<div dir="ltr">Hi,<br><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jan 7, 2016 at 3:51 PM, Sony Abraham <span dir="ltr"><<a href="mailto:sony.abraham@ibsplc.com" target="_blank">sony.abraham@ibsplc.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div lang="EN-IN" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Hi Arjan,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Thanks again for your support and guidance.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">I have put my SAM module (jar) inside ear/lib.</span></p></div></div></blockquote><div><br></div><div>If the SAM resides within the application then modifying standalone.xml is not needed. A reference to a SAM in standalone.xml is only really needed if the SAM is separate from the application, e.g. resides in a jar that you put somewhere in the /modules folder of WildFly.</div><div><br></div><div>In this case you can just as well use the programmatic registration via a listener as demonstrated by the samples.</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div lang="EN-IN" link="blue" vlink="purple"><div><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> </span><span style="color:rgb(31,73,125);font-family:Calibri,sans-serif;font-size:11pt">Also I am facing the below issues, when I try to access a protected resource, I want redirect to my login page. For this I have mentioned
the login.jsp in the web.xml as below</span></p>
<p class="MsoNormal" style="text-indent:36pt"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><login-config><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> <auth-method>FORM</auth-method>
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> <form-login-config><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> <form-login-page>/login.jsp</form-login-page><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> <form-error-page>/login.jsp</form-error-page><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </form-login-config><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </login-config><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">But this is not happening automatically, I had to explicitly do response.sendRedirect to get my login page (otherwise “Unauthorized”
error was coming). Is this the right thing to do ?</span></p></div></div></blockquote><div><br></div><div>This is unfortunately not correct. A SAM is an authenticated mechanism, not an identity store. So it replaces FORM. In other words the entire login-config element can be removed here as its overridden when using a SAM. </div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div lang="EN-IN" link="blue" vlink="purple"><div><p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125);font-family:Calibri,sans-serif;font-size:11pt">After I provide my username / password and do j_security_check I am getting below error. Can you please let me know what I would
had done wrong</span></p></div></div></blockquote><div><br></div><div>j_security_check is the name in the URL that the build-in FORM authentication mechanism happens to be listening to. j_security_check is not some general mechanism by which security in Java EE is activated.<br></div><div><br></div><div>There is clearly a mismatch in Java EE security. There are build-in authentication mechanisms and a standard API for custom authentication mechanisms, but no standard API for the identity store (the artifact that only focuses on {credentials in, caller data out}).</div><div><br></div><div>What's typical though here is building a SAM that only redirects to a login page when a protected resource is requested and the user is not authenticated, and otherwise relies on Servlet's programmatic authenticate feature. So on /login.jsp you don't postback to a special URL, but post back to /login.jsp. Then backing code of /login.jsp sets the credentials as a request attribute and then calls HttpServletRequest.authenticate(). The SAM can then do the authentication as shown in the samples.</div><div><br></div><div>Another option would be to re-use an existing authentication module that implements FORM and then modify the part where it calls to the server specific identity store. See e.g. <a href="https://github.com/eclipse/jetty.project/blob/master/jetty-jaspi/src/main/java/org/eclipse/jetty/security/jaspi/modules/FormAuthModule.java">https://github.com/eclipse/jetty.project/blob/master/jetty-jaspi/src/main/java/org/eclipse/jetty/security/jaspi/modules/FormAuthModule.java</a> of <a href="http://grepcode.com/file/repository.jboss.org/nexus/content/repositories/releases/org.jboss.as/jboss-as-web/7.2.0.Final/org/jboss/as/web/security/jaspi/modules/HTTPFormServerAuthModule.java">http://grepcode.com/file/repository.jboss.org/nexus/content/repositories/releases/org.jboss.as/jboss-as-web/7.2.0.Final/org/jboss/as/web/security/jaspi/modules/HTTPFormServerAuthModule.java</a></div><div><br></div><div>(do take the license into account of these and take note that you may have to do your own scrutiny of how secure those are)</div><div><br></div><div>If you absolutely want or need to use the existing build-in FORM, then unfortunately JASPIC would not be the best option here. Unfortunately setting up (custom) security in Java EE is currently not entirely trivial.