[Security & JAAS/JBoss] - JBoss datasource encryption
by aramin
We're running JBoss 4.0.5 (Windows in development, Linux in production), and I'm trying to encrypt a datasource password using our own algorithm, using this as a reference:
http://wiki.jboss.org/wiki/EncryptingDataSourcePasswords
I've been able to get this to work using the standard JBoss SecureIdentityLoginModule with an encrypted password. But I have not been able to tie in a custom algorithm.
I've changed the datasource.xml file to add the security domain:
<security-domain>EncryptDBPassword</security-domain>
and added the policy to login-config.xml:
<application-policy name="EncryptDBPassword">
| <authentication>
| <login-module code="org.jboss.resource.security.SecureCustomLoginModule" flag="required">
| <module-option name="username">admin</module-option>
| <module-option name="password">-207a6df87216de44</module-option>
| <module-option name="managedConnectionFactoryName">jboss.jca:name=PostgresDS,service=LocalTxCM</module-option>
| </login-module>
| </authentication>
| </application-policy>
I've then written my own SecureCustomLoginModule, which at this point is identical to SecureIdentityLoginModule, extending AbstractPasswordCredentialLoginModule. I keep it packaged in org.jboss.resource.security to it has access to the JBoss classes (like SubjectActions) and packaged it in a separate jar in the deploy folder.
But without even changing the encryption logic, JBoss will not authenticate when I use a custom security module. The code is the same, it just points to a different class.
Is there an example of a working or recommended implementation of this? A requirement here is to use our own encryption algorithm and custom key.
Errors follow below.
Thanks to anyone who can help!
error:
State: FAILED
| Reason: java.lang.SecurityException: Invalid authentication attempt, principal=null
|
| java.lang.SecurityException: Invalid authentication attempt, principal=null
| at org.jboss.resource.connectionmanager.BaseConnectionManager2.getSubject(BaseConnectionManager2.java:572)
| at org.jboss.resource.connectionmanager.BaseConnectionManager2.allocateConnection(BaseConnectionManager2.java:378)
| at org.jboss.resource.connectionmanager.BaseConnectionManager2$ConnectionManagerProxy.allocateConnection(BaseConnectionManager2.java:812)
| at org.jboss.resource.adapter.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:88)
| at org.jboss.ejb.plugins.cmp.jdbc.SQLUtil.fixTableName(SQLUtil.java:173)
| at org.jboss.ejb.plugins.cmp.jdbc.bridge.JDBCEntityBridge.init(JDBCEntityBridge.java:157)
| at org.jboss.ejb.plugins.cmp.jdbc.JDBCStoreManager.initStoreManager(JDBCStoreManager.java:435)
| at org.jboss.ejb.plugins.cmp.jdbc.JDBCStoreManager.start(JDBCStoreManager.java:368)
| at org.jboss.ejb.plugins.CMPPersistenceManager.start(CMPPersistenceManager.java:172)
| at org.jboss.ejb.EntityContainer.startPmAndInterceptors(EntityContainer.java:1063)
| at org.jboss.ejb.EjbModule.startService(EjbModule.java:422)
(If I switch back to the SecureIdentityLoginModule then everything works fine)
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4167457#4167457
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4167457
18 years, 1 month
[JBoss Messaging] - Re: How do I empty a JBoss queue?
by asaur
"timfox" wrote : If you have well written clients which always close their connection(s) properly before exiting then any unacknowledged messages will be returned immediately to the queue(s) on close of those connection(s), otherwise the after the client exits the server will eventually time out that client and close its resources automatically. That time is governed by the ping settings (see user guide)
Sorry for the delay, I was checking all my code and trying to reproduce the error again. Unfortunately, my problem still persists: of course, as a 'good' client, I try to close the connection I'm using when I'm going down. The problem might come from the fact that this client is a web server and that there are 5 threads (consumers) consuming the queue. Sometimes the server stops BEFORE the threads are able to close properly; in other words, the thread is destroyed rather than properly finished.
