[Security & JAAS/JBoss] - No LoginModules configured for jmx-console
by ajbenson
I tried to secure the web-console as described in the Wiki (http://wiki.jboss.org/wiki/Wiki.jsp?page=SecureTheJmxConsole) by uncommenting the security relevant elements in web.xml and jboss-web.xml.
I am getting the following error in server.log:
| 2007-02-08 13:31:55,011 DEBUG [http-0.0.0.0-8443-Processor4] [org.jboss.security.plugins.JaasSecurityManager.jmx-console] Login failure
| javax.security.auth.login.LoginException: No LoginModules configured for jmx-console
| at javax.security.auth.login.LoginContext.init(LoginContext.java:189)
| at javax.security.auth.login.LoginContext.<init>(LoginContext.java:350)
| at javax.security.auth.login.LoginContext.<init>(LoginContext.java:465)
| at org.jboss.security.plugins.SubjectActions$LoginContextAction.run(SubjectActions.java:91)
| at java.security.AccessController.doPrivileged(Native Method)
| at org.jboss.security.plugins.SubjectActions.createLoginContext(SubjectActions.java:129)
| at org.jboss.security.plugins.JaasSecurityManager.defaultLogin(JaasSecurityManager.java:475) at org.jboss.security.plugins.JaasSecurityManager.authenticate(JaasSecurityManager.java:430) at org.jboss.security.plugins.JaasSecurityManager.isValid(JaasSecurityManager.java:246)
| at org.jboss.security.plugins.JaasSecurityManager.isValid(JaasSecurityManager.java:221)
| at org.jboss.web.tomcat.security.JBossSecurityMgrRealm.authenticate(JBossSecurityMgrRealm.java:337)
| at org.apache.catalina.authenticator.BasicAuthenticator.authenticate(BasicAuthenticator.java:129)
| at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:504)
| at org.apache.catalina.core.StandardValveContext.invokeNext(StandardValveContext.java:102)
| at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:520)
| at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:137)
| at org.apache.catalina.core.StandardValveContext.invokeNext(StandardValveContext.java:104)
| at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:117)
| at org.apache.catalina.core.StandardValveContext.invokeNext(StandardValveContext.java:102)
| at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:535)
| at org.apache.catalina.core.StandardValveContext.invokeNext(StandardValveContext.java:102)
| at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:520)
| at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
| at org.apache.catalina.core.StandardValveContext.invokeNext(StandardValveContext.java:104)
| at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:520)
| at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:929)
| at org.apache.coyote.tomcat5.CoyoteAdapter.service(CoyoteAdapter.java:160)
| at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:799)
| at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.processConnection(Http11Protocol.java:705)
| at org.apache.tomcat.util.net.TcpWorkerThread.runIt(PoolTcpEndpoint.java:577)
| at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:683)
| at java.lang.Thread.run(Thread.java:534)
|
Here is the relevant section of my web.xml:
| <security-constraint>
| <web-resource-collection>
| <web-resource-name>HtmlAdaptor</web-resource-name>
| <description>An example security config that only allows users with the
| role JBossAdmin to access the HTML JMX console web application
| </description>
| <url-pattern>/*</url-pattern>
| <http-method>GET</http-method>
| <http-method>POST</http-method>
| </web-resource-collection>
| <auth-constraint>
| <role-name>JBossAdmin</role-name>
| </auth-constraint>
| </security-constraint>
|
| <login-config>
| <auth-method>BASIC</auth-method>
| <realm-name>JBoss JMX Console</realm-name>
| </login-config>
|
| <security-role>
| <role-name>JBossAdmin</role-name>
| </security-role>
|
In jboss-web.xml:
| <security-domain>java:/jaas/jmx-console</security-domain>
|
In login-config.xml:
| <application-policy name = "jmx-console">
| <authentication>
| <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
| flag = "required" />
| <module-option name="usersProperties">users.properties</module-option>
| <module-option name="rolesProperties">roles.properties</module-option>
| </login-module>
| </authentication>
| </application-policy>
|
I am running JBoss 3.2.5 on Solaris 9.
