5-doc/realm-howto.html#JAASRealm

 doesn't contain whether i can put 'Realm' in ROOT.xml

 doesn't say anything about where to get a LoginModule implementation, or how 
 to 
 config jaas.config.

It tooks some research, but I finally got it to work.

 my point exactly. i believe every person setting up tomcat does this research 
 and i wondered if anyone created a guide.

/robert

Ittay Dror wrote:

Hi,

I haven't found anywhere a step-by-step instructions or reference code 
on how to set up jaas. Please help me with this as I'm very much lost.

What I need:
- authentication vs a DB
- a ROOT webapp
- tomcat 5.5
- where to put the 'Realm' element (can it be in 
conf/Catalina/localhost/ROOT.xml?)
- what to put inside jaas.config
- where to get an implementation of a login module. tagish isn't good 
for me since they require a specific db schema (i'm porting an 
existing application). Is there a standalone package with jboss's 
implementations?

Thanx,
Ittay

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

-- 
===
Ittay Dror ([EMAIL PROTECTED])
Application Team Leader, RD
Qlusters Inc.
+972-3-6081994 Fax: +972-3-6081841

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

howto configure JAAS+SSO

2005-08-16 Thread Edmund Urbani



hello!

I'm trying to configure two webapps (slide and jetspeed2) for 
single-sign-on in the same tomcat instance. Both apps use JAAS and come 
with their own JAAS login modules. Is it possible to configure these 
(any?) two apps to share login info with JAAS. I started reading the 
JAAS docs recently and I tried putting the two login modules into one 
JAAS login context, but that does not seem to work, because the login 
module classes won't instantiate properly due to dependencies to their 
respective webapps.


Can SSO be achieved without having the apps share one login context?
Will I have to write my own login module(s)?
Should I use a (completely) different approach to get SSO?

Thanks for any help/advice.

Edmund


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE: howto configure JAAS+SSO

2005-08-16 Thread Mark Benussi

Hi Edmund.

I am sorry but I don't know much about SSO.

However I can tell you about JAAS in Tomcat. In 5 certainly there are
issues. Essentially when you call the LoginModule to invoke your JAAS config
it works but it does not authenticate the proper session Subject. What you
end up doing (Or what I did) was place a request filter in the app that
wraps the request with an overridden RequestWrapper and you write your own
inUserInRole against the Subject that the LoginModule returns (By placing it
in the session)

If you want some code, taken from Wendy Smoak and others I can provide.

-Original Message-
From: Edmund Urbani [mailto:[EMAIL PROTECTED] 
Sent: 16 August 2005 13:14
To: Tomcat Users List
Subject: howto configure JAAS+SSO


hello!

I'm trying to configure two webapps (slide and jetspeed2) for 
single-sign-on in the same tomcat instance. Both apps use JAAS and come 
with their own JAAS login modules. Is it possible to configure these 
(any?) two apps to share login info with JAAS. I started reading the 
JAAS docs recently and I tried putting the two login modules into one 
JAAS login context, but that does not seem to work, because the login 
module classes won't instantiate properly due to dependencies to their 
respective webapps.

Can SSO be achieved without having the apps share one login context?
Will I have to write my own login module(s)?
Should I use a (completely) different approach to get SSO?

Thanks for any help/advice.

 Edmund


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: howto configure JAAS+SSO

2005-08-16 Thread Edmund Urbani


Mark Benussi wrote:


Hi Edmund.

I am sorry but I don't know much about SSO.

However I can tell you about JAAS in Tomcat. In 5 certainly there are
issues. Essentially when you call the LoginModule to invoke your JAAS config
it works but it does not authenticate the proper session Subject. What you
end up doing (Or what I did) was place a request filter in the app that
wraps the request with an overridden RequestWrapper and you write your own
inUserInRole against the Subject that the LoginModule returns (By placing it
in the session)

If you want some code, taken from Wendy Smoak and others I can provide.

 


thanks.

I'm currently considering to write my own login module in order to share 
authentication data across login contexts. i would need to access 
session cookies from the module and i'm not sure how/if this can be done 
yet.


i've never written a requestwrapper myself, so i can't really tell how 
hard/complicated that would be. i'd be glad, if you could provide me 
with some code to look at. that could certainly help me decide on how to 
go on about that SSO requirement.


Edmund


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE: howto configure JAAS+SSO [Apologies code attached]

2005-08-16 Thread Mark Benussi

1.Filter to go in web.xml

/**
 * [EMAIL PROTECTED] javax.servlet.Filter Filter} to overide the 
HttpServletRequest and
 * overide isUserInRole() using the
 * [EMAIL PROTECTED] com.ibt.framework.security.tomcat.HttpServletRequestWrapper
HttpServletRequestWrapper}
 * 
 * @author Mark Benussi
 */
public class HttpServletRequestFilter implements Filter {

/**
 * @see javax.servlet.Filter#destroy()
 */
public void destroy() {
}

/**
 * @see javax.servlet.Filter#doFilter(javax.servlet.ServletRequest,
 *  javax.servlet.ServletResponse, javax.servlet.FilterChain)
 */
public void doFilter(ServletRequest request, ServletResponse
response,
FilterChain chain) throws IOException,
ServletException {

HttpServletRequest httpServletRequest = (HttpServletRequest)
request;
HttpServletRequestWrapper wrappedRequest = new
HttpServletRequestWrapper(
httpServletRequest);
chain.doFilter(wrappedRequest, response);
}

/**
 * @see javax.servlet.Filter#init(javax.servlet.FilterConfig)
 */
public void init(FilterConfig config) throws ServletException {
}
}

2. Request wrapper

/**
 * Wraps the [EMAIL PROTECTED] javax.servlet.http.HttpServletRequest
HttpServletRequest} 
 * @author Mark Benussi
 */
public class HttpServletRequestWrapper extends
javax.servlet.http.HttpServletRequestWrapper {

/**
 * The original [EMAIL PROTECTED] javax.servlet.http.HttpServletRequest
HttpServletRequest}
 */
private HttpServletRequest request = null;

/**
 * Helper to manage any common security methods
 */
private static SecurityHelper jaasHelper = null;

/**
 * Default constructor
 * 
 * @param request
 *The original [EMAIL PROTECTED]
javax.servlet.http.HttpServletRequest HttpServletRequest}
 */
public HttpServletRequestWrapper(HttpServletRequest request) {

super(request);
if (jaasHelper == null) {
jaasHelper = new SecurityHelper();
}
this.request = request;
}

/**
 * @see
javax.servlet.http.HttpServletRequestWrapper#isUserInRole(java.lang.String)
 */
public boolean isUserInRole(String role) {

Subject subject = jaasHelper.getSessionSubject(request,
false);
return jaasHelper.isSubjectInRole(subject, role);
}
}

3. When you call youre LoginModule get the Subject and place in the session
and then write your own code to validate the Subject has the role required.

4. As for passing the session to your LoginModule, which I wouldn't do in a
puristic way as the LoginModule should be able to be used by a wing app just
as much as a web app.

Contstruct a CallBackHandler with the username and password but also with
the session or request. Then in your loginmodule you will have access to the
request/session when you invoke handle callback


-Original Message-
From: Edmund Urbani [mailto:[EMAIL PROTECTED] 
Sent: 16 August 2005 15:14
To: Tomcat Users List
Subject: Re: howto configure JAAS+SSO

Mark Benussi wrote:

Hi Edmund.

I am sorry but I don't know much about SSO.

However I can tell you about JAAS in Tomcat. In 5 certainly there are
issues. Essentially when you call the LoginModule to invoke your JAAS
config
it works but it does not authenticate the proper session Subject. What you
end up doing (Or what I did) was place a request filter in the app that
wraps the request with an overridden RequestWrapper and you write your own
inUserInRole against the Subject that the LoginModule returns (By placing
it
in the session)

If you want some code, taken from Wendy Smoak and others I can provide.

  

thanks.

I'm currently considering to write my own login module in order to share 
authentication data across login contexts. i would need to access 
session cookies from the module and i'm not sure how/if this can be done 
yet.

i've never written a requestwrapper myself, so i can't really tell how 
hard/complicated that would be. i'd be glad, if you could provide me 
with some code to look at. that could certainly help me decide on how to 
go on about that SSO requirement.