I simulated today 2 distinct situations: first, the client crashes and the server ended up with 4 messages. These were consumed right after the client started again and connected - I can say that by reading my client logs that (when in debug mode) tell me each time the client consumes a message. I reckon this is the way it should be. In the second try, the queue ended up with 8 messages after the client crashed. However, for some unknown reason, this time the messages were not consumed by the client when it started again and connected. They simply stood there. Unfortunately, it gets worse: whenever a producer sends a message to that queue, its size is increased by 1 and the new message is not consumed too. So, after many client restarts, my problem is still there: the size is increasing and the consumer is not consuming. Right now, I have 16 messages to be delivered, a client that should be consuming but it's not, and the not so good possibility that the only way to get things back in place is a restart of the server (which seems to be the only way to empty the queue).
Lastly, to try to further explain things I used a MySQL terminal to make a query that listed all my messages in that queue; I can't post the results here, but I can comment a bit on them. The messages have a distinct 'message_id', 'transaction_id' null, 'state' = 'C', a distinct 'ord' number, 'page_ord' null, 'delivery_count' = '0' and 'sched_delivery' = '0'. Does this help in any way?
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4167449#4167449
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4167449
18 years, 1 month
[JBoss Cache: Core Edition] - Disable Eviction in JBoss Cache 1.4.1 Sp9
by ssmayur
Hi
I have the following configuration as part of JBossCache.xml,
<attribute name="LockAcquisitionTimeout">15000</attribute>
| <attribute name="EvictionPolicyClass">org.jboss.cache.eviction.LRUPolicy</attribute>
| <attribute name="EvictionPolicyConfig">
| <config>
| <attribute name="wakeUpIntervalSeconds">0</attribute>
| <region name="/_default_">
| <attribute name="maxNodes">5000000</attribute>
| <attribute name="timeToLiveSeconds">0</attribute>
| <attribute name="maxAgeSeconds">0</attribute>
| </region>
| <region name="/org/jboss/data">
| <attribute name="maxNodes">5000000</attribute>
| <attribute name="timeToLiveSeconds">0</attribute>
| </region>
|
| <region name="/org/jboss/test/data">
| <attribute name="maxNodes">5000000</attribute>
| <attribute name="timeToLiveSeconds">0</attribute>
| </region>
| </config>
| </attribute>
as you can see , I have set tiem timToLiveSeconds to 0 for all regions.
When I run my JBoss tests, that has multiple threads just doing get(FQN) calls, I get this ,
"Thread-39" id=50 idx=0xcc tid=3248 prio=5 alive, in native, blocked
-- Blocked trying to get lock: java/lang/Object@0x2a32b518[fat lock]
at _dl_sysinfo_int80+2(:0)@0x7127a2
at ptWaitForEvent+76(:0)@0xb7eb2c5c
at tsiWaitForSignalForever+58(:0)@0xb7ee11ba
at tsiWaitForLockSignal+49(:0)@0xb7ee1321
at RJNI_jrockit_vm_Threads_waitForUnblockSignal+24(:0)@0xb7ed4778
at jrockit/vm/Threads.waitForUnblockSignal()V(Native Method)
at jrockit/vm/Locks.fatLockBlockOrSpin(Locks.java:1674)
at jrockit/vm/Locks.lockFat(Locks.java:1775)[optimized]
at jrockit/vm/Locks.monitorEnterSecondStageHard(Locks.java:1311)[optimized]
at jrockit/vm/Locks.monitorEnterSecondStage(Locks.java:1258)[optimized]
at EDU/oswego/cs/dl/util/concurrent/BoundedLinkedQueue.put(BoundedLinkedQueue.java:296)[inlined]
at org/jboss/cache/eviction/Region.putNodeEvent(Region.java:141)[optimized]
