[Security & JAAS/JBoss] - java.lang.SecurityException: Insufficient method permissions
by craig1980
Hi all.
I have a problem in invoking a statefull session bean in JBoss AS.
When i call this Ejb i have this error:
anonymous wrote : java.lang.SecurityException: Insufficient method permissions, principal=tiziana1, ejbName=WorkflowEngine, method=create, interface=HOME, requiredRoles=[WfMOpenAdmin], principalRoles=[WfMOpenAdmin, WfMOpenAdmin]
As you can see the expected role is WfMOpenAdmin and the principal used for invokign this EJB has these roles: WfMOpenAdmin, WfMOpenAdmin
For loggin into JBoss i have written this login module:
| package it.eng.smclient.accessmanager.authentication.jaas.module.jboss;
|
| import it.eng.smclient.accessmanager.authentication.jaas.principals.Login;
| import it.eng.smclient.accessmanager.authentication.jaas.principals.WfmOpen;
| import it.eng.smclient.accessmanager.configuration.Configuration;
| import it.eng.smclient.accessmanager.configuration.securityaccessfilter.EjbRole;
| import it.eng.smclient.accessmanager.configuration.utils.SingletonConfiguration;
| import it.eng.smclient.accessmanager.iface.SecManagerAuthorizationIface;
| import it.eng.smclient.accessmanager.util.resource.Message;
| import it.eng.smclient.accessmanager.util.resource.constants.Rbaccessmanager;
|
| import java.security.Principal;
| import java.security.acl.Group;
| import java.util.ArrayList;
| import java.util.Enumeration;
| import java.util.Iterator;
| import java.util.List;
| import java.util.Map;
| import java.util.Set;
|
| import javax.security.auth.Subject;
| import javax.security.auth.callback.CallbackHandler;
| import javax.security.auth.login.FailedLoginException;
| import javax.security.auth.login.LoginException;
| //import javax.security.auth.spi.LoginModule;
|
| import org.apache.commons.logging.Log;
| import org.apache.commons.logging.LogFactory;
| import org.jboss.security.NestableGroup;
| import org.jboss.security.SecurityAssociation;
| import org.jboss.security.SimpleGroup;
| //import org.jboss.security.SimplePrincipal;
| import org.jboss.security.auth.spi.AbstractServerLoginModule;
|
| public class SecurityManagerLoginModule extends AbstractServerLoginModule{
|
|
| static public final Log logger =
| LogFactory.getLog(SecurityManagerLoginModule.class);
|
| private Rbaccessmanager rb = new Rbaccessmanager();
| private Message message = new Message(rb);
| String username = null;
| protected Subject subject;
| protected CallbackHandler callbackHandler;
| protected Map sharedState;
| protected Map options;
| protected boolean loginOk;
| protected Principal unauthenticatedIdentity;
| protected Configuration conf = null;
| protected String ejbRole = null;
| public void initialize(Subject subject,
| CallbackHandler callbackHandler,
| Map sharedState,
| Map options) {
| logger.debug("[Method - initialize] [INIT]");
| if (logger.isTraceEnabled())
| logger.debug("[Method - initialize] [instance=@] "
| + System.identityHashCode(this));
| this.subject = subject;
| this.callbackHandler = callbackHandler;
| this.sharedState = sharedState;
| this.options = options;
| logger.debug("[Method - initialize] [Security domain:] "
| + (String) options.get("jboss.security.security_domain"));
| String name = (String) options.get("unauthenticatedIdentity");
| ejbRole = (String) options.get("ejbRole");
| if (name != null) {
| try {
| unauthenticatedIdentity = createIdentity(name);
| logger.info("Aggiungo il principal: " + unauthenticatedIdentity+ " al subject: "+ subject);
| subject.getPrincipals().add(unauthenticatedIdentity);
| subject.getPrincipals().add(getIdentity());
| Set principals = subject.getPrincipals();
| Group roleSets[] = getRoleSets();
| for (int g = 0; g < roleSets.length; g++) {
| Group group = roleSets[g];
| String aName = group.getName();
| Group subjectGroup = createGroup(aName, principals);
| if (subjectGroup instanceof NestableGroup) {