 Edmund


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: howto configure JAAS+SSO [Apologies code attached]

2005-08-16 Thread Edmund Urbani


Mark Benussi wrote:


1.Filter to go in web.xml

/**
* [EMAIL PROTECTED] javax.servlet.Filter Filter} to overide the 
HttpServletRequest and
* overide isUserInRole() using the
* [EMAIL PROTECTED] com.ibt.framework.security.tomcat.HttpServletRequestWrapper
HttpServletRequestWrapper}
* 
* @author Mark Benussi

*/
public class HttpServletRequestFilter implements Filter {

/**
 * @see javax.servlet.Filter#destroy()
 */
public void destroy() {
}

/**
 * @see javax.servlet.Filter#doFilter(javax.servlet.ServletRequest,
 *  javax.servlet.ServletResponse, javax.servlet.FilterChain)
 */
public void doFilter(ServletRequest request, ServletResponse
response,
FilterChain chain) throws IOException,
ServletException {

HttpServletRequest httpServletRequest = (HttpServletRequest)
request;
HttpServletRequestWrapper wrappedRequest = new
HttpServletRequestWrapper(
httpServletRequest);
chain.doFilter(wrappedRequest, response);
}

/**
 * @see javax.servlet.Filter#init(javax.servlet.FilterConfig)
 */
public void init(FilterConfig config) throws ServletException {
}
}

2. Request wrapper

/**
* Wraps the [EMAIL PROTECTED] javax.servlet.http.HttpServletRequest
HttpServletRequest} 
* @author Mark Benussi

*/
public class HttpServletRequestWrapper extends
javax.servlet.http.HttpServletRequestWrapper {

/**
 * The original [EMAIL PROTECTED] javax.servlet.http.HttpServletRequest
HttpServletRequest}
 */
private HttpServletRequest request = null;

/**
 * Helper to manage any common security methods
 */
private static SecurityHelper jaasHelper = null;

/**
 * Default constructor
	 * 
	 * @param request

 *The original [EMAIL PROTECTED]
javax.servlet.http.HttpServletRequest HttpServletRequest}
 */
public HttpServletRequestWrapper(HttpServletRequest request) {

super(request);
if (jaasHelper == null) {
jaasHelper = new SecurityHelper();
}
this.request = request;
}

/**
 * @see
javax.servlet.http.HttpServletRequestWrapper#isUserInRole(java.lang.String)
 */
public boolean isUserInRole(String role) {

Subject subject = jaasHelper.getSessionSubject(request,
false);
return jaasHelper.isSubjectInRole(subject, role);
}
}

3. When you call youre LoginModule get the Subject and place in the session
and then write your own code to validate the Subject has the role required.

4. As for passing the session to your LoginModule, which I wouldn't do in a
puristic way as the LoginModule should be able to be used by a wing app just
as much as a web app.
 

well. my login module would be for the very special purpose of making 
SSO of webapps possible, so i wouldn't have much of a problem with this.



Contstruct a CallBackHandler with the username and password but also with
the session or request. Then in your loginmodule you will have access to the
request/session when you invoke handle callback

 



wow. thanks a lot!
the code looks much simpler than i would have expected.

i think this will do nicely. :)

Edmund


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: howto configure JAAS+SSO

2005-08-16 Thread Wendy Smoak


From: Mark Benussi [EMAIL PROTECTED]


However I can tell you about JAAS in Tomcat. In 5 certainly there are
issues. Essentially when you call the LoginModule to invoke your JAAS 
config

it works but it does not authenticate the proper session Subject.


Can you explain more about this?  I just _finally_ got the jsp-examples 
webapp that ships with Tomcat changed over to Kerberos authentication. Am I 
about to run into problems?


What you end up doing (Or what I did) was place a request filter in the 
app that

wraps the request with an overridden RequestWrapper and you write your own
inUserInRole against the Subject that the LoginModule returns (By placing 
it

in the session)

If you want some code, taken from Wendy Smoak ...


... who took it from one of Craig's tomcat-user posts. ;)
http://wiki.wsmoak.net/cgi-bin/wiki.pl?TomcatRequestWrapper

--
Wendy Smoak 



-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE: howto configure JAAS+SSO

2005-08-16 Thread Mark Benussi

Hi Wendy,

Sure I can explain what happens but not why.

When you call the LoginModule with an optional Subject and CallBack the code
works fine for me, i.e. it calls the LoginModule and I do everything I need,
placing the Principals into the Subject.

However... and this is where I don't want to say anything sweeping in case I
have just simply misunderstood the Subject that is authenticated via the
LoginModule has no visibility to Tomcat. If I could find a way to replace
the session Subject with the one passed back from the
LoginModule.getSubject() I would be ok, but I couldn't, so I placed the
authorised Subject in the session and overrode the request.isUserInRole() to
authorise against the Subject I placed in the session.

One of these days I might ask the Tomcat dev list what I was doing wrong but
got comments from other developers saying they had the same problem [All the
JAAS examples do it the way I have described in some shape or form]

Its not that bid a deal, and if you just use the Request wrapper I have
attached you know that in the future you can remove the filter if you go to
WebSphere or something like that.

-Original Message-
From: Wendy Smoak [mailto:[EMAIL PROTECTED] 
Sent: 16 August 2005 17:44
To: Tomcat Users List
Subject: Re: howto configure JAAS+SSO

From: Mark Benussi [EMAIL PROTECTED]

 However I can tell you about JAAS in Tomcat. In 5 certainly there are
 issues. Essentially when you call the LoginModule to invoke your JAAS 
 config
 it works but it does not authenticate the proper session Subject.

Can you explain more about this?  I just _finally_ got the jsp-examples 
webapp that ships with Tomcat changed over to Kerberos authentication. Am I 
about to run into problems?

 What you end up doing (Or what I did) was place a request filter in the 
 app that
 wraps the request with an overridden RequestWrapper and you write your own
 inUserInRole against the Subject that the LoginModule returns (By placing 
 it
 in the session)

 If you want some code, taken from Wendy Smoak ...

.. who took it from one of Craig's tomcat-user posts. ;)
http://wiki.wsmoak.net/cgi-bin/wiki.pl?TomcatRequestWrapper

-- 
Wendy Smoak 


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Last question on JAAS I promise

2005-08-09 Thread Mark Benussi

OK I got JAAS working with form authentication. That worked a treat (After a
bit of head banging).

I then moved to invoking the login from Struts (Or a Servlet for Tomcat
users who don't use Struts)

The code still gets invoked correctly.

IBTJAASCallbackHandler callbackHandler = new
IBTJAASCallbackHandler(loginForm.getUserName(), loginForm.getPassword());
LoginContext context = new LoginContext(IBTJAAS, callbackHandler);
context.login();

However the request.remoteUser() is now null (Was populated correctly when I
used form authentication) and the same for request.isUserInRole() (It
returns false, even though the Principal was added to the subject).

Any ideas...?

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

My first JAAS implementation. A few questions.

2005-08-08 Thread Mark Benussi

I am implementing my first JAAS implementation and have some
problems/questions.

Firstly my commit method of my LoginModule does the following (User and Role
both implement Principal)

// Create a new User Principal with the user name retrieved from the
NameCallback
User user = new User(username);
// Add the principal to the subject
subject.getPrincipals().add(user);

for (int i = 0; i  roles.length; i++) {
// Iterate the role names retrieved from the database lookup
   String roleName = roles[i];
   // Create a new Role Principal with the role name
Role role = new Role(roleName);
// Add it to the public credentials to see if it works
subject.getPublicCredentials().add(role);
// Add it to the private credentials to see if it works
subject.getPrivateCredentials().add(role);
}
return true;

In the JSP that the application returns to after doing form based
authentication the following occurs

pSubject = %= Subject.getSubject(AccessController.getContext()) %/p
pRemote User = %= request.getRemoteUser() %/p
pUser Prinicipal = %= request.getUserPrincipal() %/p

But this produces

Subject = null
Remote User = administrator
User Prinicipal = GenericPrincipal[administrator()]
Why is the subject null please?

The request.isUserInRole() methods for the role names I added to the subject
also return false... has anyone got some helpful ideas please?

If more source is needed I can gladly provide it if will help

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

JAAS with EJB

2005-07-19 Thread Amleto Di Salle

Hi all,
I am using JAAS with EJB, i.e. inside MyLoginModule i use an EJB in
order to authenticate the user.
When I try to get the Home Interface, I have the ClassCastException in
the PortableRemoteObject.narrow method.

I use Tomcat 5.0.28 and Jboss4.0.2 (EJB container) running in two
separates JVM.



Best Regards
Amleto Di Salle

-- 
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.9.1/51 - Release Date: 18/07/2005
 


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

JAAS

2005-07-11 Thread ronald

I've been trying to get the JavaWorld example located at
http://www.javaworld.com/javaworld/jw-03-2005/jw-0307-captcha.html

On tomcat v5.5.9 (JDK 1.5) on Linux without any luck. It goes through
the authentication process and reports it's assigned the anonymous
principle but when I go to access the protected directory again it
prompts for the login.jsp page again. 


Any ideas guys 


Thanks 

Ron 







-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

JAAS LoginModule weird error

2005-05-25 Thread Faine, Mark


I've written a JAAS Login Module for my web application that authenticates
against a third party (Documentum) content management server.  It works fine
but it seems to attempt to login once before the dialog is even presented to
the user.

The logs show:

DfPrincipalException:: THREAD: http-443-Processor13; MSG:
[DM_API_E_NOUSERNAME]error:  No user name have been provided for a
connection.
... (more authentication failed messages from LoginModule code)
...


