[Security & JAAS/JBoss] - Re: Negotiate with Kerberos
by hpkolasani
I followed the instructions from http://wiki.jboss.org/wiki/Wiki.jsp?page=NegotiateKerberos (using JBoss 4.02) and it appears that the SPNEGO/NTLM handshaking and getting the principal from token seems to be working fine. I can also see that the 'login()' method of 'NegotiateLoginModule' is returning the Principal successfully.
But the silent authentaication is not happening in the 'test' web app.
It looks like in 'HttpServletRequestResponseValve.authenitcate()' , the following code is returning 'null' for the principal.
// Start the authentication with the retrieved user, and a blank
// password. This will be mostly ignored by the login module, but needed
// to do this to allow role retrieval and other stuff to work properly
principal = getContainer().getRealm().authenticate(userId == null ? "" : userId, "");
Here is some log info. from jboss server.log
***********************************************************
2006-11-26 10:26:35,875 INFO [org.apache.jk.server.JkMain] Jk running ID=0 time=0/47 config=null
2006-11-26 10:26:35,875 INFO [org.jboss.system.server.Server] JBoss (MX MicroKernel) [4.0.2 (build: CVSTag=JBoss_4_0_2 date=200505022023)] Started in 13s:47ms
2006-11-26 10:27:58,515 DEBUG [org.jboss.security.plugins.JaasSecurityManagerService] Created securityMgr=org.jboss.security.plugins.JaasSecurityManager@d1afd3
2006-11-26 10:27:58,515 DEBUG [org.jboss.security.plugins.JaasSecurityManager.SPNEGO] CachePolicy set to: org.jboss.util.TimedCachePolicy@6e795b
2006-11-26 10:27:58,515 DEBUG [org.jboss.security.plugins.JaasSecurityManagerService] setCachePolicy, c=org.jboss.util.TimedCachePolicy@6e795b
2006-11-26 10:27:58,515 DEBUG [org.jboss.security.plugins.JaasSecurityManagerService] Added SPNEGO, org.jboss.security.plugins.SecurityDomainContext@e1469c to map
2006-11-26 10:27:58,609 DEBUG [org.jboss.web.tomcat.security.AdvancedWebCallbackHandler] Got SecurityAssociationCallback: org.jboss.security.auth.callback.SecurityAssociationCallback@93a985
2006-11-26 10:27:58,609 DEBUG [org.jboss.web.tomcat.security.AdvancedWebCallbackHandler] Sending back authorization header
2006-11-26 10:27:58,640 DEBUG [org.jboss.web.tomcat.security.HttpServletRequestResponseValve] Realm returned: null
2006-11-26 10:27:58,640 DEBUG [org.jboss.web.tomcat.security.AdvancedWebCallbackHandler] Got NegotiateCallback: [B@8518d4
2006-11-26 10:27:58,640 DEBUG [org.jboss.web.tomcat.security.AdvancedWebCallbackHandler] Token was Type 1 NTLM
2006-11-26 10:27:58,687 DEBUG [org.jboss.web.tomcat.security.HttpServletRequestResponseValve] Realm returned: null
2006-11-26 10:27:58,687 DEBUG [org.jboss.web.tomcat.security.AdvancedWebCallbackHandler] Got NegotiateCallback: [B@71d29a
2006-11-26 10:27:58,687 DEBUG [org.jboss.web.tomcat.security.AdvancedWebCallbackHandler] Token was Type 3 NTLM
2006-11-26 10:27:58,687 DEBUG [org.jboss.security.auth.NegotiateLoginModule] Found NTLM token in SPNEGO: [B@71d29a
2006-11-26 10:28:00,062 DEBUG [org.jboss.web.tomcat.security.HttpServletRequestResponseValve] Realm returned: null
***********************************************************
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3988666#3988666
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3988666
19Â years, 5Â months
[JBoss Seam] - Re: [DVD example] how to directly go back to the checkout pa
by ellenzhao
Just Got it with two pageflow definition files. :-) (the names of the transition nodes and view ids are modified according to the requirement of my application. But the idea is not difficult to capture...