</div><div><br></div><div>Kind regards,</div><div>Arjan Tijms</div><div><br></div><div><br></div><div><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div lang="EN-IN" link="blue" vlink="purple"><div>
<p class="MsoNormal"><i><span style="font-size:13.5pt;color:black">HTTP method POST is not supported by this URL</span></i><i><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u><u></u></span></i></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Regards<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Sony<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif"> arjan tijms [mailto:<a href="mailto:arjan.tijms@gmail.com" target="_blank">arjan.tijms@gmail.com</a>]
<br>
<b>Sent:</b> 07 January 2016 18:29<br>
<b>To:</b> Sony Abraham</span></p><div><div class="h5"><br>
<b>Subject:</b> Re: [undertow-dev] Multiple logins under same user id in Wildfly 9.0.2 uses same subject<u></u><u></u></div></div><p></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Hi,<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Thu, Jan 7, 2016 at 8:10 AM, Sony Abraham <<a href="mailto:sony.abraham@ibsplc.com" target="_blank">sony.abraham@ibsplc.com</a>> wrote:<u></u><u></u></p>
<blockquote style="border-style:none none none solid;border-left-color:rgb(204,204,204);border-left-width:1pt;padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Thank you for your reply. I am complete new to SAMPIC, do you have any sample implementation for
custom JASPIC on wildfly that I can refer to ?</span><u></u><u></u></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Yes, there about 12 categories of samples for JASPIC here: <a href="https://github.com/javaee-samples/javaee7-samples/tree/master/jaspic" target="_blank">https://github.com/javaee-samples/javaee7-samples/tree/master/jaspic</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">The simplest sample can be found in <a href="https://github.com/javaee-samples/javaee7-samples/tree/master/jaspic/basic-authentication" target="_blank">
https://github.com/javaee-samples/javaee7-samples/tree/master/jaspic/basic-authentication</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">A very basic but fully working standalone application can be found here: <a href="https://github.com/arjantijms/mechanism-to-store" target="_blank">https://github.com/arjantijms/mechanism-to-store</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<blockquote style="border-style:none none none solid;border-left-color:rgb(204,204,204);border-left-width:1pt;padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> I read though your blog
</span><a href="http://arjan-tijms.omnifaces.org/2012/11/implementing-container-authentication.html" target="_blank"><span style="font-size:11pt;font-family:Calibri,sans-serif">http://arjan-tijms.omnifaces.org/2012/11/implementing-container-authentication.html</span></a><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">
and </span><a href="http://arjan-tijms.omnifaces.org/2013/04/whats-new-in-java-ee-7s-authentication.html" target="_blank"><span style="font-size:11pt;font-family:Calibri,sans-serif">http://arjan-tijms.omnifaces.org/2013/04/whats-new-in-java-ee-7s-authentication.html</span></a><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">
, but configuring the SAM module alone in standalone.xml and mentioning that in jboss-web.xml invoked my login module. Could not exactly understand why the factory and context classes were required ( I assume those implementations are provided by jboss itself)</span><u></u><u></u></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">The factory/config/context classes are there for when a fully in-app portable application archive is needed. The only standardised way to register a SAM is the programmatic way. The initial factory doesn't have a method that just takes
a SAM, but instead wants all these wrapper classes. In hindsight this was perhaps not the most ideal decision and we hope to be able to rectify this in the Java EE security EG.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">The non-standard way, in this case the JBoss specific way via standalone.xml, does accept just a SAM. In that case the wrappers are indeed provided by JBoss.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<blockquote style="border-style:none none none solid;border-left-color:rgb(204,204,204);border-left-width:1pt;padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">But it’s been invoked for all resources (even non secure resources)