| SimpleGroup tmp = new SimpleGroup("Roles");
| subjectGroup.addMember(tmp);
| subjectGroup = tmp;
| } // if (subjectGroup instanceof NestableGroup)
| Principal role;
| for (Enumeration members = group.members(); members
| .hasMoreElements(); subjectGroup.addMember(role))
| role = (Principal) members.nextElement();
| }
| SecurityAssociation.setPrincipal(unauthenticatedIdentity);
| //SecurityAssociation.setCredential(credential);
| SecurityAssociation.setSubject(subject);
| logger.info("Aggiunto il principal a subject che ora è: " + subject);
| logger.debug("[Method - initialize] [navigazione anonima] " + name);
| } catch (Exception e) {
| logger.error("[Method - initialize] " +
| "[Inizializzazione modulo di login non riuscita - " +
| " Verificare la configurazione dei moduli]");
| logger.error("[Method - initialize] [Exception]",e);
| logger.error("[Method - initialize] [message]" + e.getMessage());
| }
| } // if (name != null)
| logger.debug("[Method - initialize] [END]");
| } // public void initialize(Subject subject, CallbackHandler
| // callbackHandler, Map sharedState, Map options)
| public boolean login() throws LoginException {
| logger.debug("[Method - login] [LoginModule]");
| /*
| JAASConfigFile jaas = new JAASConfigFile();
| jaas.displayProperties();
| */
| boolean result = false;
| loginOk = false;
| try {
| if (subject != null) {
| Iterator iter = subject.getPrivateCredentials().iterator();
| while (iter.hasNext()) {
| Object obj = iter.next();
| if (obj instanceof Login) {
| username = ((Login) obj).getName();
| logger.debug("[Method - login]" +
| "[Username not null] " + username);
| System.setProperty("javax.security.auth.login.name",username);
| } // if (obj instanceof Login)
| } // while ( iter.hasNext())
| } // if (subject != null)
|
| // Se username = [null] vuol dire che ho effettuato autenticazione
| // e sto richiamando il modulo all'interno dell'applicazione
| if (username == null) {
| logger.debug("[Method - login] " +
| "[Username = null] [Leggo le propietà di Sistema]");
| username = System.getProperty("javax.security.auth.login.name");
| logger.debug("[Method - login] " +
| "[javax.security.auth.login.name] " + username);
| } else {
| sharedState.put("javax.security.auth.login.name",username);
| Object credential = System.getProperty("javax.security.auth.login.name");
| List rolesPM = ((SecManagerAuthorizationIface) Configuration
| .getAccessManagerImplementation()).getRoles();
| logger.debug("[Method - login] [Lista Ruoli PM] " + rolesPM);
| WfmOpen wfmPrincipal = new WfmOpen(username);
|
| SingletonConfiguration singletonConfig =
| SingletonConfiguration.getInstance(null,null);
|
| Configuration conf =
| singletonConfig.getConfiguration();
|
| wfmPrincipal.setApplication(conf.getApplication()
| .getApplicationCode());
|
| ArrayList roles = new ArrayList();
| String role = ((EjbRole) conf.getEjbSecurityIdentity()
| .getEjbRoles().iterator().next()).getRole();
| roles.add(role);
|
| ArrayList groups = new ArrayList();
| groups.add("Some Group");
| groups.add("Order Processing");
|
| wfmPrincipal.setRoles(roles);
| wfmPrincipal.setGroups(groups);
|
| SecurityAssociation.setPrincipal(wfmPrincipal);
| SecurityAssociation.setCredential(credential);
| SecurityAssociation.setSubject(subject);
|
| } // if (username != null)
|
| loginOk = true;
| result = true;
| logger.debug("[Method - login] [END]");
| } catch (Exception e) {
| logger.error("[Method - login] ", e);
| throw new FailedLoginException(message
| .getMessage(rb.MODULE_LOGIN_ERROR));
| // throw new LoginException( e.getMessage() );
| }
| return result;
| } // public boolean login() throws LoginException
|
| protected Principal createIdentity(String name) throws Exception {
| logger.trace("[Method - login] [INIT]");
| Principal principal = null;
| logger.trace("[Method - login] [name] " + name);
| principal = new WfmOpen(name);
| return principal;