at org/jboss/cache/interceptors/EvictionInterceptor.doEventUpdatesOnRegionManager(EvictionInterceptor.java:149)[inlined]
at org/jboss/cache/interceptors/EvictionInterceptor.updateNode(EvictionInterceptor.java:122)[inlined]
at org/jboss/cache/interceptors/EvictionInterceptor.invoke(EvictionInterceptor.java:97)[optimized]
at org/jboss/cache/interceptors/Interceptor.invoke(Interceptor.java:68)[inlined]
at org/jboss/cache/interceptors/PessimisticLockInterceptor.invoke(PessimisticLockInterceptor.java:206)[optimized]
at org/jboss/cache/interceptors/Interceptor.invoke(Interceptor.java:68)[inlined]
at org/jboss/cache/interceptors/UnlockInterceptor.invoke(UnlockInterceptor.java:32)[optimized]
at org/jboss/cache/interceptors/Interceptor.invoke(Interceptor.java:68)[inlined]
at org/jboss/cache/interceptors/TxInterceptor.handleNonTxMethod(TxInterceptor.java:379)[optimized]
at org/jboss/cache/interceptors/TxInterceptor.invoke(TxInterceptor.java:174)[optimized]
at org/jboss/cache/interceptors/Interceptor.invoke(Interceptor.java:68)[inlined]
at org/jboss/cache/interceptors/CacheMgmtInterceptor.invoke(CacheMgmtInterceptor.java:138)[optimized]
Why is eviction happening? How can I diable eviction, so update and put nodeEvent are not invoked at all. I am just doing invoking get on the Tree Cache.
Tx
Mayur
anonymous wrote : anonymous wrote :
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4167445#4167445
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4167445
18 years, 1 month
[JBoss Cache: Core Edition] - Option to remove persistent data is a valid use case
by cacheuser
A Eviction policy option to be able to remove persistent data is valid use case that the JBoss Cahe does not support right. For example, we are storing data that we get by making a webservice call to other vendor, we have contract with to be able to store the data for no longer than a certain number of days. The current LRUPolicy supports maxAge that can be used to get the data out of the memory and we use persistent (JBDCCacheLoader) store to the data, ones that data is persistent store we dont have a way to identify and get rid of the data after x number of days. It is easy for the Cache to clean up the data that it creates and I modified the LRUPolicy and LRUConfiguration as follows to. The modifications are in bold
| /*
| * JBoss, the OpenSource J2EE webOS
| *
| * Distributable under LGPL license.
| * See terms of license at gnu.org.
| */
| package org.jboss.cache.eviction;
|
| import org.jboss.cache.config.ConfigurationException;
| import org.jboss.cache.config.Dynamic;
|
| /**
| * Configuration implementation for {@link LRUPolicy}.
| * <p/>
| * If configured via XML, expects the following:
| * <p/>
| * <pre>
| * <region name="/maxAgeTest/">
| * <attribute name="maxNodes">10000</attribute>
| * <attribute name="timeToLiveSeconds">8</attribute>
| * <attribute name="maxAgeSeconds">10</attribute>
| * </region>
| * </pre>
| *
| * @author Daniel Huang (dhuang(a)jboss.org)
| * @version $Revision: 6252 $
| */
| public class LRUConfiguration extends EvictionPolicyConfigBase
| {
| /**
| * The serialVersionUID
| */
| private static final long serialVersionUID = -3426716488271559729L;
|
| @Dynamic
| @Deprecated
| private int timeToLiveSeconds;
| @Dynamic
| @Deprecated
| private int maxAgeSeconds;
|
|
| /** value expressed in millis*/
| @Dynamic
| private long timeToLive;
|
| /** value expressed in millis*/
| @Dynamic
| private long maxAge;
|
| /** if true, nodes that are past maxAge will be removed*/