the boomBookingFlow.jpdl.xml:
| <?xml version="1.0" encoding="UTF-8"?>
|
| <pageflow-definition name="roomBookingFlow">
| <start-state name="start">
| <transition to="preference" />
| </start-state>
|
| <page name="preference" view-id="/reservations/preferences.xhtml">
| <redirect />
| <transition name="pricing" to="checkAvailability">
| <action expression="#{roomBooking.doPricing}" />
| </transition>
| <transition name="cancel" to="cancelPage" />
| </page>
|
| <decision name="checkAvailability"
| expression="#{roomBooking.roomAvailable}">
| <transition name="true" to="payment" />
| <transition name="false" to="preference" />
| </decision>
|
| <page name="payment" view-id="/reservations/payment.xhtml"
| no-conversation-view-id="/reservations/preferences.xhtml">
| <redirect />
| <transition name="next" to="checkLoggedIn" />
| <transition name="back" to="preference" />
| <transition name="cancel" to="cancelPage" />
| </page>
|
| <decision name="checkLoggedIn" expression="#{login.loggedIn}">
| <transition name="true" to="checkPayment" />
| <transition name="false" to="loginPage" />
| </decision>
|
| <page name="loginPage" view-id="/login.xhtml">
| <transition name="login" to="checkLoggedIn">
| <action expression="#{login.login}" />
| </transition>
| <transition name="newguest" to="registerConversation">
| <action expression="#{register.startEdit}" />
| </transition>
| <transition name="continue" to="checkPayment" />
| <transition name="back" to="payment" />
| <transition name="cancel" to="cancelPage" />
| </page>
|
| <page name="registerConversation" view-id="/register/account.xhtml" />
|
|
| <decision name="checkPayment"
| expression="#{roomBooking.validPayment}">
| <transition name="true" to="review" />
| <transition name="false" to="payment" />
| </decision>
|
| <page name="review" view-id="/reservations/review-details.xhtml"
| no-conversation-view-id="/reservations/preferences.xhtml">
| <redirect />
| <transition name="book" to="confirmation">
| <action expression="#{roomBooking.bookRoom}" />
| </transition>
| <transition name="back" to="payment" />
| <transition name="cancel" to="cancelPage" />
| </page>
|
| <page name="confirmation" view-id="/reservations/complete.xhtml"
| no-conversation-view-id="/reservations/preferences.xhtml">
| <redirect />
| <end-conversation />
| </page>
|
| <page name="cancelPage" view-id="/home.xhtml"
| no-conversation-view-id="/home.xhtml">
| <redirect />
| <end-conversation />
| </page>
|
| </pageflow-definition>
|
the register.jpdl.xml:
| <pageflow-definition name="newguest">
| <start-state name="start">
| <transition to="account" />
| </start-state>
|
| <page name="account" view-id="/register/account.xhtml">
| <redirect />
| <transition name="next" to="checkPassword" />
| </page>
|
| <decision name="checkPassword"
| expression="#{register.validNamePassword}">
| <transition name="true" to="detail" />
| <transition name="false" to="account" />
| </decision>
|
|
| <page name="detail" view-id="/register/detail.xhtml"
| no-conversation-view-id="/register/account.xhtml">
| <redirect />
| <transition name="prev" to="account" />
| <transition name="next" to="confirmation" />
| </page>
|
| <page name="confirmation" view-id="/register/confirmation.xhtml"
| no-conversation-view-id="/register/account.xhtml">
| <redirect />
| <transition name="edit" to="detail" />
| <transition name="confirm" to="complete">
| <action expression="#{register.saveUser}" />
| </transition>
|
| </page>
|
| <page name="complete" view-id="/register/complete.xhtml"
| no-conversation-view-id="/register/account.xhtml">
| <redirect />
| <end-conversation />
| </page>
|
| </pageflow-definition>
|
|
the diagrams are here:
The room booking flow:
[img]http://www.ningning.org/gallery/main.php/d/28-2/roomBooking-pageflow....]
The register flow
[img]http://www.ningning.org/gallery/main.php/d/26-2/register-pageflow.png...]
Here the register conversation is a nested conversation of the room booking conversation.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3988659#3988659
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3988659
19Â years, 5Â months
![img]http://www.ningning.org/gallery/main.php/d/28-2/roomBooking-pageflow....](http://img]http://www.ningning.org/gallery/main.php/d/28-2/roomBooking-pageflow.png[/img){kind=link}
![img]http://www.ningning.org/gallery/main.php/d/26-2/register-pageflow.png...](http://img]http://www.ningning.org/gallery/main.php/d/26-2/register-pageflow.png[/img){kind=link}