| } // protected Principal createIdentity(String name) throws Exception
| public boolean commit() throws LoginException {
| logger.trace("[Method - commit] [INIT]");
| logger.trace("[Method - commit] [subject] " + subject);
| if (!loginOk) return false;
| Set principals = subject.getPrincipals();
| Principal identity = getIdentity();
| logger.trace("[Method - commit] [identity] " + identity.getName());
|
| principals.add(identity);
| Group roleSets[] = getRoleSets();
|
| for (int g = 0; g < roleSets.length; g++) {
| Group group = roleSets[g];
| String name = group.getName();
| Group subjectGroup = createGroup(name, principals);
| if (subjectGroup instanceof NestableGroup) {
| SimpleGroup tmp = new SimpleGroup("Roles");
| subjectGroup.addMember(tmp);
| subjectGroup = tmp;
| } // if (subjectGroup instanceof NestableGroup)
| Principal role;
| for (Enumeration members = group.members(); members
| .hasMoreElements(); subjectGroup.addMember(role))
| role = (Principal) members.nextElement();
| } // for(int g = 0; g < roleSets.length; g++)
| return true;
| } // public boolean commit() throws LoginException
| public boolean abort() throws LoginException {
| logger.trace("[Method - abort() ] [INIT]");
| return true;
| } // public boolean abort() throws LoginException
|
| public boolean logout() throws LoginException {
| logger.trace("[Method - logout() ] [INIT]");
| Principal identity = getIdentity();
| Set principals = subject.getPrincipals();
| principals.remove(identity);
| return true;
| } // public boolean logout() throws LoginException
| protected Principal getIdentity() {
| logger.info("[Method - getIdentity() ] [INIT]");
| logger.trace("[Method - getIdentity() ] [username] " + username);
| Principal p = null;
| if (username != null) {
|
| logger.info("La username era diversa da null... "+ username);
| p = new WfmOpen(username);
| } else {
| // Ruolo reucperato dalla configurazione XML
| if (conf != null) {
| logger.info("Conf non era null.....");
| String role = ((EjbRole) conf.getEjbSecurityIdentity()
| .getEjbRoles().iterator().next()).getRole();
| p = new WfmOpen(role);
| } else {
|
| logger.info("Conf era null.....");
| p = new WfmOpen(ejbRole);
| }
| } // if (username != null)
| return p;
| } // private Principal getIdentity()
|
| protected Group[] getRoleSets() throws LoginException {
| logger.trace("[Method - getRoleSets() ] [INIT]");
|
| SimpleGroup rolesGroup = new SimpleGroup("Roles");
| ArrayList groups = new ArrayList();
|
| // Ruolo reucperato dalla configurazione XML
| Principal p = null;
| if (conf != null) {
| String role = ((EjbRole) conf.getEjbSecurityIdentity()
| .getEjbRoles().iterator().next()).getRole();
| logger.trace("[Method - getRoleSets() ] [Ruolo di sistema recuperato]");
| p = new WfmOpen(role);
| } else {
| p = new WfmOpen(ejbRole);
| }
| rolesGroup.addMember(p);
| groups.add(rolesGroup);
|
| Group roleSets[] = new Group[groups.size()];
| groups.toArray(roleSets);
|
| logger.trace("[Method - getRoleSets() ] [END]");
|
| return roleSets;
|
| } // private Group[] getRoleSets() throws LoginException
| protected Principal getUnauthenticatedIdentity() {
| return unauthenticatedIdentity;
| }
|
| protected Group createGroup(String name, Set principals) {
| logger.trace("[Method - createGroup ] [INIT]");
| Group roles = null;
| Iterator iter = principals.iterator();
| do {
| if (!iter.hasNext())
| break;
| Object next = iter.next();
| if (!(next instanceof Group))
| continue;
| Group grp = (Group) next;
| if (!grp.getName().equals(name))
| continue;
| roles = grp;
| break;
| } while (true);
| if (roles == null) {
| roles = new SimpleGroup(name);
| principals.add(roles);
| } // if (roles == null)
| logger.trace("[Method - createGroup ] [END]");
| return roles;
| } // protected Group createGroup(String name, Set principals)
|
| }
|
I know that when there is an unauthenticatedIdentity a cabled principal is created but i was trying to understand what error was created....
