[Beginners Corner] - Re: Setting up database authentication in JBoss using JAAS
by safwateleish
I have the same problem. authentication fails and i am being redirected to the error page without any log indicating the error that happened. My configurations are as follows:
I added the following entry to the login-config.xml
<application-policy name = "jbossdatabaseBilling">
<login-module code = "org.jboss.security.auth.spi.DatabaseServerLoginModule"
flag = "required">
<module-option name = "unauthenticatedIdentity">guest</module-option>
<module-option name = "dsJndiName">java:/myDS</module-option>
<module-option name = "principalsQuery">SELECT PASSWORD passwd FROM USERS WHERE USERNAME=?</module-option>
<module-option name = "rolesQuery">SELECT ROLENAME userRoles, 'Roles' FROM DUMMYROLES WHERE USERNAME =?</module-option>
</login-module>
</application-policy>
By the way my database is oracle. and i jave defined myDS in oracle-ds.xml in the deploy directory of my server.
I have the jboss-web.xml in the same directory of the web.xml of my web application. It has the following entry
<security-domain>java:/jaas/jbossdatabaseBilling</security-domain>
finally in the web.xml file i added the following sections
<security-role>
<role-name>users</role-name>
</security-role>
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/error.jsp</form-error-page>
</form-login-config>
</login-config>
<security-constraint>
<web-resource-collection>
<web-resource-name>whatever</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>POST</http-method>
<http-method>GET</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>upgradebundle</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
-----
I am still being redirected to the error page. Any hint ? Please i need help
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4025954#4025954
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4025954
19Â years, 1Â month
[JBoss Seam] - Re: JBoss-4.2.0-CR1 and Seam 1.2
by tony.herstellï¼ gmail.com
Can this (answer) go into the doco (setup) or the wiki...
"NielsH" wrote : Installed Jboss-4.2.0-CR1 just today. Made the changes in my web.xml to use RI instead of MyFace, then deployed my seam app, but ran into a few library problems.
|
| JBoss-4.0.5-GA has jboss-tomcat55.sar which includes:
| commons-beanutil.jar
| commons-codec.jar
| commons-collections.jar
| commons-digester-1.6.jar
| commons-lang-2.1.jar
|
| While JBoss-4.2.0-CR1 has jboss-web.deployer which does not have any of these libraries included.
|
| Now the question:
| Is it better to include the above jars in my application or is good practice to add the jars to the jboss-web.deployer jsf-lib directory? I did the latter and my app runs fine, but I'd like to be sure which is the proper procedure.
|
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4025951#4025951
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4025951
19Â years, 1Â month
[JBoss Seam] - Re: Eclipse, JBoss & exploded deployment
by gcomnz
In my experience so far, you need to have a real ear directory of some name, under which your various wars and jars will be deployed by the native Eclipse builder. Additionally, you need to put this under a deploy directory, so that you can tell JBoss to poll that directory for deployable modules. It's not beautiful, but it works, without needing to message with Eclipse's link dirs, and everything can be checked in for a team to use as is without special local setup.
So, for instance, in your project base path, you could create a "deploy/" directory, and under that put "projectname.ear/" directory. Inside that create the ear's deploy/projectname.ear/META-INF directory and any relevant files.
Then in the java build path dialog for the project, on the source tab, check the box for "Allow output folders for source folders". Then go through each of your sub-archives' src and resource dirs in that tab, and set their "Output folder" to each one's appropriate, exploded-style, directory under the previously created projectname.ear location.
If my extremely unclear instructions make any sense, you should now have Eclipse auto-building into an exploded ear, and all that remains is that your configure JBoss to poll that directory. So for instance you should have something like:
| /deploy/
| /projectname.ear/
| /META-INF/
| /projectname.jar/
| /projectname.war/
|
If anyone has a better way to do this, that also fulfills all the reasonable goals, such as team-compatibility without extra local configuration, hacks, and other messiness, I'd be very interested. This has worked great for me for sometime though.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4025949#4025949
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4025949
19Â years, 1Â month
[Security & JAAS/JBoss] - Re: Active Directory and LdapExtLoginModule?
by ksiva_rajesh
Hi,
I have a J2EE WebApp which expects the user to have a specific role for authorization (Authentication and Authorization will be against Active Directory).
Environment details given below:
App Server : JBoss-4.0.5.GA
Directory Services : Microsoft Active Directory.
Steps - 1:
Created a Group in Active Directory exactly with the same name required by WebaApp, assuming that JAAS will populate the group name(s) into role(s) after successful authentication.
Step - 2:
Assigned all the users to the group apart from their pre-assigned groups in Active Directory (AD).
Step - 3:
Below are the various config XMLs in JBoss.
