[JBoss JIRA] (SECURITY-640) Jboss Negotiation fallback to login page if NTLM token is received or the user is not present in active directory.
1:46 a.m.
Hrishi Salvi created SECURITY-640:
-------------------------------------
Summary: Jboss Negotiation fallback to login page if NTLM token is received
or the user is not present in active directory.
Key: SECURITY-640
URL: https://issues.jboss.org/browse/SECURITY-640
Project: PicketBox (JBoss Security and Identity Management)
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Negotiation
Environment: Active Directory Winwos 2003, Client Machine windows XP, Jboss
Server Machine Window XP and Jboss 6.1
Reporter: Hrishi Salvi
Assignee: Darran Lofthouse
We are trying to configure the single sign on using jboss negotiation.
We are able to login successfully if the user is present in active directory.
But in case if user is not present in active directory users, it throw 401 error page.
Instead of 401 we want user to access login form and authenticate user using different
login module.
In our case we have login page we authenticate user on that page.
If we receive user credentials we login the user without asking for password.
Now if the user credentials are not received then we want user to open login form present
on login page, but before that is throws 401 error.
We have configure the login-config.xml, web.xml and jboss-web.xml as per the
documentation.
Also defined
<web-resource-collection>
<web-resource-name>Restricted</web-resource-name>
<url-pattern>/Request</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
in web.xml
Our application is access through Request servlet.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:54 a.m.
[
https://issues.jboss.org/browse/SECURITY-640?page=com.atlassian.jira.plug...
]
Hrishi Salvi updated SECURITY-640:
----------------------------------
Steps to Reproduce:
edit web.xml as
<web-resource-collection>
<web-resource-name>Restricted</web-resource-name>
<url-pattern>/Request</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
<login-config>
<auth-method>SPNEGO</auth-method>
<realm-name>SPNEGO</realm-name>
</login-config>
edit jboss-web.xml
<security-domain>java:/jaas/SPNEGO</security-domain>
edit login-config.xml
<application-policy name="host">
<authentication>
<login-module code="com.sun.security.auth.module.Krb5LoginModule"
flag="required">
<module-option name="storeKey">true</module-option>
<module-option name="useKeyTab">true</module-option>
<module-option name="principal">%princpal%</module-option>
<module-option name="keyTab">%keytab path%</module-option>
<module-option name="doNotPrompt">true</module-option>
<module-option name="debug">true</module-option>
</login-module>
</authentication>
</application-policy>
<application-policy name="SPNEGO">
<authentication>
<login-module
code="org.jboss.security.negotiation.spnego.SPNEGOLoginModule">
<module-option
name="password-stacking">useFirstPass</module-option>
<module-option
name="serverSecurityDomain">host</module-option>
</login-module>
</authentication>
</application-policy>
Jboss Negotiation fallback to login page if NTLM token is received or
the user is not present in active directory.
------------------------------------------------------------------------------------------------------------------
Key: SECURITY-640
URL: https://issues.jboss.org/browse/SECURITY-640
Project: PicketBox (JBoss Security and Identity Management)
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Negotiation
Environment: Active Directory Winwos 2003, Client Machine windows XP, Jboss
Server Machine Window XP and Jboss 6.1
Reporter: Hrishi Salvi
Assignee: Darran Lofthouse
We are trying to configure the single sign on using jboss negotiation.
We are able to login successfully if the user is present in active directory.
But in case if user is not present in active directory users, it throw 401 error page.
Instead of 401 we want user to access login form and authenticate user using different
login module.
In our case we have login page we authenticate user on that page.
If we receive user credentials we login the user without asking for password.
Now if the user credentials are not received then we want user to open login form
present
on login page, but before that is throws 401 error.
We have configure the login-config.xml, web.xml and jboss-web.xml as per the
documentation.
Also defined
<web-resource-collection>
<web-resource-name>Restricted</web-resource-name>
<url-pattern>/Request</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
in web.xml
Our application is access through Request servlet.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:58 a.m.
[
https://issues.jboss.org/browse/SECURITY-640?page=com.atlassian.jira.plug...