Yet I haven't even tried to login yet.  I am able to  login successfully
after this error but it still bothers me that something is causing it to
attempt a login before it even presents the dialog.

Any suggestion, solutions would be appreciated.

-Mark

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: JAAS LoginModule weird error

2005-05-25 Thread Mark Thomas


Might be related to bug 22617 (which has been fixed in CVS).

Mark

Faine, Mark wrote:

I've written a JAAS Login Module for my web application that authenticates
against a third party (Documentum) content management server.  It works fine
but it seems to attempt to login once before the dialog is even presented to
the user.

The logs show:

DfPrincipalException:: THREAD: http-443-Processor13; MSG:
[DM_API_E_NOUSERNAME]error:  No user name have been provided for a
connection.
... (more authentication failed messages from LoginModule code)
...


Yet I haven't even tried to login yet.  I am able to  login successfully
after this error but it still bothers me that something is causing it to
attempt a login before it even presents the dialog.

Any suggestion, solutions would be appreciated.

-Mark

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]






-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Why is Tomcat trying to use JAAS?

2005-05-18 Thread Brandon Dove

I've just done a fresh install of Tomcat 5.5.9 and when I start
it up I see the following in catalina.out:

May 18, 2005 4:14:23 PM org.apache.catalina.realm.JAASRealm
setContainer
INFO: Set JAAS app name Catalina

I haven't configured a JAASRealm anywhere -- doing:

grep -i jaas $(find .)

in $TOMCAT_HOME returns no relevant config entries. Why is
Tomcat trying to use JAAS?

Cheers,

Brandon


Get your own 800 number
Voicemail, fax, email, and a lot more
http://www.ureach.com/reg/tag

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

slightly OT - JndiLoginModule, JAAS and user bind

2005-05-06 Thread Mark

Is it possible to use the JndiLoginModule class with JAAS to connect
to LDAP when the LDAP server only supports user binds.  The LDAP
server that I am trying to connect to does not provide user
information when connecting anonymously.

Thank you.

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

How do I Logout using JAAS

2005-04-14 Thread Scot Meyer

I have JAAS implemented and working properly.  Except
when I attempt to invalidate the session it keeps me
logged in.  Is this because of SSO?  What do I need to
do to Logout the user in question.

Thanks
Scotchy



__ 
Do you Yahoo!? 
Yahoo! Small Business - Try our new resources site!
http://smallbusiness.yahoo.com/resources/

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

JAAS: LoginConfig file in webapp

2005-04-12 Thread Jeroen Kransen

The tomcat documentation about JAASRealm suggests to pass the location 
of the JAAS config file as a parameter to the JVM (with JAVA_OPTS=...). 
It also mentions that there are alternatives. Can anyone tell me how to 
place the config file under /WEB-INF of a specific webapp and how to 
reference it? I don't want to tweak webapp specific things in Tomcat.

Jeroen
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: JAAS authentication and global realms

2005-04-04 Thread Guillaume Lederrey

  Once more, could you send those mails to the tomcat mailing-list and not 
directly to me ? It helps me to sort my mails and it can profit to more 
people ...

On Friday 01 April 2005 18.26, you wrote:
 My problem is I am not
 able to understand how to assign roles to a particular user. For example
 ..After the user is authenticated in the commit() I try to add principal to
 the subject with the set for roles as..
 subject.getPrincipals().add((principal));

  That should be correct.

 Though the role shows up under principals for the subject, he fails to be
 authenticated. Can you please help me. it's a bit urgent. Hope the problem
 was clear enough) Ops I am trying to use JAAS in Borland Enterprise Server.

  How do you check that the roles shows up in the principal ? Do you have an 
authentication or an authorization problem ? What implementation of Principal 
are you using ? Could you send the relevant java code ?

  Sorry that I'm not able to help you more right now ...


 Guillaume

-- 
Guillaume Lederrey
Rte des Arsenaux 15
1700 Fribourg

+41 76 / 573 32 40

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

JAAS authentication and global realms

2005-03-10 Thread Guillaume Lederrey

  Hello !

  I'm trying to use a host wide JAAS Realm. I've written the LoginModule and 
tested it by declaring the Realm in the Context/ of one of my app. This app 
is not declared in server.xml, but in its own context.xml in /webapps. 
Everything is working just fine. My LoginModule logs using just 
System.out.println(), so I fiind its logs in logs/catalina.out.

  When I move the Realm decleration from the context.xml to server.xml (either 
in the host/ node or the Engine/ node) it stops working ... I dont see 
any logs of any kind ...

  What am I doing wrong ? The doc made me think I could just move this Realm 
around to change its visibility, but there would not need to do anything 
more ...

  Thanks for the help.

 Guillaume

-- 


Guillaume Lederrey
Informaticien Développement
Tecost - Technology Consulting Studies
Fribourg (Switzerland)
http://www.tecost.ch/

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE : jaas with wlclient.jar returns no principals

2005-02-08 Thread LERBSCHER Jean-Pierre

Hi,
You have to :
configure your realm for example,
Realm className=org.apache.catalina.realm.JAASRealm 
appName=Sample   

userClassNames=weblogic.security.principal.WLSUserImpl   

roleClassNames=weblogic.security.principal.WLSGroupImpl 
debug=99/
in this case your can't access easily to subject
Configure your jaas config file.
app {
myLoginModule option debug=true params 
};
use the system property to declare jaas login file.
-Djava.security.auth.login.config=your path
Deploy your wlclient.jar in common/lib.
Configure your webapp to secure urls.
I think its all.


-Message d'origine-
De : [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
Envoyé : lundi 7 février 2005 16:18
À : tomcat-user@jakarta.apache.org
Objet : jaas with wlclient.jar returns no principals

We are developing a j2ee app using tomcat for the web container and 
weblogic for the ejb container. 
We are using jaas for authentication with weblogic. 
When our war is deployed on tomcat, using the wlclient.jar,  the jaas 
authentication returns no principals with the subject.  When we deploy our 
war on weblogic (or test a jaas client using weblogic.jar), the jaas 
authentication returns principlas.

What can we do to make the jaas authentication with a war deployed on 
tomcat work with weblogic?


Using WLClient.jar:
Subject is: Subject:
Private Credential: 
[EMAIL PROTECTED]
Private Credential: SubjectProxy[23994289]

Size of Principals: 0
Principals: 

Using Weblogic.jar:
Subject is: Subject:
Principal: mjLDAP
Private Credential: 
[EMAIL PROTECTED]
Private Credential: 
[EMAIL PROTECTED]

Size of Principals: 1
Principals: 
mjLDAP

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

jaas with wlclient.jar returns no principals

2005-02-07 Thread CMcDonald

We are developing a j2ee app using tomcat for the web container and 
weblogic for the ejb container. 
We are using jaas for authentication with weblogic. 
When our war is deployed on tomcat, using the wlclient.jar,  the jaas 
authentication returns no principals with the subject.  When we deploy our 
war on weblogic (or test a jaas client using weblogic.jar), the jaas 
authentication returns principlas.

What can we do to make the jaas authentication with a war deployed on 
tomcat work with weblogic?


Using WLClient.jar:
Subject is: Subject:
Private Credential: 
[EMAIL PROTECTED]
Private Credential: SubjectProxy[23994289]

Size of Principals: 0
Principals: 

Using Weblogic.jar:
Subject is: Subject:
Principal: mjLDAP
Private Credential: 
[EMAIL PROTECTED]
Private Credential: 
[EMAIL PROTECTED]

Size of Principals: 1
Principals: 
mjLDAP

Problem with JAAS

2004-12-02 Thread Julian Templeman

I'm evaluating an ISP that uses Tomcat to host webapps, and am running
into a security problem.

Any webapp that uses FORM authentication triggers an error from JAAS,
saying that it can't find a login configuration. I'm certainly not
using JAAS, and have just been adding users to the tomcat-users.xml
file. I've been able to confirm that this happens with even the
simplest apps.

Can anyone give me any idea of what's going on here? My guess is that
somehow Tomcat is configured to use JAAS by default, but since I've
not used JAAS before now, I'm not sure where to look...

Thanks,

julian
in london

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE : Problem with JAAS

2004-12-02 Thread LERBSCHER Jean-Pierre

Use tomcat env JAVA_OPTS=-Djava.security.auth.login.config=java config
file to declare your login module.

-Message d'origine-
De : Julian Templeman [mailto:[EMAIL PROTECTED] 
Envoyé : jeudi 2 décembre 2004 09:56
À : [EMAIL PROTECTED]
Objet : Problem with JAAS

I'm evaluating an ISP that uses Tomcat to host webapps, and am running
into a security problem.

Any webapp that uses FORM authentication triggers an error from JAAS,
saying that it can't find a login configuration. I'm certainly not
using JAAS, and have just been adding users to the tomcat-users.xml
file. I've been able to confirm that this happens with even the
simplest apps.