</span><u></u><u></u></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">That's correct. JASPIC authentication modules are invoked for every resource, both secured (protected) and non-secured (public). Authentication is also not automatically tied to a session. Coming from some other proprietary mechanisms this
may seem controversial, but it actually makes it really flexible and makes the creation of e.g. stateless header based authentication mechanisms trivial. See e.g. <a href="http://arjan-tijms.omnifaces.org/2014/11/header-based-stateless-token.html" target="_blank">http://arjan-tijms.omnifaces.org/2014/11/header-based-stateless-token.html</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">You can check whether the SAM *must* do authentication (which includes being called for a secured resource) via a helper method such as:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">public static boolean isProtectedResource(MessageInfo messageInfo) {<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> return Boolean.valueOf((String) messageInfo.getMap().get(IS_MANDATORY));<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">}<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<blockquote style="border-style:none none none solid;border-left-color:rgb(204,204,204);border-left-width:1pt;padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">and the values in the handler and MessagePolicy are all coming as null.</span><u></u><u></u></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">That doesn't seem right. Perhaps this is a bug when registering a SAM via the standalone.xml method. Where did you put the com.test.TestServerAuthModule class? Is it inside a .jar that you put in your WildFly install (and if so, where?),
or is this class inside your application archive (.war)?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Kind regards,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Arjan Tijms<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<blockquote style="border-style:none none none solid;border-left-color:rgb(204,204,204);border-left-width:1pt;padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">How can I configure the container not to invoke the SAM for non-secure resources and why is the handler
and MessagePolicy coming as null ?</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">My standalone.xml entry is as below</span><u></u><u></u></p>
<p class="MsoNormal" style="text-indent:36pt">
<span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><security-domain name="test" cache-type="default"></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> <authentication-jaspi>
</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> <auth-module code="com.test.TestServerAuthModule" flag="optional"/></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </authentication-jaspi></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </security-domain></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">And jboss-web.xml as below</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><jboss-web></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> <security-domain>test</security-domain></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"></jboss-web></span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Regards,</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Sony</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">
arjan tijms [mailto:<a href="mailto:arjan.tijms@gmail.com" target="_blank">arjan.tijms@gmail.com</a>]
<br>
<b>Sent:</b> 05 January 2016 23:03<br>
<b>To:</b> Sony Abraham<br>
<b>Cc:</b> <a href="mailto:undertow-dev@lists.jboss.org" target="_blank">undertow-dev@lists.jboss.org</a><br>
<b>Subject:</b> Re: [undertow-dev] Multiple logins under same user id in Wildfly 9.0.2 uses same subject</span><u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal">Hi,<u></u><u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">I remember that in older versions of JBoss there always was a (proprietary) API to explicitly clear the authentication cache. Maybe this could be of help here if that API is still
there.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">An other option would be to try using the Java EE standard API for custom authentication modules. This is called JASPIC and WildFly has excellent support for those. Support is best
