[Security & JAAS/JBoss] - Webstart & SSO, a viable scheme?
by iori
Hi,
We are currently planning an authentication/authorization scheme on a system involving a Java Webstart application workstation doing mainly presentation and configuration, delegating the demanding memory & CPU intensive calculation tasks and the persisting of the configuration settings to stateless session beans running on a JBoss cluster.
JAAS approach with ClientLoginModule seems like the obvious choice on the Java application client side and checking the credentials from Ldap on the serer side, but there is one problem: Client login and role info would already be needed when parsing the JNLP file for the webstart application, because the workstation software is contructed from different set of pluggable modules based on user profiles.
To avoid double sing-on, we thought we had to do the login with a separate servlet against Ldap and pass the user credentials to the webstart application by giving them as properties in the gererated JNLP file. I did not like this, giving the user's plain text password in the JNLP file is out of the question.
So what I was thinking was that the login servlet would do the login against our existing external LDAP server (using the LdapLoginModule), generate a temporary password, store it in the user DB with other user session information and put this temporary password in the JNLP file as a property. Then the Webstart app would use the userid and this temporary password as user credentials with the ClientLoginModule when making EJB calls to the JBoss cluster. The EJBs would be configured in other security domain than the login servlet configured to do the authentication and authorization using DatabaseServerLoginModule against the user DB containing the userid and the temporary password (if login was successful and the session is still valid).
If the session gets invalidated, the Webstart app would still have to ask the user for the real password to make a new session using the login servlet and start using the new returned temporary password bound to the new session when communicating with the EJBs (thus two JAAS login contexts on the client side).
Now this is not exactly how things are done in the manual, so I would like to ask if anyone sees any obvious security holes or problems with this kind of scheme? An comments would be appreciated as I'm not exacly a network security wizard.
Ilkka
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3983900#3983900
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3983900
19Â years, 6Â months
[JBoss Messaging] - Jboss Messaging randomly implodes
by nbreau
We're running Jboss messaging as a standalone app with JBoss application server (latest release of both) with a load of anywhere around 100-300 messages per second. I was wondering if someone could tell me what the issue could be, I'm not getting any hints of the following stack trace. Once the error occurs I need to restart my application in order to be able to start publsihing to JBoss again. Once the error starts occuring this stack trace gets printed on every attempt to send a message.
I'm not seeing any errors in the jboss logs.
Stack trace:
Error publishing to topic : org.jboss.jms.util.MessagingJMSException: Caught exception
org.jboss.jms.util.MessagingJMSException: Caught exception
at org.jboss.jms.client.container.ExceptionInterceptor.invoke(ExceptionInterceptor.java:99)
at org.jboss.jms.client.delegate.ClientSessionDelegate$send_N3028277934545793941.invokeNext(ClientSessionDelegate$send_N3028277934545793941.java)
at org.jboss.jms.client.container.ClientLogInterceptor.invoke(ClientLogInterceptor.java:107)
at org.jboss.jms.client.delegate.ClientSessionDelegate$send_N3028277934545793941.invokeNext(ClientSessionDelegate$send_N3028277934545793941.java)
at org.jboss.jms.client.delegate.ClientSessionDelegate.send(ClientSessionDelegate.java)
at org.jboss.jms.client.container.ProducerAspect.handleSend(ProducerAspect.java:253)
at sun.reflect.GeneratedMethodAccessor130.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at org.jboss.aop.advice.PerInstanceAdvice.invoke(PerInstanceAdvice.java:130)
at org.jboss.jms.client.delegate.ClientProducerDelegate$send_3961598017717988886.invokeNext(ClientProducerDelegate$send_3961598017717988886.java)
at org.jboss.jms.client.container.ClosedInterceptor.invoke(ClosedInterceptor.java:182)
at org.jboss.aop.advice.PerInstanceInterceptor.invoke(PerInstanceInterceptor.java:117)
at org.jboss.jms.client.delegate.ClientProducerDelegate$send_3961598017717988886.invokeNext(ClientProducerDelegate$send_3961598017717988886.java)
at org.jboss.jms.client.container.ExceptionInterceptor.invoke(ExceptionInterceptor.java:69)
at org.jboss.jms.client.delegate.ClientProducerDelegate$send_3961598017717988886.invokeNext(ClientProducerDelegate$send_3961598017717988886.java)
at org.jboss.jms.client.container.ClientLogInterceptor.invoke(ClientLogInterceptor.java:107)
at org.jboss.jms.client.delegate.ClientProducerDelegate$send_3961598017717988886.invokeNext(ClientProducerDelegate$send_3961598017717988886.java)
at org.jboss.jms.client.delegate.ClientProducerDelegate.send(ClientProducerDelegate.java)
at org.jboss.jms.client.JBossMessageProducer.send(JBossMessageProducer.java:172)
at org.jboss.jms.client.JBossMessageProducer.send(JBossMessageProducer.java:220)
at org.jboss.jms.client.JBossMessageProducer.send(JBossMessageProducer.java:147)
at org.jboss.jms.client.JBossMessageProducer.send(JBossMessageProducer.java:138)
at com.mycom.sphere.postcrawler.services.mq.LinkDiscoveryMQProducer.publish(LinkDiscoveryMQProducer.java:50)
at
...
any help would be appreciated.
Nick.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3983899#3983899
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3983899
19Â years, 6Â months