Can anyone give me any idea of what's going on here? My guess is that
somehow Tomcat is configured to use JAAS by default, but since I've
not used JAAS before now, I'm not sure where to look...

Thanks,

julian
in london

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: RE : Problem with JAAS

2004-12-02 Thread Julian Templeman

On Thu, 2 Dec 2004 11:36:48 +0100, LERBSCHER Jean-Pierre
[EMAIL PROTECTED] wrote:
 Use tomcat env JAVA_OPTS=-Djava.security.auth.login.config=java config
 file to declare your login module.

Thanks...

But what I want to know is *why* it wants to use JAAS at all. *I*
certainly don't want to have to, because a simple form authentication
will work fine for me...

julian

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE : RE : Problem with JAAS

2004-12-02 Thread LERBSCHER Jean-Pierre

Perhaps because your configure your jaas realm in engine/host configuration.

-Message d'origine-
De : Julian Templeman [mailto:[EMAIL PROTECTED] 
Envoyé : jeudi 2 décembre 2004 11:53
À : Tomcat Users List
Objet : Re: RE : Problem with JAAS

On Thu, 2 Dec 2004 11:36:48 +0100, LERBSCHER Jean-Pierre
[EMAIL PROTECTED] wrote:
 Use tomcat env JAVA_OPTS=-Djava.security.auth.login.config=java config
 file to declare your login module.

Thanks...

But what I want to know is *why* it wants to use JAAS at all. *I*
certainly don't want to have to, because a simple form authentication
will work fine for me...

julian

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: Problem with JAAS

2004-12-02 Thread QM

On Thu, Dec 02, 2004 at 08:56:26AM +, Julian Templeman wrote:
: I'm evaluating an ISP that uses Tomcat to host webapps, and am running
: into a security problem.
: 
: Any webapp that uses FORM authentication triggers an error from JAAS,
: saying that it can't find a login configuration. I'm certainly not
: using JAAS, and have just been adding users to the tomcat-users.xml
: file. I've been able to confirm that this happens with even the
: simplest apps.

What does the ISP support team say?  If they can't answer, it's time to
find a new host. =)

: Can anyone give me any idea of what's going on here? My guess is that
: somehow Tomcat is configured to use JAAS by default, but since I've
: not used JAAS before now, I'm not sure where to look...

Are you in your own container?  If not, you could be tripped up by an
errant global setting.

-QM

-- 

software  -- http://www.brandxdev.net
tech news -- http://www.RoarNetworX.com


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Problem Locating JAAS Config File in Tomcat 5.5.x

2004-11-09 Thread Jojo Paderes

Hi,

We are having problems running a servlet providing JAAS to our web
application. We are using Tomcat 5.5.x and JVM 1.4.2.

We can't seem to make the JAAS servlet run because Tomcat can't find
the JAAS config file which we've already specified in the JAVA_OPTS
env variable.

We are referring to this document to setup our JAAS servlet:
http://jakarta.apache.org/tomcat/tomcat-5.5-doc/realm-howto.html#JAASRealm


regards,

jOjO

-- 
My Blogs http://www.jroller.com/page/jojopaderes/blog
Pinoy Tech Scene http://pinoytechscene.mparaz.com
PinoyJUG http://www.pinoyjug.ph

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE: FW: Configuring JAAS realm for a web appplication (Catalina c lass loader bug)

2004-11-08 Thread Jacob Kjome

Quoting Reingold Genna [EMAIL PROTECTED]:

 Jake,

 Thanks for our reply.

 I have tried common/lib scenario. As a matter of fact I have started with
 that option. However it produces the same result.


Well, not the same result when you remove the jar from WEB-INF/lib as I
recommended as you seem to have later stated below.

 I have tried to move ejb-client jar out of of web app. But then I run into
 the problem when the application uses a class loaded by common class loader
 and if the class references another class in the WEB_INF/lib jar (a
 different jar) I get NoClassDefError. Effectively the only safe way to
 install my application in that scenario is to copy all application jars into
 common/lib and that is fundamently wrong.


It sounds like you might have to re-think your circular dependencies.  You need
to make a decision which jars should depend on each other and whether the
dependency direction is one way, both ways, or none at all.  You can't get away
from making this decision no matter the appserver.

 What I don't understand is why my set up works in 4.1.29 and doesn't work in
 5.0.28.


I can't explain that.  However, I suspect that you tested 4.1.29 on some other
machine than what you have 5.0.28 installed upon.  I would investigate how the
environment might be different.  Different classpaths,  different ways of
starting the server (batch file -vs- a service), etc  Make sure you try
fresh installs of each version with your app and test both in exactly the same
way.  Then you will be comparing apples to apples and, therefore, getting rid
of extraneous variables that might be clouding the investigation.


Jake




 -Original Message-
 From: Jacob Kjome [mailto:[EMAIL PROTECTED]
 Sent: Monday, 8 November 2004 3:52 PM
 To: Tomcat Users List
 Subject: Re: FW: Configuring JAAS realm for a web appplication (Catalina
 class loader bug)


 Well, the short answer is, move it to common/lib, not
 server/lib.  server/lib is for stuff that *only* Tomcat itself should
 see.  common/lib is for stuff that both the server and applications should
 see (and shared/lib is the converse of server/lib, but different from
 WEB-INF/lib since it is global to all apps in the server).

 Even in the common/lib case, you may run into the same problem, though,
 because if you put the jar in WEB-INF/lib, that will be loaded,
 preferentially by the application because of child first classloading
 behavior that Tomcat implements.  If JASS looks up this class as well, but
 loads it in a different classloader you will run into the same issue.  In
 this case, you'll need to remove the jar from WEB-INF/lib and load it from
 common/lib only.

 I can't say for sure that it isn't bad behavior by Tomcat, but I doubt
 it.  It is just a classloading issue you'll have to deal with.  However,
 this is one reason why many appservers out there don't use child first
 classloading behavior by default, although in the server/lib situation
 you'd get the same result in this case.  The common/lib case would have
 been taken care of in a server implementing normal parent first
 classloading behavior, but then it would be redundant to have the jar in
 WEB-INF/lib in that case anyway.  Bottom line is that classloaders are
 tricky and different situations call for different solutions so I doubt
 there is anything fundamentally wrong with what Tomcat is doing.

 Jake

 At 09:31 AM 11/8/2004 +1100, you wrote:

 Hi,
 My company  isusing Tomcat 4.1.29 and I'm investigating a transition to
 version 5.0.28.
 
 We use JAAS for authentication. The realm is decleared inside the web
 application context. The authentication code makes an EJB call to jBoss
 server (we are using stand alone Tomcat not jBoss bundled version).
 
 In verion 4.1 we have ejb-client code jar in both server/lib and Web
 Application lib directories. I have replicated the same structure in
 version 5 but I get ClassCastException inside my JAAS
 Authentication  module. If I remove the copy of ejb-client jar from Web
 Application it all works fine which suggest to me that the
 ClassCastException related to the fact that the same class id loaded by
 different classloaders. Tomcat doco specifies that Catalina classloader is
 invisible to webapplications ( and that's why we use it in Tomcat 4) but
 it doesn't seem to be the case. The work-around (removing ejb-client code
 from web app) is not a solution because it has a lot of web app specific
 code.
 
 If I don't copy authentication code to server/lib directory and only keep
 it in web app Tomcat doesn't find it. That is the case for both versions -
 4 and 5. To me it suggests a different problem - since JAAS realm declared
 in web app context it should apply to web application only and therefore
 it should be looking into webapp not server/lib directory. But that is a
 different discussion topic altogether.
 
 Thanks in advance
 
 Genna
 
 
 
 
 
 
 
 CAUTION - This message may contain privileged and confidential

FW: Configuring JAAS realm for a web appplication (Catalina class loader bug)

2004-11-07 Thread Reingold Genna

Title: FW: Configuring JAAS realm for a web appplication (Catalina classloader bug)

Hi,
My company isusing Tomcat 4.1.29 and I'm investigating a transition to version 5.0.28.

We use JAAS for authentication. The realm is decleared inside the web application context. The authentication code makes an EJB call to jBoss server (we are using stand alone Tomcat not jBoss bundled version).

In verion 4.1 we have ejb-client code jar in both server/lib and Web Application lib directories. I have replicated the same structure in version 5 but I get ClassCastException inside my JAAS Authentication module. If I remove the copy of ejb-client jar from Web Application it all works fine which suggest to me that the ClassCastException related to the fact that the same class id loaded by different classloaders. Tomcat doco specifies that Catalina classloader is invisible to webapplications ( and that's why we use it in Tomcat 4) but it doesn't seem to be the case. The work-around (removing ejb-client code from web app) is not a solution because it has a lot of web app specific code.