| @Dynamic
| private boolean maxAgeRemove;
|
| public LRUConfiguration()
| {
| super();
| // Force config of ttls
| setTimeToLive(-1);
| }
|
| public LRUConfiguration(long timeToLive, long maxAge)
| {
| super();
| setTimeToLive(timeToLive);
| setMaxAge(maxAge);
| setMaxAgeRemove(false);
| }
|
| @Override
| protected void setEvictionPolicyClassName()
| {
| setEvictionPolicyClass(LRUPolicy.class.getName());
| }
|
| /** value expressed in millis*/
| public long getTimeToLive()
| {
| return timeToLive;
| }
|
| /** value expressed in millis*/
| public void setTimeToLive(long timeToLive)
| {
| testImmutability("timeToLive");
| this.timeToLive = timeToLive;
| this.timeToLiveSeconds = (int)(timeToLive/1000);
| }
|
| /** value expressed in millis*/
| public long getMaxAge()
| {
| return maxAge;
| }
|
| /** value expressed in millis*/
| public void setMaxAge(long maxAge)
| {
| testImmutability("maxAge");
| this.maxAge = maxAge;
| this.maxAgeSeconds = (int) (maxAge/1000);
| }
|
| public boolean isMaxAgeRemove()
| {
| return maxAgeRemove;
| }
|
| public void setMaxAgeRemove(boolean maxAgeRemove)
| {
| this.maxAgeRemove = maxAgeRemove;
| }
|
| /**
| * use {@link #getTimeToLive()}
| * @return
| */
| @Deprecated
| public int getTimeToLiveSeconds()
| {
| return timeToLiveSeconds;
| }
|
| /**
| * Use {@link #setTimeToLive(long)}
| */
| @Deprecated
| public void setTimeToLiveSeconds(int timeToLiveSeconds)
| {
| testImmutability("timeToLiveSeconds");
| this.timeToLiveSeconds = timeToLiveSeconds;
| timeToLive = timeToLiveSeconds * 1000;
| }
|
| /**
| * Use {@link #getMaxAge()}
| * @deprecated
| */
| @Deprecated
| public int getMaxAgeSeconds()
| {
| return maxAgeSeconds;
| }
|
| /**
| * Use {@link #getMaxAge()}
| * @param maxAgeSeconds
| */
| @Deprecated
| public void setMaxAgeSeconds(int maxAgeSeconds)
| {
| testImmutability("maxAgeSeconds");
| this.maxAgeSeconds = maxAgeSeconds;
| this.maxAge = maxAgeSeconds * 1000;
| }
|
| /**
| * Requires a positive timeToLive value or ConfigurationException
| * is thrown.
| */
| @Override
| public void validate() throws ConfigurationException
| {
| if (timeToLive < 0)
| {
| throw new ConfigurationException("timeToLive must be " +
| "configured to a value greater than or equal to 0 for " + getEvictionPolicyClass());
| }
| }
|
|
| public String toString()
| {
| return "LRUConfiguration{" +
| "timeToLiveSeconds=" + timeToLiveSeconds +
| ", timeToLive=" + timeToLive +
| ", maxAge=" + maxAge +
| '}';
| }
|
| public boolean equals(Object o)
| {
| if (this == o) return true;
| if (!(o instanceof LRUConfiguration)) return false;
| if (!super.equals(o)) return false;
|
| LRUConfiguration that = (LRUConfiguration) o;
|
| if (maxAge != that.maxAge) return false;
| if (maxAgeSeconds != that.maxAgeSeconds) return false;
| if (timeToLive != that.timeToLive) return false;
| if (timeToLiveSeconds != that.timeToLiveSeconds) return false;
|
| return true;
| }
|
| public int hashCode()
| {
| int result = super.hashCode();
| result = 31 * result + timeToLiveSeconds;
| result = 31 * result + maxAgeSeconds;
| result = 31 * result + (int) (timeToLive ^ (timeToLive >>> 32));
| result = 31 * result + (int) (maxAge ^ (maxAge >>> 32));
| return result;
| }
|
| @Override
| public void reset()
| {
| super.reset();
| setTimeToLive(-1);
| }
|
| @Override
| public LRUConfiguration clone() throws CloneNotSupportedException
| {
| return (LRUConfiguration) super.clone();
| }
|
| }
|
| /*
| * JBoss, the OpenSource J2EE webOS
| *
| * Distributable under LGPL license.