]
Hrishi Salvi updated SECURITY-640:
----------------------------------
Steps to Reproduce:
edit web.xml as
<web-resource-collection>
<web-resource-name>Restricted</web-resource-name>
<url-pattern>*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
<login-config>
<auth-method>SPNEGO</auth-method>
<realm-name>SPNEGO</realm-name>
</login-config>
edit jboss-web.xml
<security-domain>java:/jaas/SPNEGO</security-domain>
edit login-config.xml
<application-policy name="host">
<authentication>
<login-module code="com.sun.security.auth.module.Krb5LoginModule"
flag="required">
<module-option name="storeKey">true</module-option>
<module-option name="useKeyTab">true</module-option>
<module-option name="principal">%princpal%</module-option>
<module-option name="keyTab">%keytab path%</module-option>
<module-option name="doNotPrompt">true</module-option>
<module-option name="debug">true</module-option>
</login-module>
</authentication>
</application-policy>
<application-policy name="SPNEGO">
<authentication>
<login-module
code="org.jboss.security.negotiation.spnego.SPNEGOLoginModule">
<module-option
name="password-stacking">useFirstPass</module-option>
<module-option
name="serverSecurityDomain">host</module-option>
</login-module>
</authentication>
</application-policy>
hit login page with the user authenticated using active directory you will be able to
login.
Now hit login page with user that is not present in active directory
401 error thrown.
Instead of 401 user should be able to view login form.
was:
edit web.xml as
<web-resource-collection>
<web-resource-name>Restricted</web-resource-name>
<url-pattern>/Request</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
<login-config>
<auth-method>SPNEGO</auth-method>
<realm-name>SPNEGO</realm-name>
</login-config>
edit jboss-web.xml
<security-domain>java:/jaas/SPNEGO</security-domain>
edit login-config.xml
<application-policy name="host">
<authentication>
<login-module code="com.sun.security.auth.module.Krb5LoginModule"
flag="required">
<module-option name="storeKey">true</module-option>
<module-option name="useKeyTab">true</module-option>
<module-option name="principal">%princpal%</module-option>
<module-option name="keyTab">%keytab path%</module-option>
<module-option name="doNotPrompt">true</module-option>
<module-option name="debug">true</module-option>
</login-module>
</authentication>
</application-policy>
<application-policy name="SPNEGO">
<authentication>
<login-module
code="org.jboss.security.negotiation.spnego.SPNEGOLoginModule">
<module-option
name="password-stacking">useFirstPass</module-option>
<module-option
name="serverSecurityDomain">host</module-option>
</login-module>
</authentication>
</application-policy>
Jboss Negotiation fallback to login page if NTLM token is received or
the user is not present in active directory.
------------------------------------------------------------------------------------------------------------------
Key: SECURITY-640
URL: https://issues.jboss.org/browse/SECURITY-640
Project: PicketBox (JBoss Security and Identity Management)
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Negotiation
Environment: Active Directory Winwos 2003, Client Machine windows XP, Jboss
Server Machine Window XP and Jboss 6.1
Reporter: Hrishi Salvi
Assignee: Darran Lofthouse
We are trying to configure the single sign on using jboss negotiation.
We are able to login successfully if the user is present in active directory.
But in case if user is not present in active directory users, it throw 401 error page.
Instead of 401 we want user to access login form and authenticate user using different
login module.
In our case we have login page we authenticate user on that page.
If we receive user credentials we login the user without asking for password.
Now if the user credentials are not received then we want user to open login form
present
on login page, but before that is throws 401 error.
We have configure the login-config.xml, web.xml and jboss-web.xml as per the
documentation.
Also defined
<web-resource-collection>
<web-resource-name>Restricted</web-resource-name>
<url-pattern>/Request</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
in web.xml
Our application is access through Request servlet.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:30 a.m.
[
https://issues.jboss.org/browse/SECURITY-640?page=com.atlassian.jira.plug...
]
Darran Lofthouse resolved SECURITY-640.
---------------------------------------
Resolution: Rejected
Do you have a forum discussion started for this? If not can you please start one, Jira is
for confirmed or almost confirmed bugs at the moment this is a debug question. Can you
make sure you do specify in your discussion the version of JBoss Negotiation that you are
using.
Jboss Negotiation fallback to login page if NTLM token is received or
the user is not present in active directory.