If I don't copy authentication code to server/lib directory and only keep it in web app Tomcat doesn't find it. That is the case for both versions - 4 and 5. To me it suggests a different problem - since JAAS realm declared in web app context it should apply to web application only and therefore it should be looking into webapp not server/lib directory. But that is a different discussion topic altogether.

Thanks in advance

Genna

CAUTION - This message may contain privileged and confidential information intended only for the use of the addressee(s) named above. If you are not the intended recipient of this message you are notified that any use, dissemination, distribution or reproduction of this message is prohibited. If you have received this message in error please notify Siemens Ltd., ABN 98 004 347 880, or Siemens (NZ) Limited immediately. No representation is made that this email or any attachments are free of viruses. Virus Scanning is recommended and is the responsibility of the recipient.

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: FW: Configuring JAAS realm for a web appplication (Catalina class loader bug)

2004-11-07 Thread Jacob Kjome

Well, the short answer is, move it to common/lib, not 
server/lib.  server/lib is for stuff that *only* Tomcat itself should 
see.  common/lib is for stuff that both the server and applications should 
see (and shared/lib is the converse of server/lib, but different from 
WEB-INF/lib since it is global to all apps in the server).

Even in the common/lib case, you may run into the same problem, though, 
because if you put the jar in WEB-INF/lib, that will be loaded, 
preferentially by the application because of child first classloading 
behavior that Tomcat implements.  If JASS looks up this class as well, but 
loads it in a different classloader you will run into the same issue.  In 
this case, you'll need to remove the jar from WEB-INF/lib and load it from 
common/lib only.

I can't say for sure that it isn't bad behavior by Tomcat, but I doubt 
it.  It is just a classloading issue you'll have to deal with.  However, 
this is one reason why many appservers out there don't use child first 
classloading behavior by default, although in the server/lib situation 
you'd get the same result in this case.  The common/lib case would have 
been taken care of in a server implementing normal parent first 
classloading behavior, but then it would be redundant to have the jar in 
WEB-INF/lib in that case anyway.  Bottom line is that classloaders are 
tricky and different situations call for different solutions so I doubt 
there is anything fundamentally wrong with what Tomcat is doing.

Jake
At 09:31 AM 11/8/2004 +1100, you wrote:
Hi,
My company  isusing Tomcat 4.1.29 and I'm investigating a transition to 
version 5.0.28.

We use JAAS for authentication. The realm is decleared inside the web 
application context. The authentication code makes an EJB call to jBoss 
server (we are using stand alone Tomcat not jBoss bundled version).

In verion 4.1 we have ejb-client code jar in both server/lib and Web 
Application lib directories. I have replicated the same structure in 
version 5 but I get ClassCastException inside my JAAS 
Authentication  module. If I remove the copy of ejb-client jar from Web 
Application it all works fine which suggest to me that the 
ClassCastException related to the fact that the same class id loaded by 
different classloaders. Tomcat doco specifies that Catalina classloader is 
invisible to webapplications ( and that's why we use it in Tomcat 4) but 
it doesn't seem to be the case. The work-around (removing ejb-client code 
from web app) is not a solution because it has a lot of web app specific code.

If I don't copy authentication code to server/lib directory and only keep 
it in web app Tomcat doesn't find it. That is the case for both versions - 
4 and 5. To me it suggests a different problem - since JAAS realm declared 
in web app context it should apply to web application only and therefore 
it should be looking into webapp not server/lib directory. But that is a 
different discussion topic altogether.

Thanks in advance
Genna



CAUTION - This message may contain privileged and confidential information 
intended only for the use of the addressee(s) named above. If you are not 
the intended recipient of this message you are notified that any use, 
dissemination, distribution or reproduction of this message is prohibited. 
If you have received this message in error please notify Siemens Ltd., ABN 
98 004 347 880, or Siemens (NZ) Limited immediately. No representation is 
made that this email or any attachments are free of viruses. Virus 
Scanning is recommended and is the responsibility of the recipient.

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE: FW: Configuring JAAS realm for a web appplication (Catalina c lass loader bug)

2004-11-07 Thread Reingold Genna

Title: RE: FW: Configuring JAAS realm for a web appplication (Catalina class loader bug)





Jake,


Thanks for our reply.


I have tried common/lib scenario. As a matter of fact I have started with that option. However it produces the same result. 

I have tried to move ejb-client jar out of of web app. But then I run into the problem when the application uses a class loaded by common class loader and if the class references another class in the WEB_INF/lib jar (a different jar) I get NoClassDefError. Effectively the only safe way to install my application in that scenario is to copy all application jars into common/lib and that is fundamently wrong. 

What I don't understand is why my set up works in 4.1.29 and doesn't work in 5.0.28.





-Original Message-
From: Jacob Kjome [mailto:[EMAIL PROTECTED]] 
Sent: Monday, 8 November 2004 3:52 PM
To: Tomcat Users List
Subject: Re: FW: Configuring JAAS realm for a web appplication (Catalina class loader bug)



Well, the short answer is, move it to common/lib, not 
server/lib. server/lib is for stuff that *only* Tomcat itself should 
see. common/lib is for stuff that both the server and applications should 
see (and shared/lib is the converse of server/lib, but different from 
WEB-INF/lib since it is global to all apps in the server).


Even in the common/lib case, you may run into the same problem, though, 
because if you put the jar in WEB-INF/lib, that will be loaded, 
preferentially by the application because of child first classloading 
behavior that Tomcat implements. If JASS looks up this class as well, but 
loads it in a different classloader you will run into the same issue. In 
this case, you'll need to remove the jar from WEB-INF/lib and load it from 
common/lib only.


I can't say for sure that it isn't bad behavior by Tomcat, but I doubt 
it. It is just a classloading issue you'll have to deal with. However, 
this is one reason why many appservers out there don't use child first 
classloading behavior by default, although in the server/lib situation 
you'd get the same result in this case. The common/lib case would have 
been taken care of in a server implementing normal parent first 
classloading behavior, but then it would be redundant to have the jar in 
WEB-INF/lib in that case anyway. Bottom line is that classloaders are 
tricky and different situations call for different solutions so I doubt 
there is anything fundamentally wrong with what Tomcat is doing.


Jake


At 09:31 AM 11/8/2004 +1100, you wrote:


Hi,
My company isusing Tomcat 4.1.29 and I'm investigating a transition to 
version 5.0.28.

We use JAAS for authentication. The realm is decleared inside the web 
application context. The authentication code makes an EJB call to jBoss 
server (we are using stand alone Tomcat not jBoss bundled version).

In verion 4.1 we have ejb-client code jar in both server/lib and Web 
Application lib directories. I have replicated the same structure in 
version 5 but I get ClassCastException inside my JAAS 
Authentication module. If I remove the copy of ejb-client jar from Web 
Application it all works fine which suggest to me that the 
ClassCastException related to the fact that the same class id loaded by 
different classloaders. Tomcat doco specifies that Catalina classloader is 
invisible to webapplications ( and that's why we use it in Tomcat 4) but 
it doesn't seem to be the case. The work-around (removing ejb-client code 
from web app) is not a solution because it has a lot of web app specific code.

If I don't copy authentication code to server/lib directory and only keep 
it in web app Tomcat doesn't find it. That is the case for both versions - 
4 and 5. To me it suggests a different problem - since JAAS realm declared 
in web app context it should apply to web application only and therefore 
it should be looking into webapp not server/lib directory. But that is a 
different discussion topic altogether.

Thanks in advance

Genna







CAUTION - This message may contain privileged and confidential information 
intended only for the use of the addressee(s) named above. If you are not 
the intended recipient of this message you are notified that any use, 
dissemination, distribution or reproduction of this message is prohibited. 
If you have received this message in error please notify Siemens Ltd., ABN 
98 004 347 880, or Siemens (NZ) Limited immediately. No representation is 
made that this email or any attachments are free of viruses. Virus 
Scanning is recommended and is the responsibility of the recipient.

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



CAUTION - This message may contain privileged and confidential information intended only

JAAS in combination with WAR

2004-09-22 Thread KoflerI.external


Hi!

I want to develop a webapp which should be easily deployable by using a
WAR file. So, as I found out, I can place the context descriptor as
context.xml in the META-INF directory. 

But I have some problems concerning the JAASRealm.

First, the location of the jaas config file has to be set via a system
property. How can I handle that by using a WAR??