| * See terms of license at gnu.org.
| * Created on March 25 2003
| */
| package org.jboss.cache.eviction;
|
| import org.jboss.cache.CacheSPI;
| import org.jboss.cache.Fqn;
| import org.jboss.cache.RegionManager;
|
| /**
| * Provider to provide eviction policy. This one is based on LRU algorithm that a user
| * can specify either maximum number of nodes or the idle time of a node to be evicted.
| *
| * @author Ben Wang 02-2004
| * @author Daniel Huang - dhuang(a)jboss.org
| * @version $Revision: 5730 $
| */
| public class LRUPolicy extends BaseEvictionPolicy
| {
| protected RegionManager regionManager_;
|
| protected EvictionAlgorithm algorithm;
|
| public LRUPolicy()
| {
| super();
| algorithm = new LRUAlgorithm();
| }
|
| public EvictionAlgorithm getEvictionAlgorithm()
| {
| return algorithm;
| }
|
| public void evict(Fqn fqn) throws Exception
| {
| if(((LRUAlgorithm)algorithm).getConfiguration().isMaxAgeRemove())
| cache_.removeNode(fqn);
| else
| cache_.evict(fqn, false);
| }
|
| public Class<LRUConfiguration> getEvictionConfigurationClass()
| {
| return LRUConfiguration.class;
| }
|
| @Override
| public void setCache(CacheSPI cache)
| {
| super.setCache(cache);
| regionManager_ = cache_.getRegionManager();
| }
| }
|
|
| <?xml version="1.0" encoding="UTF-8"?>
|
| <!-- ===================================================================== -->
| <!-- -->
| <!-- Sample JBoss Cache Service Configuration -->
| <!-- -->
| <!-- ===================================================================== -->
|
| <server>
|
| <!-- ==================================================================== -->
| <!-- Defines JBoss Cache configuration -->
| <!-- ==================================================================== -->
|
|
| <mbean code="org.jboss.cache.jmx.CacheJmxWrapper"
| name="jboss.mycache:service=Cache">
|
|
|
| <attribute name="IsolationLevel">REPEATABLE_READ</attribute>
|
| <!-- Lock parent before doing node additions/removes -->
| <attribute name="LockParentForChildInsertRemove">true</attribute>
|
| <!-- Valid modes are LOCAL (default)
| REPL_ASYNC
| REPL_SYNC
| INVALIDATION_ASYNC
| INVALIDATION_SYNC -->
| <attribute name="CacheMode">LOCAL</attribute>
|
| <!-- Name of cluster. Needs to be the same for all JBoss Cache nodes in a
| cluster in order to find each other.
| -->
| <attribute name="ClusterName">JBossCache-Cluster</attribute>
|
| <!-- JGroups protocol stack properties.
| ClusterConfig isn't used if the multiplexer is enabled above.
| -->
| <attribute name="ClusterConfig">
| <config>
| <!-- UDP: if you have a multihomed machine, set the bind_addr
| attribute to the appropriate NIC IP address -->
| <!-- UDP: On Windows machines, because of the media sense feature
| being broken with multicast (even after disabling media sense)
| set the loopback attribute to true -->
| <UDP mcast_addr="228.1.2.3" mcast_port="48866"
| ip_ttl="64" ip_mcast="true"
| mcast_send_buf_size="150000" mcast_recv_buf_size="80000"
| ucast_send_buf_size="150000" ucast_recv_buf_size="80000"
| loopback="false"/>
| <PING timeout="2000" num_initial_members="3"/>
| <MERGE2 min_interval="10000" max_interval="20000"/>
| <FD shun="true"/>
| <FD_SOCK/>
| <VERIFY_SUSPECT timeout="1500"/>
| <pbcast.NAKACK gc_lag="50" retransmit_timeout="600,1200,2400,4800" />
| <UNICAST timeout="600,1200,2400,4800" />
| <pbcast.STABLE desired_avg_gossip="400000"/>
| <FC max_credits="2000000" min_threshold="0.10"/>
| <FRAG2 frag_size="8192"/>
| <pbcast.GMS join_timeout="5000" shun="true" print_local_addr="true"/>
| <pbcast.STATE_TRANSFER/>
| </config>
| </attribute>
|
| <attribute name="StateRetrievalTimeout">20000</attribute>
| <attribute name="SyncReplTimeout">20000</attribute>
|
| <!-- Max number of milliseconds to wait for a lock acquisition -->
| <attribute name="LockAcquisitionTimeout">15000</attribute>
|
| <!-- Shutdown hook behavior. Valid choices are: DEFAULT, REGISTER and DONT_REGISTER.