Thanks for any help anyone can provide.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4013246#4013246
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4013246
19Â years, 2Â months
[Security & JAAS/JBoss] - Re: Repeated calls to LoginModule for EJB authentication
by brownjamese
Interesting and odd log entries - especially since I don't know what a good "run" should look like. I followed the security FAQ and added the necessary log4j config entries. After trundling through the info, I still see:
* multiple access to the login module's login() method; and
* inserts into the cache with different subject reference Id
For example, I see the actual login:
| 2007-02-08 14:58:03,121 TRACE [org.jboss.security.plugins.JaasSecurityManager.acol-core-policy] Begin isValid, principal:U174791, cache info: null
| 2007-02-08 14:58:03,322 TRACE [org.jboss.security.plugins.JaasSecurityManager.acol-core-policy] End isValid, true
| 2007-02-08 14:58:03,322 TRACE [org.jboss.web.tomcat.security.JBossSecurityMgrRealm] User: U174791 is authenticated
| 2007-02-08 14:58:03,332 TRACE [org.jboss.security.SecurityAssociation] pushSubjectContext, subject=Subject:
| Principal: Roles(members:xxx,yyy,zzz)
| Principal: U174791
| , sc=org.jboss.security.SecurityAssociation$SubjectContext@7c7d85{principal=U174791,subject=18143033}
|
Then access to the next URL, where the "hit" on the web app checks (and finds) the subject in cache:
2007-02-08 14:59:09,777 DEBUG [org.apache.catalina.core.ContainerBase.[jboss.web].[localhost]] Checking for SSO cookie
| 2007-02-08 14:59:09,777 DEBUG [org.apache.catalina.core.ContainerBase.[jboss.web].[localhost]] Checking for cached principal for D5612028A309EA8A4A5889D393B6251A
| 2007-02-08 14:59:09,777 DEBUG [org.apache.catalina.core.ContainerBase.[jboss.web].[localhost]] Found cached principal 'U174791' with auth type 'FORM'
|
But then access from web-app to EJB to EJB in another ear (all with same jaas policy configured) produces:
| 2007-02-08 14:59:09,907 TRACE [org.jboss.security.SecurityAssociation] getPrincipal, principal=U174791
| 2007-02-08 14:59:09,907 TRACE [org.jboss.security.SecurityAssociation] pushSubjectContext, subject=null, sc=org.jboss.security.SecurityAssociation$SubjectContext@7aed3a{principal=U174791,subject=null}
| 2007-02-08 14:59:09,928 TRACE [org.jboss.security.SecurityAssociation] pushRunAsIdentity, runAs=null
| 2007-02-08 14:59:09,958 TRACE [org.jboss.security.SecurityAssociation] getPrincipal, principal=U174791
| 2007-02-08 14:59:09,958 TRACE [org.jboss.security.plugins.JaasSecurityManager$DomainInfo] destroy, subject=Subject:
| Principal: Roles(members:xxx,yyy,zzz)
| Principal: U174791
| , this=org.jboss.security.plugins.JaasSecurityManager$DomainInfo@b05409[Subject(23167560).principals=org.jboss.security.SimpleGroup@28014118(Roles(members:xxx,yyy,zzz))org.jboss.security.SimplePrincipal@22316052(U174791),credential.class=java.lang.String@23438274,expirationTime=1170961028413], activeUsers=0
| 2007-02-08 14:59:09,958 TRACE [org.jboss.security.plugins.JaasSecurityManager$DomainInfo] logout, subject=Subject:
| Principal: Roles(members:xxx,yyy,zzz)
| Principal: U174791
| , this=org.jboss.security.plugins.JaasSecurityManager$DomainInfo@b05409[Subject(23167560).principals=org.jboss.security.SimpleGroup@28014118(Roles(members:xxx,yyy,zzz))org.jboss.security.SimplePrincipal@22316052(U174791),credential.class=java.lang.String@23438274,expirationTime=1170961028413]
| 2007-02-08 14:59:09,968 TRACE [org.jboss.security.plugins.JaasSecurityManager.acol-core-policy] Begin isValid, principal:U174791, cache info: null
| 2007-02-08 14:59:09,968 TRACE [org.jboss.security.plugins.JaasSecurityManager.acol-core-policy] defaultLogin, principal=U174791
| 2007-02-08 14:59:09,968 TRACE [org.jboss.security.auth.login.XMLLoginConfigImpl] Begin getAppConfigurationEntry(acol-core-policy), size=10
| 2007-02-08 14:59:09,968 TRACE [org.jboss.security.auth.login.XMLLoginConfigImpl] End getAppConfigurationEntry(acol-core-policy), authInfo=AppConfigurationEntry[]:
| [0]
| LoginModule Class: ca.acol.core.security.login.JBossLoginModule
| ControlFlag: LoginModuleControlFlag: sufficient
| Options:name=auth_ds, value=auth
|
| 2007-02-08 14:59:10,048 TRACE [org.jboss.security.plugins.JaasSecurityManager.acol-core-policy] defaultLogin, lc=javax.security.auth.login.LoginContext@1be9101, subject=Subject(2223107).principals=org.jboss.security.SimpleGroup@28014118(Roles(members:xxx,yyy,zzz))org.jboss.security.SimplePrincipal@22316052(U174791)
| 2007-02-08 14:59:10,048 TRACE [org.jboss.security.plugins.JaasSecurityManager.acol-core-policy] updateCache, inputSubject=Subject(2223107).principals=org.jboss.security.SimpleGroup@28014118(Roles(members:xxx,yyy,zzz))org.jboss.security.SimplePrincipal@22316052(U174791)