In my login-config.xml I have this configuration:
anonymous wrote :
| <application-policy name = "wfdemopluto">
|
| <login-module code = "org.jboss.security.auth.spi.ProxyLoginModule" flag = "sufficient">
| <module-option name = "moduleName">it.eng.smclient.accessmanager.authentication.jaas.module.jboss.SecurityManagerLoginModule</module-option>
|
| <module-option name="unauthenticatedIdentity">nobody</module-option>
| <module-option name="debug">true</module-option>
| <!--module-option name="password-stacking">useFirstPass</module-option-->
| <module-option name="ejbRole">WfMOpenAdmin</module-option>
| </login-module>
|
| </application-policy>
|
Can anybody help me?
Thnks to all,
Angelo
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4026655#4026655
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4026655
19Â years, 1Â month
[JBoss Seam] - Re: Use of Seam Security/drools to selectively load a list?
by JohnEChesher
Thanks Shane. As it turns out, I found a simpler way to implement this, by just passing the role name to the permission check in the "name" (1st) argument of hasPermission(). However, your response did help me to understand how to use the third argument, which is pretty cool and something I will no doubt be using later.
In case it helps anyone else trying to implement something simliar, here is my revised code to load the SelectItems to be used in the view:
The session bean method to determine which items should be in the list:
public ArrayList<SelectItem> getRoleList() {
|
| ArrayList<SelectItem> roleNames = new ArrayList<SelectItem>();
|
| ArrayList<Role> roles = (ArrayList<Role>) entityManager.createQuery("from Role")
| .getResultList();
|
| for (Role r : roles) {
| if ( ! r.getDisabled()) {
| if (identity.hasPermission(r.getRole(), "create")) {
| roleNames.add(new SelectItem(r.getRole()));
| }
| }
| }
| return roleNames;
| }
The drools rules that apply:
rule CanAddCompanyAdmin
| when
| c: PermissionCheck(name == "Company Admin", action == "create")
| Role(name == "Super Admin")
| then
| c.grant();
| end;
|
|
| rule CanAddClientAdmin
| when
| c: PermissionCheck(name == "Client Admin", action == "create")
| Role(name == "Company Admin")
| then
| c.grant();
| end;
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4026652#4026652
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4026652
19Â years, 1Â month
[JBoss Messaging] - Resource GC problem
by kurt.stamï¼ jboss.com
Hi guys,
I'm posting this to keep track of the issue that when you write connection open/close intensive code, it seems that the GC cannot free up all the resources that is was using. This will be not be an issue if you use pooling of the connections, but if you don't and simple do:
lookup factory, lookup queue, connect to queue, open session, send message, receive message, close connection.
and you make this loop then you will run out of memory at some point. Both JBM and JBMQ seem to have this problem. From what Kevin could see it may have to do with the way JBoss Remoting is used. Note that we did not look at code; just at what the profiler is telling us.
