[Security & JAAS/JBoss] - Not able to authenticate against ActiveDirectory using LDAPL
by sreeni.gali
Hi Team,
We have tring hard to secure the webapplication using LDAPLogin module against Active Directory but we are not successfull . Please have a look into the following configuration files and suggest me the solution. Thanks Advance.
Step1: in "login-config.xml" the entry as below
-------------------------
<application-policy name="kwormSecurity">
<login-module code="org.jboss.security.auth.spi.LdapLoginModule" flag="required" >
<module-option name="java.naming.factory.initial">com.sun.jndi.ldap.LdapCtxFactory</module-option>
<module-option name="java.naming.provider.url">ldap://151.111.195.26:389/</module-option>
<module-option name="java.naming.security.authentication">simple</module-option>
<module-option name="java.naming.security.principal">ldapbrowse</module-option>
<module-option name="java.naming.security.credentials">ldapbrowse</module-option>
<module-option name="bindDN">@dot.state.mn.us</module-option>
<!--<module-option name="bindCredential">ldapbrowse</module-option> -->
<module-option name="baseCtxDN">DC=ad,DC=dot,DC=state,DC=mn,DC=us</module-option>
<module-option name="baseFilter">(&(sAMAccountName={0})(objectClass=user))</module-option>
<module-option name="roleFilter">(&(member={0})(objectClass=group))</module-option>
<module-option name="rolesCtxDN">DC=ad,DC=dot,DC=state,DC=mn,DC=us</module-option>
<module-option name="roleAttributeID">memberOf</module-option>
<module-option name="roleAttributeIsDN">true</module-option>
<module-option name="roleNameAttributeID">cn</module-option>
<module-option name="roleRecursion">-1</module-option>
<!-- <module-option name="searchScope">ONELEVEL_SCOPE</module-option> -->
</login-module>
</application-policy>
--------------------------
Step2: in "jboss.xml" file the entry as below
------------------
<jboss-web>
<context-root>ara</context-root>
<security-domain>java:/jaas/kwormSecurity</security-domain>
</jboss-web>
------------------
We are getting the following error. Please suggest me the solution .
error:
--------------
2006-08-08 16:08:04,390 DEBUG [org.jboss.security.auth.spi.LdapLoginModule] Failed to validate password
javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 525, v893 ]
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:2988)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2934)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2735)
at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2649)
at com.sun.jndi.ldap.LdapCtx.(LdapCtx.java:290)
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)
at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)
at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:662)
at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:243)
at javax.naming.InitialContext.init(InitialContext.java:219)
at javax.naming.ldap.InitialLdapContext.(InitialLdapContext.java:133)
at org.jboss.security.auth.spi.LdapLoginModule.createLdapInitContext(LdapLoginModule.java:258)
at org.jboss.security.auth.spi.LdapLoginModule.validatePassword(LdapLoginModule.java:208)
at org.jboss.security.auth.spi.UsernamePasswordLoginModule.login(UsernamePasswordLoginModule.java:163)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:324)
at javax.security.auth.login.LoginContext.invoke(LoginContext.java:675)
at javax.security.auth.login.LoginContext.access$000(LoginContext.java:129)
at javax.security.auth.login.LoginContext$4.run(LoginContext.java:610)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.login.LoginContext.invokeModule(LoginContext.java:607)
at javax.security.auth.login.LoginContext.login(LoginContext.java:534)
at org.jboss.security.plugins.JaasSecurityManager.defaultLogin(JaasSecurityManager.java:483)
at org.jboss.security.plugins.JaasSecurityManager.authenticate(JaasSecurityManager.java:425)
at org.jboss.security.plugins.JaasSecurityManager.isValid(JaasSecurityManager.java:251)
at org.jboss.web.tomcat.security.JBossSecurityMgrRealm.authenticate(JBossSecurityMgrRealm.java:230)
at org.apache.catalina.authenticator.FormAuthenticator.authenticate(FormAuthenticator.java:256)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:391)
at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:59)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:856)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.processConnection(Http11Protocol.java:744)
at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:527)
at org.apache.tomcat.util.net.MasterSlaveWorkerThread.run(MasterSlaveWorkerThread.java:112)
at java.lang.Thread.run(Thread.java:534)
2006-08-08 16:08:04,390 DEBUG [org.jboss.security.auth.spi.LdapLoginModule] Bad password for username=gali1sre
----------------
Thanks,
Sreeni Gali
sreeni.gali(a)gmail.com
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3963912#3963912
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3963912
19 years, 9 months
[JBoss Portal] - Re: Using WSRP with JBoss Portal 2.4
by chris.laprun＠jboss.com
anonymous wrote : What do you mean by "cannot configure WSRP instance"? Does it mean I cannot use a WSRP portlet?
Julien meant that we do not currently support the Portlet Management interface. What this means is that you cannot create an instance of the portlet and then configure it with specific properties for each of your users. An example would be a weather portlet. To be useful, the weather portlet requires a zip code (for example) so that it knows which location it needs to display the weather for. Using the 2.4 implementation (without support for Portlet Management), it is not possible to change the portlet property for a user so that each user can display a different weather location. It is however possible to configure *on the producer side* several instances of the portlet with different settings and then offer them via WSRP. Any operation requiring consumer-initiated cloning or property modification is not currently supported (but will be in 2.6).
anonymous wrote : When I tried to change the portlet provider in the management portlet (under portlet), I got the following error. Is it because the feature has not been implemented yet?
The portlet provider switching is fully supported and should work. Getting an exception is not normal. However, JSF creates very long exception stacks and the useful information is usually pretty far in the stack... Hence, could you provide the complete error, so that I can try to see what is going wrong?
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3963911#3963911
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3963911
19 years, 9 months
[Tomcat, HTTPD, Servlets & JSP] - IOException in HttpInvokerProxy
by ssanjeev
The code is from org.jboss.invocation.http.interfaces.Util.java
public static Object invoke(URL externalURL, Invocation mi)
| throws Exception
| {
| if( log.isTraceEnabled() )
| log.trace("invoke, externalURL="+externalURL);
| /* Post the MarshalledInvocation data. This is using the URL class
| for now but this should be improved to a cluster aware layer with
| full usage of HTTP 1.1 features, pooling, etc.
| */
| HttpURLConnection conn = (HttpURLConnection) externalURL.openConnection();
| configureHttpsHostVerifier(conn);
| conn.setDoInput(true);
| conn.setDoOutput(true);
| conn.setRequestProperty("ContentType", REQUEST_CONTENT_TYPE);
| conn.setRequestMethod("POST");
| OutputStream os = conn.getOutputStream();
| ObjectOutputStream oos = new ObjectOutputStream(os);
| try
| {
| oos.writeObject(mi);
| oos.flush();
| }
| catch (ObjectStreamException e)
| {
| // This generally represents a programming/deployment error,
| // not a communication problem
| throw new InvocationException(e);
| }
|
| // Get the response MarshalledValue object
| InputStream is = conn.getInputStream();
| ObjectInputStream ois = new ObjectInputStream(is);
| MarshalledValue mv = (MarshalledValue) ois.readObject();
| // A hack for jsse connection pooling (see patch ).
| ois.read();
| ois.close();
| oos.close();
|
| // If the encoded value is an exception throw it
| Object value = mv.get();
| if( value instanceof Exception )
| {
| throw (Exception) value;
| }
|
| return value;
| }
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3963909#3963909
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3963909
19 years, 9 months