------------------------------------------------------------------------------------------------------------------
Key: SECURITY-640
URL: https://issues.jboss.org/browse/SECURITY-640
Project: PicketBox (JBoss Security and Identity Management)
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Negotiation
Environment: Active Directory Winwos 2003, Client Machine windows XP, Jboss
Server Machine Window XP and Jboss 6.1
Reporter: Hrishi Salvi
Assignee: Darran Lofthouse
We are trying to configure the single sign on using jboss negotiation.
We are able to login successfully if the user is present in active directory.
But in case if user is not present in active directory users, it throw 401 error page.
Instead of 401 we want user to access login form and authenticate user using different
login module.
In our case we have login page we authenticate user on that page.
If we receive user credentials we login the user without asking for password.
Now if the user credentials are not received then we want user to open login form
present
on login page, but before that is throws 401 error.
We have configure the login-config.xml, web.xml and jboss-web.xml as per the
documentation.
Also defined
<web-resource-collection>
<web-resource-name>Restricted</web-resource-name>
<url-pattern>/Request</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
in web.xml
Our application is access through Request servlet.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:01 a.m.
[
https://issues.jboss.org/browse/SECURITY-640?page=com.atlassian.jira.plug...
]
Hrishi Salvi commented on SECURITY-640:
---------------------------------------
Darran, thanks for quick response; can you share forum link where we can raise this? We
are using JBoss 6.1, Jboss Negotiation Version: 2.1.0.GA which is by default shipped with
Jboss 6.1, we have not made any changes in jar.
Jboss Negotiation fallback to login page if NTLM token is received or
the user is not present in active directory.
------------------------------------------------------------------------------------------------------------------
Key: SECURITY-640
URL: https://issues.jboss.org/browse/SECURITY-640
Project: PicketBox (JBoss Security and Identity Management)
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Negotiation
Environment: Active Directory Winwos 2003, Client Machine windows XP, Jboss
Server Machine Window XP and Jboss 6.1
Reporter: Hrishi Salvi
Assignee: Darran Lofthouse
We are trying to configure the single sign on using jboss negotiation.
We are able to login successfully if the user is present in active directory.
But in case if user is not present in active directory users, it throw 401 error page.
Instead of 401 we want user to access login form and authenticate user using different
login module.
In our case we have login page we authenticate user on that page.
If we receive user credentials we login the user without asking for password.
Now if the user credentials are not received then we want user to open login form
present
on login page, but before that is throws 401 error.
We have configure the login-config.xml, web.xml and jboss-web.xml as per the
documentation.
Also defined
<web-resource-collection>
<web-resource-name>Restricted</web-resource-name>
<url-pattern>/Request</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
in web.xml
Our application is access through Request servlet.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
6 a.m.
[
https://issues.jboss.org/browse/SECURITY-640?page=com.atlassian.jira.plug...
]
Hrishi Salvi commented on SECURITY-640:
---------------------------------------
discussion thread :
https://community.jboss.org/thread/177372
ok with any work around or any other configuration changes
Jboss Negotiation fallback to login page if NTLM token is received or
the user is not present in active directory.
------------------------------------------------------------------------------------------------------------------
Key: SECURITY-640
URL: https://issues.jboss.org/browse/SECURITY-640
Project: PicketBox (JBoss Security and Identity Management)
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Negotiation
Environment: Active Directory Winwos 2003, Client Machine windows XP, Jboss
Server Machine Window XP and Jboss 6.1
Reporter: Hrishi Salvi
Assignee: Darran Lofthouse
We are trying to configure the single sign on using jboss negotiation.
We are able to login successfully if the user is present in active directory.
But in case if user is not present in active directory users, it throw 401 error page.
Instead of 401 we want user to access login form and authenticate user using different
login module.
In our case we have login page we authenticate user on that page.
If we receive user credentials we login the user without asking for password.
Now if the user credentials are not received then we want user to open login form
present
on login page, but before that is throws 401 error.
We have configure the login-config.xml, web.xml and jboss-web.xml as per the
documentation.
Also defined
<web-resource-collection>
<web-resource-name>Restricted</web-resource-name>
<url-pattern>/Request</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
in web.xml
Our application is access through Request servlet.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
5305
days inactive
5305
days old
5 comments
2 participants
participants (2)
-
Darran Lofthouse (JIRA) -
Hrishi Salvi (JIRA)