Thanks,
--Kurt
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4026650#4026650
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4026650
19Â years, 1Â month
[JBoss Messaging] - Getting java.sql.SQLException: ORA-01460: unimplemented or u
by rpkavuri
Hi
I have configured JBoss4.0.5 n 2 physical machines to test cluster enabled JMS. I am using HA-JNDI/HA-JMS to run application. Also, I have configured to use oracle as backend database.
Here are the configs I have used -
jbossmq-destinations-service.xml
<depends optional-attribute-name="DestinationManager">jboss.mq:service=DestinationManager
<depends optional-attribute-name="SecurityManager">jboss.mq:service=SecurityManager
jbossmq-service.xml - default configuration
login-config.xml - Modified to add Oracle references
Once I modified the files, I have started the server on both the one machines. My serverPublishTopic has created. Also, I have verified the databse and found the rquired tables have created.
We have Java Swing based GUI application which is having one server and multiple clients. When I am trying to login my application try to establish the JMS connection from the server as well as from the client. I have verified the logs and found that the connection is esatblsihed properly. In my case server publsihes the messages and clinets alwasys the subscribes the messages. We are using Persistent publsiher and Durable subscriber.
But when server is trying to publish the messages I am getting the following exception. It seems Jboss is unable to store the messages in Oracle database.
om.indigo.base.BasketException: Could not store message: 4813 msg=1070 hard NOT_STORED PERSISTENT queue=TOPIC.serverPublishTopic.DurableSubscription[clientId=guest name=guest selector=(originator <> 'guest' AND filter = 'N') OR guest = 'Y'] priority=4 lateClone=false hashCode=2769003; - nested throwable: (java.sql.SQLException: ORA-01460: unimplemented or unreasonable conversion requested
)
at com.indigo.utils.BasketLoader.save(BasketLoader.java:828)
at com.indigo.utils.BasketLoader.createBasket(BasketLoader.java:1159)
at com.indigo.base.Basket.createIndexBasket(Basket.java:1926)
at toplevel.HunterTest5.createIndexBasket(HunterTest5.java:83)
at toplevel.HunterTest5.init(HunterTest5.java:37)
at com.indigo.neuron.client.AbstractAlgorithm.run(AbstractAlgorithm.java:2294)
at java.lang.Thread.run(Unknown Source)
Caused by: org.jboss.mq.SpyJMSException: Could not store message: 4813 msg=1070 hard NOT_STORED PERSISTENT queue=TOPIC.serverPublishTopic.DurableSubscription[clientId=guest name=guest selector=(originator <> 'guest' AND filter = 'N') OR guest = 'Y'] priority=4 lateClone=false hashCode=2769003; - nested throwable: (java.sql.SQLException: ORA-01460: unimplemented or unreasonable conversion requested
)
at com.indigo.utils.jms.JMSSource.publish(JMSSource.java:475)
at com.indigo.basketserver.ServerSideJMSRMIDriver.invokePublish(ServerSideJMSRMIDriver.java:435)
at com.indigo.basketserver.ServerSideJMSRMIDriver.access$1(ServerSideJMSRMIDriver.java:415)
at com.indigo.basketserver.ServerSideJMSRMIDriver$ModelNone.invokeMethodForAll(ServerSideJMSRMIDriver.java:965)
at com.indigo.basketserver.ServerSideJMSRMIDriver.invokeMethodForAll(ServerSideJMSRMIDriver.java:453)
at com.indigo.basketserver.ServerSideJMSRMIDriver.invokeMethodForAll(ServerSideJMSRMIDriver.java:402)
at com.indigo.basketserver.ServerSideJMSRMIDriver.processBasket(ServerSideJMSRMIDriver.java:485)
at com.indigo.basketserver.ServerSideProcessor.sendBasket(ServerSideProcessor.java:237)