in the latest version of WildFly, which is 10cr5.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Kind regards,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Arjan Tijms<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal">On Tue, Jan 5, 2016 at 9:18 AM, Sony Abraham <<a href="mailto:sony.abraham@ibsplc.com" target="_blank">sony.abraham@ibsplc.com</a>> wrote:<u></u><u></u></p>
<blockquote style="border-style:none none none solid;border-left-color:rgb(204,204,204);border-left-width:1pt;padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt">
<div>
<div>
<p style="margin:0cm 0cm 0.0001pt;line-height:16.25pt;vertical-align:baseline;background:white">
<span style="font-family:Cabin,serif;color:rgb(61,61,61)">Hi,</span><u></u><u></u></p>
<p style="margin:0cm 0cm 0.0001pt;line-height:16.25pt;vertical-align:baseline;min-height:8pt;word-spacing:0px;background:white">
<span style="font-family:Cabin,serif;color:rgb(61,61,61)"> </span><u></u><u></u></p>
<p style="margin:0cm 0cm 0.0001pt;line-height:16.25pt;vertical-align:baseline;word-spacing:0px;background:white">
<span style="font-family:Cabin,serif;color:rgb(61,61,61)">I am trying to port our existing application (in weblogic) to Jboss wildfly.</span><u></u><u></u></p>
<p style="margin:0cm 0cm 0.0001pt;line-height:16.25pt;vertical-align:baseline;min-height:8pt;word-spacing:0px;background:white">
<span style="font-family:Cabin,serif;color:rgb(61,61,61)"> </span><u></u><u></u></p>
<p style="margin:0cm 0cm 0.0001pt;line-height:16.25pt;vertical-align:baseline;word-spacing:0px;background:white">
<span style="font-family:Cabin,serif;color:rgb(61,61,61)">Our application supports multiple logins under same user id but each logins need to be treated in different security context. For this we invoke the login modules by invoking j_security_check for each
logins attempts. We use a custome Jaas login module from where the subject is created with a unique user token and set as name of the Principal after successful login. But when using wildfly, the login module is invoked only the first time and for the subsequent
login attempts, the user subject is looked up from the domain cache inside JBossCachedAuthenticationManager.</span><u></u><u></u></p>
<p style="margin:0cm 0cm 0.0001pt;line-height:16.25pt;vertical-align:baseline;min-height:8pt;word-spacing:0px;background:white">
<span style="font-family:Cabin,serif;color:rgb(61,61,61)"> </span><u></u><u></u></p>
<p style="margin:0cm 0cm 0.0001pt;line-height:16.25pt;vertical-align:baseline;word-spacing:0px;background:white">
<span style="font-family:Cabin,serif;color:rgb(61,61,61)">Further debugging into the issue i noticed below</span><u></u><u></u></p>
<p style="margin-right:0cm;margin-left:36pt;margin-bottom:0.0001pt;line-height:16.25pt;vertical-align:baseline;word-spacing:0px;background:white">
<span style="font-family:Cabin,serif;color:rgb(61,61,61)">1.</span><span style="font-size:7pt;color:rgb(61,61,61)">
</span><span style="font-family:Cabin,serif;color:rgb(61,61,61)">After jaas login completes, the org.wildfly.extension.undertow.security.AccountImpl in exchange of ServletRequest gets updated with the new Principal (token set during jaas login) and the OriginalPrincipal
remains the same as the user id. This is fine as expected (I hope).</span><u></u><u></u></p>
<p style="margin-right:0cm;margin-left:36pt;margin-bottom:0.0001pt;line-height:16.25pt;vertical-align:baseline;word-spacing:0px;background:white">
<span style="font-family:Cabin,serif;color:rgb(61,61,61)">2.</span><span style="font-size:7pt;color:rgb(61,61,61)">
</span><span style="font-family:Cabin,serif;color:rgb(61,61,61)">org.wildfly.extension.undertow.security.JAASIdentityManagerImpl.verifyCredential(final AccountImpl account, final Object credential) uses the OriginalPrincipal to send to authenticationManager for
validation. Since this is not updated, it will always be the original user id. <span style="background:white">
Below source code from <a href="http://jboss.as" target="_blank">jboss.as</a> uses </span></span><span style="font-family:Consolas;color:rgb(51,51,51);border:1pt none windowtext;padding:0cm;background:white">account</span><span style="font-family:Consolas;color:rgb(167,29,93);border:1pt none windowtext;padding:0cm;background:white">.</span><span style="font-family:Consolas;color:rgb(51,51,51);border:1pt none windowtext;padding:0cm;background:white">getPrincipal()
for getting the incomingPrincipal. But this is now changed to getOriginalPrincipal. </span><span style="font-family:Cabin,serif;color:rgb(61,61,61)"> I think this should be the principal (not the OriginalPrincipal).</span><u></u><u></u></p>
<p style="margin:0cm 0cm 0.0001pt;text-indent:36pt;line-height:16.25pt;vertical-align:baseline;word-spacing:0px;background:white">
<img border="0" width="715" height="182" src="cid:image001.png@01D14988.F41F31C0"><u></u><u></u></p>