Second, the my implementation of the LoginModule is bundled in a jar
file. If the jar is placed in the WEB-INF/lib directory of my webapp,
authentication with jaas doesn't succeed. If I put it into tomcat's
common/lib directory, it starts working. Are there any possibilities to
deploy the login jar within my webapp??


regards  thanx, Ingo

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

too many JAAS...

hi again,
fiddled araound with JAASRealm in tomcat 5.0.28
but still did not succeed.

so i`ll ask a few simple questions:
(which actually seemed already answered to me while reading tons of
faq/documentation - but it still does not work)

is it possible to authenticate users via servlet, when the actual page
does not include action-url 'j_security_check'
e.g. form action=myservlet.do method=POST

i need to do so, because 'MyCallbackHandler' needs more specific data

if so, is it fuerthermore possible to do smthng like:
 
 LoginContext ctx = new LoginContext(logonDef, new 
MyCallbackHandler(user,pass,object));
 ctx.login();

if so, why do i have loads of problems when i try to retrieve
MyCallbackHandler in my custom LoginModule when simple doin:

public  class MyLoginModule implements LoginModule {

 private Subject subject;
 private CallbackHandler handler;
 private Map sharedState;
 private Map options;
 private Logger logger;

 public void initialize(Subject subject, CallbackHandler callbackHandler,
Map sharedState,Map options) {

this.subject = subject;
this.handler = callbackHandler;
this.sharedState = sharedState;
this.options = options;
this.logger = Logger.getLogger(MyLoginModule.class);
 }

 pubic boolean login() {
MyCallbackHandler myhandler = (MyCallbackHandler) this.handler;
// do something with it..
// but here the ClassCastException shows up ...

 }
...
}


thanks in advance..

insanely
rene

 
-- 
gpg-key 8FC78254 http://www.so36.net/keys/rene.asc
fingerprint: E883 D359 3F56 51AF 0294  8BEB 16B3 15BD 8FC7 8254

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: too many JAAS...

2004-09-22 Thread Michiel Toneman


Hi Rene,
You can have a look at 
http://www.kopz.org/public/documents/tomcat/jaasintomcat.html

It contains a known-good approach so it may be of some use to you.
Michiel
Rene Paulokat wrote:
hi again,
fiddled araound with JAASRealm in tomcat 5.0.28
but still did not succeed.
so i`ll ask a few simple questions:
(which actually seemed already answered to me while reading tons of
faq/documentation - but it still does not work)
is it possible to authenticate users via servlet, when the actual page
does not include action-url 'j_security_check'
e.g. form action=myservlet.do method=POST
i need to do so, because 'MyCallbackHandler' needs more specific data
if so, is it fuerthermore possible to do smthng like:
LoginContext ctx = new LoginContext(logonDef, new 
MyCallbackHandler(user,pass,object));
ctx.login();
if so, why do i have loads of problems when i try to retrieve
MyCallbackHandler in my custom LoginModule when simple doin:
public  class MyLoginModule implements LoginModule {
private Subject subject;
private CallbackHandler handler;
private Map sharedState;
private Map options;
private Logger logger;
public void initialize(Subject subject, CallbackHandler callbackHandler,
Map sharedState,Map options) {

this.subject = subject;
this.handler = callbackHandler;
this.sharedState = sharedState;
this.options = options;
this.logger = Logger.getLogger(MyLoginModule.class);
}
pubic boolean login() {
MyCallbackHandler myhandler = (MyCallbackHandler) this.handler;
// do something with it..
// but here the ClassCastException shows up ...

}
...
}
thanks in advance..
insanely
rene
 


--
Michiel Toneman  Software Engineer   Bibit Global Payment Services
Regulierenring 10  3981 LB  Bunnik   [EMAIL PROTECTED]
Tel. +31-30-6595168  Fax +31-30-6564464  http://www.bibit.com/
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: too many JAAS...

On Wed, Sep 22, 2004 at 03:47:08PM +0200, Michiel Toneman wrote:

 You can have a look at 
 http://www.kopz.org/public/documents/tomcat/jaasintomcat.html
 
 It contains a known-good approach so it may be of some use to you.

hi michiel,
yes, i found that already, but i thought this is not *very* different
from my approach:

in this example 'SecurityFilter' does the same thing like my
Login-servlet:

creates new LoginContext - passes over the CallBackhandler - here
'HttpAuthCallBackhandler' and finally calls login-method of loginModule.

additionally it puts 'Subject' into user's Session, to be reused when
needed. fine thing.

i think i am missing some more basic thing - cause of my beloved
ClassCastException, when my loginModule starts to act...

or - is it the only way to accomplish the task with that kind of
'SecurityFilter' - which in the example acts upon every request?

thanks for your hint, i'am gonna implement it test-wise...

greetings
rene












-- 
gpg-key 8FC78254 http://www.so36.net/keys/rene.asc
fingerprint: E883 D359 3F56 51AF 0294  8BEB 16B3 15BD 8FC7 8254

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE : too many JAAS...

2004-09-22 Thread LERBSCHER Jean-Pierre

Why do you have a ClassCastException exception ?
Could you give us more detail on your realm configuration ?
Do you configured a jass realm with custom userClassNames and roleClassNames
attributes ? or any thing else.

-Message d'origine-
De : Rene Paulokat [mailto:[EMAIL PROTECTED] 
Envoyé : mercredi 22 septembre 2004 16:18
À : Tomcat Users List
Objet : Re: too many JAAS...

On Wed, Sep 22, 2004 at 03:47:08PM +0200, Michiel Toneman wrote:

 You can have a look at 
 http://www.kopz.org/public/documents/tomcat/jaasintomcat.html
 
 It contains a known-good approach so it may be of some use to you.

hi michiel,
yes, i found that already, but i thought this is not *very* different
from my approach:

in this example 'SecurityFilter' does the same thing like my
Login-servlet:

creates new LoginContext - passes over the CallBackhandler - here
'HttpAuthCallBackhandler' and finally calls login-method of loginModule.

additionally it puts 'Subject' into user's Session, to be reused when
needed. fine thing.

i think i am missing some more basic thing - cause of my beloved
ClassCastException, when my loginModule starts to act...

or - is it the only way to accomplish the task with that kind of
'SecurityFilter' - which in the example acts upon every request?

thanks for your hint, i'am gonna implement it test-wise...

greetings
rene












-- 
gpg-key 8FC78254 http://www.so36.net/keys/rene.asc
fingerprint: E883 D359 3F56 51AF 0294  8BEB 16B3 15BD 8FC7 8254

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: RE : too many JAAS...

On Wed, Sep 22, 2004 at 04:26:44PM +0200, LERBSCHER Jean-Pierre wrote:
 Why do you have a ClassCastException exception ?
 Could you give us more detail on your realm configuration ?
 Do you configured a jass realm with custom userClassNames and roleClassNames
 attributes ? or any thing else.


okay, my context configuration looks like:

Realm className=org.apache.catalina.realm.JAASRealm
verbosity=99
appName=dabRealm
debug=99
useContextClassLoader=true
userClassNames=com.warenform.ima_frontend.auth.DabPrincipal
roleClassNames=com.warenform.ima_frontend.auth.DabRole/

my login.conf shows:

dabRealm {
  com.warenform.ima_frontend.interf.DabLoginModule  REQUIRED;
};

loginModule/Role/Principal-classes are visible to $CATALINA_HOME/common/lib

and the way i invoke the whole thing is via 

servlet which is called by url /login.do - 

creates my DabCallBackHandler ,
pushes this into new LoginContext
module gets invoked - and creates exception like described in the
thread-start.

hm - am i lost?

rene




-- 
gpg-key 8FC78254 http://www.so36.net/keys/rene.asc
fingerprint: E883 D359 3F56 51AF 0294  8BEB 16B3 15BD 8FC7 8254

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE: RE : too many JAAS...


Hi,
I just committed a fairly big patch from Andrew Jaquith last night that
addresses numerous issues encountered when using the JAASRealm with
custom user and role class names.  You may wish to build from CVS and
see if this patch fixes your exception.   The patch was in Bugzilla
issue 28631 if you want to look it up.

Yoav Shapira
Millennium Research Informatics


-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Wednesday, September 22, 2004 11:00 AM
To: Tomcat Users List
Subject: Re: RE : too many JAAS...

On Wed, Sep 22, 2004 at 04:26:44PM +0200, LERBSCHER Jean-Pierre wrote:
 Why do you have a ClassCastException exception ?
 Could you give us more detail on your realm configuration ?
 Do you configured a jass realm with custom userClassNames and
roleClassNames
 attributes ? or any thing else.


okay, my context configuration looks like:

Realm className=org.apache.catalina.realm.JAASRealm
verbosity=99
appName=dabRealm
debug=99
useContextClassLoader=true
userClassNames=com.warenform.ima_frontend.auth.DabPrincipal
roleClassNames=com.warenform.ima_frontend.auth.DabRole/

my login.conf shows:

dabRealm {
  com.warenform.ima_frontend.interf.DabLoginModule  REQUIRED;
};

loginModule/Role/Principal-classes are visible to
$CATALINA_HOME/common/lib

and the way i invoke the whole thing is via

servlet which is called by url /login.do -

creates my DabCallBackHandler ,
pushes this into new LoginContext
module gets invoked - and creates exception like described in the
thread-start.

hm - am i lost?

rene




--
gpg-key 8FC78254 http://www.so36.net/keys/rene.asc
fingerprint: E883 D359 3F56 51AF 0294  8BEB 16B3 15BD 8FC7 8254

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




This e-mail, including any attachments, is a confidential business communication, and 
may contain information that is confidential, proprietary and/or privileged.  This 
e-mail is intended only for the individual(s) to whom it is addressed, and may not be 
saved, copied, printed, disclosed or used by anyone else.  If you are not the(an) 
intended recipient, please immediately delete this e-mail from your computer system 
and notify the sender.  Thank you.