at com.indigo.basketserver.RemoteServerImpl.sendBasket(RemoteServerImpl.java:224)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at sun.rmi.server.UnicastServerRef.dispatch(UnicastServerRef.java:294)
at sun.rmi.transport.Transport$1.run(Transport.java:153)
at java.security.AccessController.doPrivileged(Native Method)
at sun.rmi.transport.Transport.serviceCall(Transport.java:149)
at sun.rmi.transport.tcp.TCPTransport.handleMessages(TCPTransport.java:466)
at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run(TCPTransport.java:707)
at java.lang.Thread.run(Thread.java:595)
at sun.rmi.transport.StreamRemoteCall.exceptionReceivedFromServer(Unknown Source)
at sun.rmi.transport.StreamRemoteCall.executeCall(Unknown Source)
at sun.rmi.server.UnicastRef.invoke(Unknown Source)
at com.indigo.basketserver.RemoteServerImpl_Stub.sendBasket(Unknown Source)
at com.indigo.basketserver.ClientSideRMIJMSDriver$4.execute(ClientSideRMIJMSDriver.java:497)
at com.indigo.basketserver.ClientSideRMIJMSDriver.makeRequest(ClientSideRMIJMSDriver.java:464)
at com.indigo.basketserver.ClientSideRMIJMSDriver.sendBasket(ClientSideRMIJMSDriver.java:495)
at com.indigo.utils.BasketLoader.save(BasketLoader.java:826)
... 6 more
Caused by: java.sql.SQLException: ORA-01460: unimplemented or unreasonable conversion requested
at oracle.jdbc.dbaccess.DBError.throwSqlException(DBError.java:134)
at oracle.jdbc.ttc7.TTIoer.processError(TTIoer.java:289)
at oracle.jdbc.ttc7.Oall7.receive(Oall7.java:579)
at oracle.jdbc.ttc7.TTC7Protocol.doOall7(TTC7Protocol.java:1894)
at oracle.jdbc.ttc7.TTC7Protocol.parseExecuteFetch(TTC7Protocol.java:1094)
at oracle.jdbc.driver.OracleStatement.executeNonQuery(OracleStatement.java:2132)
at oracle.jdbc.driver.OracleStatement.doExecuteOther(OracleStatement.java:2015)
at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:2877)
at oracle.jdbc.driver.OraclePreparedStatement.executeUpdate(OraclePreparedStatement.java:608)
at org.jboss.resource.adapter.jdbc.WrappedPreparedStatement.executeUpdate(WrappedPreparedStatement.java:251)
at org.jboss.mq.pm.jdbc2.PersistenceManager.add(PersistenceManager.java:1136)
at org.jboss.mq.pm.jdbc2.PersistenceManager.add(PersistenceManager.java:1082)
at org.jboss.mq.server.PersistentQueue.addMessage(PersistentQueue.java:58)
at org.jboss.mq.server.SelectorPersistentQueue.addMessage(SelectorPersistentQueue.java:84)
at org.jboss.mq.server.JMSTopic.addMessage(JMSTopic.java:392)
at org.jboss.mq.server.JMSDestinationManager.addMessage(JMSDestinationManager.java:415)
at org.jboss.mq.server.JMSDestinationManager.addMessage(JMSDestinationManager.java:399)
at org.jboss.mq.server.JMSServerInterceptorSupport.addMessage(JMSServerInterceptorSupport.java:106)
at org.jboss.mq.security.ServerSecurityInterceptor.addMessage(ServerSecurityInterceptor.java:168)
at org.jboss.mq.server.TracingInterceptor.addMessage(TracingInterceptor.java:226)
at org.jboss.mq.server.JMSServerInvoker.addMessage(JMSServerInvoker.java:112)
at org.jboss.mq.il.uil2.ServerSocketManagerHandler.handleMsg(ServerSocketManagerHandler.java:111)
at org.jboss.mq.il.uil2.SocketManager$ReadTask.handleMsg(SocketManager.java:395)
at org.jboss.mq.il.uil2.msgs.BaseMsg.run(BaseMsg.java:398)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:748)
at java.lang.Thread.run(Thread.java:595)
Please respond to this query w/ a possible solution as soon as possible.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4026643#4026643
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4026643
19Â years, 1Â month