<p style="margin-right:0cm;margin-left:36pt;margin-bottom:0.0001pt;line-height:16.25pt;vertical-align:baseline;word-spacing:0px;background:white">
<span style="font-family:Cabin,serif;color:rgb(61,61,61)">3.</span><span style="font-size:7pt;color:rgb(61,61,61)">
</span><span style="font-family:Cabin,serif;color:rgb(61,61,61)">org.jboss.security.authentication.JBossCachedAuthenticationManager caches the subject info against the OriginalPrincipal. Therefor it always returns from the cache after the first successful authentication
for a user id and JAAS login module is never invoked after that. Shouldn't the caching happen against the authenticated principal set in the subject (CallerPrincipal).</span><u></u><u></u></p>
<p style="margin:0cm 0cm 0.0001pt;line-height:16.25pt;vertical-align:baseline;min-height:8pt;word-spacing:0px;background:white">
<span style="font-family:Cabin,serif;color:rgb(61,61,61)"> </span><u></u><u></u></p>
<p style="margin:0cm 0cm 0.0001pt;line-height:16.25pt;vertical-align:baseline;word-spacing:0px;background:white">
<span style="font-family:Cabin,serif;color:rgb(61,61,61)">Can anyone please let me know whether this behavior change is possible ? Or is there any way I can configure custom class for org.wildfly.extension.undertow.security.JAASIdentityManagerImpl and org.jboss.security.authentication.JBossCachedAuthenticationManager
in wildfly 9.0.2.</span><u></u><u></u></p>
<p style="margin:0cm 0cm 0.0001pt;line-height:16.25pt;vertical-align:baseline;min-height:8pt;word-spacing:0px;background:white">
<span style="font-family:Cabin,serif;color:rgb(61,61,61)"> </span><u></u><u></u></p>
<p style="margin:0cm 0cm 0.0001pt;line-height:16.25pt;vertical-align:baseline;word-spacing:0px;background:white">
<span style="font-family:Cabin,serif;color:rgb(61,61,61)">Regards</span><u></u><u></u></p>
<p style="margin:0cm 0cm 0.0001pt;line-height:16.25pt;vertical-align:baseline;word-spacing:0px;background:white">
<span style="font-family:Cabin,serif;color:rgb(61,61,61)">Sony</span><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<p class="MsoNormal"><br>
<br>
DISCLAIMER: <span style="font-size:7.5pt;font-family:Tahoma,sans-serif;color:rgb(153,153,153)">
"The information in this e-mail and any attachment is intended only for the person to whom it is addressed and may contain confidential and/or privileged material. If you have received this e-mail in error, kindly contact the sender and destroy all copies of
the original communication. IBS makes no warranty, express or implied, nor guarantees the accuracy, adequacy or completeness of the information contained in this email or any attachment and is not liable for any errors, defects, omissions, viruses or for resultant
loss or damage, if any, direct or indirect."</span><u></u><u></u></p>
</div>
<p class="MsoNormal"><br>
_______________________________________________<br>
undertow-dev mailing list<br>
<a href="mailto:undertow-dev@lists.jboss.org" target="_blank">undertow-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/undertow-dev" target="_blank">https://lists.jboss.org/mailman/listinfo/undertow-dev</a><u></u><u></u></p>
</blockquote>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><br>
<br>
DISCLAIMER: <span style="font-size:7.5pt;font-family:Tahoma,sans-serif;color:rgb(153,153,153)">
"The information in this e-mail and any attachment is intended only for the person to whom it is addressed and may contain confidential and/or privileged material. If you have received this e-mail in error, kindly contact the sender and destroy all copies of
the original communication. IBS makes no warranty, express or implied, nor guarantees the accuracy, adequacy or completeness of the information contained in this email or any attachment and is not liable for any errors, defects, omissions, viruses or for resultant
loss or damage, if any, direct or indirect."</span><u></u><u></u></p>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div></div></div><div><div class="h5">
<br>
<br>
DISCLAIMER: <font color="#999999" size="1" face="Tahoma">"The information in this e-mail and any attachment is intended only for the person to whom it is addressed and may contain confidential and/or privileged material. If you have received this e-mail in
error, kindly contact the sender and destroy all copies of the original communication. IBS makes no warranty, express or implied, nor guarantees the accuracy, adequacy or completeness of the information contained in this email or any attachment and is not
liable for any errors, defects, omissions, viruses or for resultant loss or damage, if any, direct or indirect."</font><br>
<font size="1"></font>
</div></div></div>
</blockquote></div><br></div></div>