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: RE : too many JAAS...

On Wed, Sep 22, 2004 at 11:01:28AM -0400, Shapira, Yoav wrote:
 
 Hi,
 I just committed a fairly big patch from Andrew Jaquith last night that
 addresses numerous issues encountered when using the JAASRealm with
 custom user and role class names.  You may wish to build from CVS and
 see if this patch fixes your exception.   The patch was in Bugzilla
 issue 28631 if you want to look it up.

thanks for your advice.

the good news:
checked out, built, deployed.

the bad news:
same ClassCastException:

i`ll give u the relevant parts:


[DabLoginModule]

...
(52) public boolean login() throws LoginException {

(54)   logger.debug(loginmodule loaded by: [
+this.getClass().getClassLoader()+]);
(55)   logger.debug(this.handler.getClass().getName()+ 
(initialized handler) loaded:
+this.handler.getClass().getClassLoader()); 

(56)  DabCallBackHandler handler = (DabCallBackHandler) this.handler;
  
(57)  logger.debug(name: [+handler.getClass().getName()+
] loader: [+handler.getClass().getClassLoader()+]);
(58)  logger.debug(test if works:+handler.getUsername());
...


which results in a log of:

DEBUG [http-8080-Processor25] (DabLoginModule.java:54) - loginmodule
loaded by: [WebappClassLoader ...
DEBUG [http-8080-Processor25] (DabLoginModule.java:55) -
javax.security.auth.login.LoginContext$SecureCallbackHandler
(initialized handler) loaded: null

javax.security.auth.login.LoginException: java.lang.ClassCastException
at
com.warenform.ima_frontend.interf.DabLoginModule.login(DabLoginModule.java:56)



any more hints? 

greetings
rene


-- 
gpg-key 8FC78254 http://www.so36.net/keys/rene.asc
fingerprint: E883 D359 3F56 51AF 0294  8BEB 16B3 15BD 8FC7 8254

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE: RE : too many JAAS...


Hi,
I didn't follow the rest of your thread.  Your callback handler is
loaded from common/lib, not WEB-INF/lib, right?

Yoav Shapira
Millennium Research Informatics


-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Wednesday, September 22, 2004 2:25 PM
To: Tomcat Users List
Subject: Re: RE : too many JAAS...

On Wed, Sep 22, 2004 at 11:01:28AM -0400, Shapira, Yoav wrote:

 Hi,
 I just committed a fairly big patch from Andrew Jaquith last night
that
 addresses numerous issues encountered when using the JAASRealm with
 custom user and role class names.  You may wish to build from CVS and
 see if this patch fixes your exception.   The patch was in Bugzilla
 issue 28631 if you want to look it up.

thanks for your advice.

the good news:
checked out, built, deployed.

the bad news:
same ClassCastException:

i`ll give u the relevant parts:


[DabLoginModule]

...
(52) public boolean login() throws LoginException {

(54)   logger.debug(loginmodule loaded by: [
   +this.getClass().getClassLoader()+]);
(55)   logger.debug(this.handler.getClass().getName()+
   (initialized handler) loaded:
   +this.handler.getClass().getClassLoader());

(56)  DabCallBackHandler handler = (DabCallBackHandler) this.handler;

(57)  logger.debug(name: [+handler.getClass().getName()+
   ] loader: [+handler.getClass().getClassLoader()+]);
(58)  logger.debug(test if works:+handler.getUsername());
...


which results in a log of:

DEBUG [http-8080-Processor25] (DabLoginModule.java:54) - loginmodule
   loaded by: [WebappClassLoader ...
DEBUG [http-8080-Processor25] (DabLoginModule.java:55) -
   javax.security.auth.login.LoginContext$SecureCallbackHandler
   (initialized handler) loaded: null

javax.security.auth.login.LoginException: java.lang.ClassCastException
   at
com.warenform.ima_frontend.interf.DabLoginModule.login(DabLoginModule.j
ava:
56)



any more hints?

greetings
rene


--
gpg-key 8FC78254 http://www.so36.net/keys/rene.asc
fingerprint: E883 D359 3F56 51AF 0294  8BEB 16B3 15BD 8FC7 8254

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




This e-mail, including any attachments, is a confidential business communication, and 
may contain information that is confidential, proprietary and/or privileged.  This 
e-mail is intended only for the individual(s) to whom it is addressed, and may not be 
saved, copied, printed, disclosed or used by anyone else.  If you are not the(an) 
intended recipient, please immediately delete this e-mail from your computer system 
and notify the sender.  Thank you.


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: RE : too many JAAS...

On Wed, Sep 22, 2004 at 02:28:59PM -0400, Shapira, Yoav wrote:
 
 Hi,
 I didn't follow the rest of your thread.  Your callback handler is
 loaded from common/lib, not WEB-INF/lib, right?
 
 Yoav Shapira

if i call the handler on my servlet, the handler is loaded by StandardClassLoader
from common/lib

but i guess somewhere here is my problem - just that i dont see it.


--- snip ---
DEBUG [http-8080-Processor24] (DabLoginAction.java:177) - handler in
servlet loaded :
[EMAIL PROTECTED]
[http-8080-Processor24] (DabLoginModule.java:43) - init: callbackHandler
declared by class javax.security.auth.login.LoginContext
DEBUG [http-8080-Processor24] (DabLoginModule.java:44) - init:
callbackHandler is:
javax.security.auth.login.LoginContext$SecureCallbackHandler
DEBUG [http-8080-Processor24] (DabLoginModule.java:45) - init:
callbackHandler loaded by: null
DEBUG [http-8080-Processor24] (DabLoginModule.java:53) - loginmodule
loaded by: [WebappClassLoader 

greetings 
rene

-- 
gpg-key 8FC78254 http://www.so36.net/keys/rene.asc
fingerprint: E883 D359 3F56 51AF 0294  8BEB 16B3 15BD 8FC7 8254

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE: RE : too many JAAS...


Hi,
Can you put the login module in common/lib as well, to see if it being
loaded by the common classloader makes a difference?

Yoav Shapira
Millennium Research Informatics


-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Wednesday, September 22, 2004 3:15 PM
To: Tomcat Users List
Subject: Re: RE : too many JAAS...

On Wed, Sep 22, 2004 at 02:28:59PM -0400, Shapira, Yoav wrote:

 Hi,
 I didn't follow the rest of your thread.  Your callback handler is
 loaded from common/lib, not WEB-INF/lib, right?

 Yoav Shapira

if i call the handler on my servlet, the handler is loaded by
StandardClassLoader
from common/lib

but i guess somewhere here is my problem - just that i dont see it.


--- snip ---
DEBUG [http-8080-Processor24] (DabLoginAction.java:177) - handler in
servlet loaded :
[EMAIL PROTECTED]
[http-8080-Processor24] (DabLoginModule.java:43) - init:
callbackHandler
declared by class javax.security.auth.login.LoginContext
DEBUG [http-8080-Processor24] (DabLoginModule.java:44) - init:
callbackHandler is:
javax.security.auth.login.LoginContext$SecureCallbackHandler
DEBUG [http-8080-Processor24] (DabLoginModule.java:45) - init:
callbackHandler loaded by: null
DEBUG [http-8080-Processor24] (DabLoginModule.java:53) - loginmodule
loaded by: [WebappClassLoader

greetings
rene

--
gpg-key 8FC78254 http://www.so36.net/keys/rene.asc
fingerprint: E883 D359 3F56 51AF 0294  8BEB 16B3 15BD 8FC7 8254

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




This e-mail, including any attachments, is a confidential business communication, and 
may contain information that is confidential, proprietary and/or privileged.  This 
e-mail is intended only for the individual(s) to whom it is addressed, and may not be 
saved, copied, printed, disclosed or used by anyone else.  If you are not the(an) 
intended recipient, please immediately delete this e-mail from your computer system 
and notify the sender.  Thank you.


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: RE : too many JAAS...