<!-- ------------------------- login-config.xml - START --------------------------------------------- -->
<?xml version='1.0'?>
<!DOCTYPE policy PUBLIC
"-//JBoss//DTD JBOSS Security Config 3.0//EN"
"http://www.jboss.org/j2ee/dtd/security_config.dtd">
<!-- Used by clients within the application server VM such as
mbeans and servlets that access EJBs.
-->
<!-- Attempt with LdapExtLoginModule -->
<application-policy name="HMActiveDirecotry">
<login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="required" >
<!--
Some AD configurations may require searching against
the Global Catalog on port 3268 instead of the usual
port 389. This is most likely when the AD forest
includes multiple domains.
-->
<module-option name="java.naming.provider.url">ldap://ldaphost.company.com:389/</module-option>
<module-option name="java.naming.security.authentication">simple</module-option>
<module-option name="bindDN">cn=user,cn=Users,DC=company,DC=com</module-option>
<module-option name="bindCredential">password</module-option>
<module-option name="baseCtxDN">DC=company,DC=com</module-option>
<module-option name="baseFilter">(userPrincipalName={0})</module-option>
<module-option name="rolesCtxDN">DC=company,DC=com</module-option>
<module-option name="roleFilter">(member={1})</module-option>
<module-option name="roleAttributeID">memberOf</module-option>
<module-option name="roleAttributeIsDN">true</module-option>
<module-option name="roleNameAttributeID">name</module-option>
<module-option name="roleRecursion">-1</module-option>
<module-option name="searchScope">SUBTREE_SCOPE</module-option>
<module-option name="defaultRole">AuthUserRole</module-option>
</login-module>
</application-policy>
<!-- Attempt 2 from Wiki as it is from example and few more additions -->
<application-policy name="HMActiveDirecotry">
<login-module code="org.jboss.security.auth.spi.LdapLoginModule" flag="required">
<module-option name="java.naming.provider.url">ldap://ldaphost.company.com:389/</module-option>
<module-option name="java.naming.security.authentication">simple</module-option>
<module-option name="rolesCtxDN">cn=Users,DC=company,DC=com</module-option>
<module-option name="matchOnUserDN">false</module-option>
<module-option name="principalDNSuffix">@ldaphost.company.com</module-option>
<module-option name="uidAttributeID">sAMAccountName</module-option>
<module-option name="roleAttributeID">memberOf</module-option>
<module-option name="roleAttributeIsDN">true</module-option>
<module-option name="roleNameAttributeID">name</module-option>
<module-option name="allowEmptyPasswords">false</module-option>
<module-option name="searchScope">SUBTREE_SCOPE</module-option>
<module-option name="searchTimeLimit">5000</module-option>
<module-option name="defaultRole">AuthUserRole</module-option>
<!-- module-option name="additionalRole">AuthUserRole</module-option -->
</login-module>
</application-policy>
<!-- ------------------------- login-config.xml - END --------------------------------------------- -->
<!-- ------------------------- web.xml - START --------------------------------------------- -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
<display-name>LDAP-Test</display-name>
<welcome-file-list>
<welcome-file>index.jsp</welcome-file>
</welcome-file-list>
<servlet-name>ldapTest</servlet-name>
<display-name>LDAPTest</display-name>
<jsp-file>/ldaptest.jsp</jsp-file>
<servlet-mapping>
<servlet-name>ldapTest</servlet-name>
<url-pattern>/ldapTest</url-pattern>
</servlet-mapping>
<security-constraint>
<web-resource-collection>
<web-resource-name>LDAPTestJSP</web-resource-name>
<url-pattern>/ldaptest</url-pattern>
<url-pattern>/ldaptest.jsp</url-pattern>
<url-pattern>/ldapTest</url-pattern>
<http-method>POST</http-method>
<http-method>GET</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>AuthUserRole</role-name>
</auth-constraint>
</security-constraint>
<!-- login-config>
<auth-method>BASIC</auth-method>
</login-config -->
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/login_error.jsp</form-error-page>
</form-login-config>
</login-config>
<security-role>
<role-name>AuthUserRole</role-name>
</security-role>
</web-app>
<!-- ------------------------- web.xml - END --------------------------------------------- -->
<!-- ------------------------- jboss-web.xml - START ------------------------------------- -->
<jboss-web>
<security-domain>java:/jaas/test</security-domain>
</jboss-web>
<!-- ------------------------- jboss-web.xml - END -------------------------------------- -->
Actual Result:
The J2EE WebApp is not authorizing the user to view the ldapTest Servlet (JSP) after successful authentication.
I have tried with both LdapExtLoginModule & LdapLoginModule and could not get thru.
Is there any specific way of defining groups in Active Directory so that they will be populated into roles by JAAS after successful authentication? Please respond ASAP.
Can anyone help me please? This is very urgent.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4025948#4025948
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4025948
19Â years, 1Â month