[JBoss JIRA] Created: (JBPORTAL-1779) SynchronizingLoginModule prevents access to Dashboard
by Guy M. Spillman, Jr. (JIRA)
SynchronizingLoginModule prevents access to Dashboard
-----------------------------------------------------
Key: JBPORTAL-1779
URL: http://jira.jboss.com/jira/browse/JBPORTAL-1779
Project: JBoss Portal
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Portal Security
Affects Versions: 2.6.2 Final
Environment: Pentium 3 - 2GB memroy - 20 GB of Free Space
Windows XP Professional Service Pack 2
JBoss Portal 2.6.2 + JBoss AS 4.2.1 Bundle
Reporter: Guy M. Spillman, Jr.
Assigned To: Julien Viet
Users who athenticate using an additional login module after the IdentityLoginModule get the following HTTP error when clicking on their Dashboard link:
HTTP Status 403 -
--------------------------------------------------------------------------------
type Status report
message
description Access to the specified resource () has been forbidden.
--------------------------------------------------------------------------------
JBossWeb/2.0.0.GA
Users who login with the IdentityLoginModule (such as the default user & admin usernames) will see their Dashboard content without problems.
Problem was discovered using JaasLounge(http://jaaslounge.sourceforge.net/ ) NTLMLoginModule, but can be duplicated using JBoss' UsersRolesLoginModule.
This problem was originally discussed in the following thread, but seams to be a different problem since it can be duplicated using JBoss code only.
http://www.jboss.com/index.html?module=bb&op=viewtopic&t=119733
Configuration:
${jboss.server.home.dir}\deploy\jboss-portal.sar\conf\login-config.xml:
Code:
<login-module code="org.jboss.portal.identity.auth.IdentityLoginModule" flag="sufficient">
<module-option name="unauthenticatedIdentity">guest</module-option>
<module-option name="userModuleJNDIName">java:/portal/UserModule</module-option>
<module-option name="roleModuleJNDIName">java:/portal/RoleModule</module-option>
<module-option name="userProfileModuleJNDIName">java:/portal/UserProfileModule</module-option>
<module-option name="membershipModuleJNDIName">java:/portal/MembershipModule</module-option>
<module-option name="additionalRole">Authenticated</module-option>
<module-option name="password-stacking">useFirstPass</module-option>
</login-module>
<login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule" flag="required" />
<login-module code="org.jboss.portal.identity.auth.SynchronizingLoginModule" flag="optional">
<module-option name="synchronizeIdentity">true</module-option>
<module-option name="synchronizeRoles">false</module-option>
<module-option name="additionalRole">Authenticated</module-option>
<module-option name="defaultAssignedRole">User</module-option>
<module-option name="userModuleJNDIName">java:/portal/UserModule</module-option>
<module-option name="roleModuleJNDIName">java:/portal/RoleModule</module-option>
<module-option name="membershipModuleJNDIName">java:/portal/MembershipModule</module-option>
<module-option name="userProfileModuleJNDIName">java:/portal/UserProfileModule</module-option>
</login-module>
${jboss.server.home.dir}\conf\defaultRoles.properties:
Code:
testuser=test
testuser2=test2
${jboss.server.home.dir}\conf\defaultUsers.properties:
Code:
testuser=testrole1,testrole2
testuser2=testrole3,testrole4
Procedure:
1. Login a testuser/test.
2. Click Dashboard link.
The HTTP Status 403 error described above will be displayed.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
17 years
[JBoss JIRA] Created: (JBMESSAGING-1199) Improve flow control
by Tim Fox (JIRA)
Improve flow control
--------------------
Key: JBMESSAGING-1199
URL: http://jira.jboss.com/jira/browse/JBMESSAGING-1199
Project: JBoss Messaging
Issue Type: Task
Reporter: Tim Fox
Assigned To: Tim Fox
Fix For: Stable branch
The current consumer flow control algorithm can result in many more messages than the buffer size arriving at a client consumer, since the server does not stop sending until it receives a stop message.
For fast messaging this should even out. But when consumers are slower this can cause problems.
The algorithm should instead automatically stop sending when buffer size messages are sent, and wait for a change rate +.
This should make distribution between many consumers much smoother.
Workaround for now is to set slowConsumes = true. But this effectively turns off buffering altogether.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
17 years