On Wed, Sep 22, 2004 at 03:16:17PM -0400, Shapira, Yoav wrote:
 
 Hi,
 Can you put the login module in common/lib as well, to see if it being
 loaded by the common classloader makes a difference?

first: thanks a lot for your efforts.

i can, i did change the location for the loginModule, so that it gets
loaded by StandardClassLoader:

DEBUG [http-8080-Processor25] (DabLoginAction.java:177) - handler in
servlet loaded : [EMAIL PROTECTED]
DEBUG [http-8080-Processor25] (DabLoginAction.java:183) - servlet
classloader logincontext: null
DEBUG [http-8080-Processor25] (DabLoginModule.java:44) - init:
callbackHandler declared by class javax.security.auth.login.LoginContext
DEBUG [http-8080-Processor25] (DabLoginModule.java:45) - init:
callbackHandler is:
javax.security.auth.login.LoginContext$SecureCallbackHandler
DEBUG [http-8080-Processor25] (DabLoginModule.java:46) - init:
callbackHandler loaded by: null
DEBUG [http-8080-Processor25] (DabLoginModule.java:54) - loginmodule
loaded by: [EMAIL PROTECTED]
DEBUG [http-8080-Processor25] (DabLoginModule.java:55) -
javax.security.auth.login.LoginContext$SecureCallbackHandler
(initialized handler) loaded: null
javax.security.auth.login.LoginException: java.lang.ClassCastExceptioni


but same cce

rene



-- 
gpg-key 8FC78254 http://www.so36.net/keys/rene.asc
fingerprint: E883 D359 3F56 51AF 0294  8BEB 16B3 15BD 8FC7 8254

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE: RE : too many JAAS...


Hi,
What's the stack trace for the ClassCastException?

Yoav Shapira
Millennium Research Informatics


-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Wednesday, September 22, 2004 3:33 PM
To: Tomcat Users List
Subject: Re: RE : too many JAAS...

On Wed, Sep 22, 2004 at 03:16:17PM -0400, Shapira, Yoav wrote:

 Hi,
 Can you put the login module in common/lib as well, to see if it
being
 loaded by the common classloader makes a difference?

first: thanks a lot for your efforts.

i can, i did change the location for the loginModule, so that it gets
loaded by StandardClassLoader:

DEBUG [http-8080-Processor25] (DabLoginAction.java:177) - handler in
servlet loaded : [EMAIL PROTECTED]
DEBUG [http-8080-Processor25] (DabLoginAction.java:183) - servlet
classloader logincontext: null
DEBUG [http-8080-Processor25] (DabLoginModule.java:44) - init:
callbackHandler declared by class
javax.security.auth.login.LoginContext
DEBUG [http-8080-Processor25] (DabLoginModule.java:45) - init:
callbackHandler is:
javax.security.auth.login.LoginContext$SecureCallbackHandler
DEBUG [http-8080-Processor25] (DabLoginModule.java:46) - init:
callbackHandler loaded by: null
DEBUG [http-8080-Processor25] (DabLoginModule.java:54) - loginmodule
loaded by: [EMAIL PROTECTED]
DEBUG [http-8080-Processor25] (DabLoginModule.java:55) -
javax.security.auth.login.LoginContext$SecureCallbackHandler
(initialized handler) loaded: null
javax.security.auth.login.LoginException: java.lang.ClassCastExceptioni


but same cce

rene



--
gpg-key 8FC78254 http://www.so36.net/keys/rene.asc
fingerprint: E883 D359 3F56 51AF 0294  8BEB 16B3 15BD 8FC7 8254

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




This e-mail, including any attachments, is a confidential business communication, and 
may contain information that is confidential, proprietary and/or privileged.  This 
e-mail is intended only for the individual(s) to whom it is addressed, and may not be 
saved, copied, printed, disclosed or used by anyone else.  If you are not the(an) 
intended recipient, please immediately delete this e-mail from your computer system 
and notify the sender.  Thank you.


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

beware: stackTrace was: Re: RE : too many JAAS...

On Wed, Sep 22, 2004 at 03:33:27PM -0400, Shapira, Yoav wrote:
 
 Hi,
 What's the stack trace for the ClassCastException?

here it comes:

rene

--
javax.security.auth.login.LoginException: java.lang.ClassCastException
at
com.warenform.ima_frontend.interf.DabLoginModule.login(DabLoginModule.java:56)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:324)
at
javax.security.auth.login.LoginContext.invoke(LoginContext.java:675)
at
javax.security.auth.login.LoginContext.access$000(LoginContext.java:129)
at
javax.security.auth.login.LoginContext$4.run(LoginContext.java:610)
at java.security.AccessController.doPrivileged(Native Method)
at
javax.security.auth.login.LoginContext.invokeModule(LoginContext.java:607)
at
javax.security.auth.login.LoginContext.login(LoginContext.java:534)
at
com.warenform.ima_frontend.action.DabLoginAction.execute(DabLoginAction.java:185)
at
org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:484)
at
org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:274)
at
org.apache.struts.action.ActionServlet.process(ActionServlet.java:1482)
at
org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:525)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:810)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:237)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:157)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:214)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178)
at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:407)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:106)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
at
org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:825)
at
org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.processConnection(Http11Protocol.java:717)
at
org.apache.tomcat.util.net.TcpWorkerThread.runIt(PoolTcpEndpoint.java:576)
at
org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:684)
at java.lang.Thread.run(Thread.java:534)

at
javax.security.auth.login.LoginContext.invoke(LoginContext.java:730)
at
javax.security.auth.login.LoginContext.access$000(LoginContext.java:129)
at
javax.security.auth.login.LoginContext$4.run(LoginContext.java:610)
at java.security.AccessController.doPrivileged(Native Method)
at
javax.security.auth.login.LoginContext.invokeModule(LoginContext.java:607)
at
javax.security.auth.login.LoginContext.login(LoginContext.java:534)
at
com.warenform.ima_frontend.action.DabLoginAction.execute(DabLoginAction.java:185)
at
org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:484)
at
org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:274)
at
org.apache.struts.action.ActionServlet.process(ActionServlet.java:1482)
at
org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:525)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:810)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:237)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:157)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:214)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178)
at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:407)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:106)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
at
org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:825)

Re: beware: stackTrace was: Re: RE : too many JAAS...

2004-09-22 Thread Michiel . Toneman

Just checking, but in your original post you described your loginmodule
as:

  public  class MyLoginModule implements LoginModule {

however, your ClassCastException mentions:

  com.warenform.ima_frontend.interf.DabLoginModule.login

Can you check if you really are referring to the same classes (also in
login.conf)?

Michiel

 On Wed, Sep 22, 2004 at 03:33:27PM -0400, Shapira, Yoav wrote:

 Hi,
 What's the stack trace for the ClassCastException?

 here it comes:

 rene

 --
 javax.security.auth.login.LoginException: java.lang.ClassCastException
   at
 com.warenform.ima_frontend.interf.DabLoginModule.login(DabLoginModule.java:56)
   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
   at
 sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
   at
 sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
   at java.lang.reflect.Method.invoke(Method.java:324)
   at
 javax.security.auth.login.LoginContext.invoke(LoginContext.java:675)
   at
 javax.security.auth.login.LoginContext.access$000(LoginContext.java:129)
   at
 javax.security.auth.login.LoginContext$4.run(LoginContext.java:610)
   at java.security.AccessController.doPrivileged(Native Method)
   at
 javax.security.auth.login.LoginContext.invokeModule(LoginContext.java:607)
   at
 javax.security.auth.login.LoginContext.login(LoginContext.java:534)
   at
 com.warenform.ima_frontend.action.DabLoginAction.execute(DabLoginAction.java:185)
   at
 org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:484)
   at
 org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:274)
   at
 org.apache.struts.action.ActionServlet.process(ActionServlet.java:1482)
   at
 org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:525)
   at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
   at javax.servlet.http.HttpServlet.service(HttpServlet.java:810)
   at
 org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:237)
   at
 org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:157)
   at
 org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:214)
   at
 org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178)
   at
 org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:407)
   at
 org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
   at
 org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:106)
   at
 org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
   at
 org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
   at
 org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:825)
   at
 org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.processConnection(Http11Protocol.java:717)
   at
 org.apache.tomcat.util.net.TcpWorkerThread.runIt(PoolTcpEndpoint.java:576)
   at
 org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:684)
   at java.lang.Thread.run(Thread.java:534)

   at
 javax.security.auth.login.LoginContext.invoke(LoginContext.java:730)
   at
 javax.security.auth.login.LoginContext.access$000(LoginContext.java:129)
   at
 javax.security.auth.login.LoginContext$4.run(LoginContext.java:610)
   at java.security.AccessController.doPrivileged(Native Method)
   at
 javax.security.auth.login.LoginContext.invokeModule(LoginContext.java:607)
   at
 javax.security.auth.login.LoginContext.login(LoginContext.java:534)
   at
 com.warenform.ima_frontend.action.DabLoginAction.execute(DabLoginAction.java:185)
   at
 org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:484)
   at
 org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:274)
   at
 org.apache.struts.action.ActionServlet.process(ActionServlet.java:1482)
   at
 org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:525)
   at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
   at javax.servlet.http.HttpServlet.service(HttpServlet.java:810)
   at
 org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:237)
   at
 org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:157)
   at
 org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:214)
   at
 org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178)
   at
 org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:407)
   at
 org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
   at

Re: beware: stackTrace was: Re: RE : too many JAAS...