| If this element is omitted, DEFAULT is used. -->
| <attribute name="ShutdownHookBehavior">DEFAULT</attribute>
|
| <!-- Enables or disables lazy unmarshalling. If omitted, the default is that lazy unmarshalling is enabled. -->
| <attribute name="UseLazyDeserialization">true</attribute>
|
| <!-- Specific eviction policy configurations. This is LRU -->
| <attribute name="EvictionPolicyConfig">
| <config>
| <attribute name="wakeUpIntervalSeconds">60</attribute>
| <!-- This defaults to 200000 if not specified -->
| <attribute name="eventQueueSize">200000</attribute>
|
| <attribute name="policyClass">org.jboss.cache.eviction.LRUPolicy</attribute>
|
|
| <!-- Cache wide default -->
| <region name="/">
| <attribute name="maxNodes">5</attribute>
| <attribute name="maxAgeSeconds">6000</attribute>
| <attribute name="timeToLiveSeconds">6000</attribute>
| </region>
| <region name="/vendorcache">
| <attribute name="maxNodes">5</attribute>
| <attribute name="maxAgeSeconds">60</attribute>
| <attribute name="timeToLiveSeconds">60</attribute>
| <attribute name="maxAgeRemove">true</attribute>
| </region>
| </config>
| </attribute>
|
| <attribute name="CacheLoaderConfig">
| <config>
| <!-- if passivation is true, only the first cache loader is used; the rest are ignored -->
| <passivation>false</passivation>
| <preload>/vendorcache</preload>
| <shared>true</shared>
|
| <cacheloader>
| <class>org.jboss.cache.loader.JDBCCacheLoader</class>
|
| <properties>
| cache.jdbc.table.name=jbosscachenew
| cache.jdbc.table.create=true
| cache.jdbc.table.drop=false
| cache.jdbc.table.select=true
| cache.jdbc.table.primarykey=jbosscachenew_pk
| cache.jdbc.fqn.column=fqn
| cache.jdbc.fqn.type=varchar(255)
| cache.jdbc.node.column=node
| cache.jdbc.node.type=blob
| cache.jdbc.parent.column=parent
| cache.jdbc.driver=com.mysql.jdbc.Driver
| cache.jdbc.url=jdbc:mysql://server:3315/GIS_DEV
| cache.jdbc.user=gis
| cache.jdbc.password=tester
| cache.jdbc.sql-concat=concat(1,2)
| </properties>
|
| <async>false</async>
| <fetchPersistentState>true</fetchPersistentState>
|
| <ignoreModifications>false</ignoreModifications>
|
| <purgeOnStartup>false</purgeOnStartup>
| </cacheloader>
|
| </config>
| </attribute>
|
| </mbean>
| </server>
|
The modified LRUPolicy works fine and removes the data when the maxAge of the nodes are reached. Can we have this feature in 3.0 please, if any coding/testing help is needed I can provide it. The fundamental reason to have this feature is as the Cache creates the data it should provide a way to clean it too, otherwise the Cache is not proving a full solution.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4167440#4167440
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4167440
18 years, 1 month