| 2007-02-08 14:59:10,048 TRACE [org.jboss.security.plugins.JaasSecurityManager.acol-core-policy] Inserted cache info: org.jboss.security.plugins.JaasSecurityManager$DomainInfo@31ac05[Subject(17676813).principals=org.jboss.security.SimpleGroup@28014118(Roles(members:xxx,yyy,zzz))org.jboss.security.SimplePrincipal@22316052(U174791),credential.class=java.lang.String@23438274,expirationTime=1170961148415]
| 2007-02-08 14:59:10,048 TRACE [org.jboss.security.plugins.JaasSecurityManager.acol-core-policy] End isValid, true
| 2007-02-08 14:59:10,048 TRACE [org.jboss.security.SecurityAssociation] pushSubjectContext, subject=Subject:
| Principal: Roles(members:xxx,yyy,zzz)
| Principal: U174791
| , sc=org.jboss.security.SecurityAssociation$SubjectContext@11492ed{principal=U174791,subject=28983194}
| 2007-02-08 14:59:10,048 TRACE [org.jboss.security.SecurityAssociation] pushRunAsIdentity, runAs=null
|
|
Just to clarify wars/jars/ears involved:
.ear
- .war - struts-based web application
- .jar - contains application-specific EJBs
payment.ear
- payment.jar - real-time payment interface
.war invokes .jar to perform custom workflow, including payment. Thus .jar calls EJBs in .jar.
Various incantations of security-domain have been used all with the same application policy. Log snippets above are from with .war and payment.jar with the security-domain set to acol-core-policy. I have tried adding the same security policy to .jar, but that just increases the number of re-authentication calls.
-- James
-
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4013244#4013244
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4013244
19Â years, 2Â months
[JBossCache] - 1.4.1.SP1 Installation Instructions
by eonnen
In looking through the distribution, the User's Guide, the FAQ and various other locations, I'm unable to find explicit instructions on how to install this build. I'd like to install to a 4.0.5 AS instance but there is no mention of how best to do this. For example:
Should I pacakge a cache sar and deploy that?
Should I just copy all the /lib to server/lib?
I'm further confused as this distribution seems to include a new jgroups.jar and new bsh jar as well as some other new dependencies.
Should the old jgroups.jar be overwritten?
Should the old bsh-1.3.0.jar be removed and the new bsh-2.0b4.jar be installed? Or should they coexist?
Is Tomcat clustering supported on this release?
If I've missed something, please let me know.
I hate to say it but this push seems rushed. I can find no install instructions, no compatibility notes and the readme contains an invalid forum link. All around, I'm hesitating to upgrade given the lack of attention this push seems to have received.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4013242#4013242
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4013242
19Â years, 2Â months
[JBoss and NetBeans] - Re: NameNotFoundException: DefaultDS not bound - Entity Unit
by htran_888
Hi L,
Thanks for your suggestion and I will try to modify these EJB 2.1 syntax for my EJB 3.0 issue. However, I have the following questions:
( i ) The code used was the same one that I have successfully compiled using the build.xml supplied as part of the EJB 3.0 Workbook (Bill Burke) on the command prompt. This means that it should not need further tampering/customisation to make it work. The only difference in this case is that I have used Netbeans to create this EJB that appears to have difficulty deploying properly. Received the following message when deploying the titan EJB using Netbeans to JBoss:
06:16:28,187 INFO [TomcatDeployer] deploy, ctxPath=/jmx-console, warUrl=.../deploy/jmx-console.war/
06:16:29,250 ERROR [URLDeploymentScanner] Incomplete Deployment listing:
--- Incompletely deployed packages ---
org.jboss.deployment.DeploymentInfo@62fe5342 { url=file:/C:/jboss-4.0.4.GA/server/default/deploy/titan.jar }
deployer: MBeanProxyExt[jboss.ejb3:service=EJB3Deployer]
status: Deployment FAILED reason: Trying to install an already registered mbean: jboss.system:service=ThreadPool
state: FAILED
watch: file:/C:/jboss-4.0.4.GA/server/default/deploy/titan.jar
altDD: null
lastDeployed: 1170962187656
lastModified: 1170962187312
mbeans:
No Cabin table has been created either.
( ii ) Could anyone assist me in translating those EJB 2.1 statements to EJB 3.0 since I am very new to EJB 3.0 and does not have a clue how EJB 2.1 work.
I will read up some Netbeans user guide/cheat sheet to ensure that the titan EJB is created properly, even though it is a very straight forward step.
Lastly, is it possible that I could not have both Glassfish (ASJS 9.0) & JBoss AS 4.0.4 co-existing on the same Windows XP platform?
I do appreciate very much for you helping me out on this issue.
Thanks,
Henry
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4013237#4013237
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4013237
19Â years, 2Â months