April 2007 - jboss-user - Jboss List Archives

by chubby

I was wondering if there a good Wiki page covering best practices for Login security for web apps? One specific question I have is with regards to a login form on the home page (non-secure) that submits to the login action. Because I cannot specify a scheme with JSF/JBoss seam in the h:form tag, I cannot force it to submit to an https URL. The best I can do is use the pages.xml to require HTTPS, but that results in one non-secure request then a redirect to the secure request. So its pointless in this case. I reviewed a JIRA (http://jira.jboss.com/jira/browse/JBSEAM-741) where this was talked about and it appears that for now the Seam team is holding off supporting a scheme attribute in the link/form tags. It has me thinking there is a security concern with doing this sort of thing (submitting a non-secure form to a secure URL) and that perhaps I should just avoid having the convenient login box on the home page. Any feedback is very much appreciated. Thanks, Mark View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4039550#4039550 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4039550

19 years

1
0
0 / 0

[JBoss Seam] - Re: Error when deploying project generated with seam-gen

by christian.bauer＠jboss.com

Wrong JBoss AS version, read the README and follow it step-by-step. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4039549#4039549 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4039549

19 years

1
0
0 / 0

[Management, JMX/JBoss] - Re: jboss JMX notification type

by leonz11

ic. Thanks, LZ View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4039548#4039548 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4039548

19 years

1
0
0 / 0

[Security & JAAS/JBoss] - JAAS integration w/ 3rd party webservice stack

by saspad

Hi, I am using Axis2/rampart webeservice/security stack. The rampart module of Axis2 will perform WS-Security logistics. However, it knows nothing about how to integrate with the container's security infrastructure. Therefore, if rampart presents me with a userid/password from processing webservice security headers, I would like to be able to hand it over to the JBoss security infrastructure and let it perform JAAS authentication with the configured security domain. It looks as easy as doing the following: Context securityCtx = InitialContext iniCtx = new InitialContext(); securityCtx = (Context) iniCtx.lookup("java:comp/env/security"); SubjectSecurityManager securityMgr = (SubjectSecurityManager) securityCtx.lookup("securityMgr"); Principal principal = new SimplePrincipal(username); Subject subject = new Subject(); if (securityMgr.isValid(principal, credentials, subject)) { // success } Is that all there is? If success then I should be able to use the JAAS subject that will have been populated by the configured loginModules. I need to investigate JBoss's own webservice stack, JBossWS. Any comparison between JBossWS and Axis2 would be appreciated. Anyway, I'm guessing JBossWS does would need to perform similar actions for WS-Security integration into the JBoss JAAS framework. Is this what they do? Can someone point me to the integration code? I want to do something portably. Thank you for any insight. -Tony View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4039546#4039546 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4039546

19 years

1
0
0 / 0

[Beginners Corner] - Re: Getting error while migrating from Jboss3.2.7 to Jboss 4

by weston.price＠jboss.com

Have a look at http://jira.jboss.com/jira/browse/JBAS-1616 Quite a fex fixes were backported to 3.2.8. You may want to consider upgrading. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4039544#4039544 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4039544

19 years

1
0
0 / 0

[Beginners Corner] - Re: EJB 3.0 - Throwing Exceptions from Session Beans

by weston.price＠jboss.com

http://jira.jboss.com/jira/browse/EJBTHREE-698 View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4039543#4039543 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4039543

19 years

1
0
0 / 0

[Installation, Configuration & Deployment] - maxThread setting for port=

by kooljava2

Hi, We have a load balancer which maintains session stickiness and points to 2 Application server. These application server run only jboss. JBOSS is configured on port 443 and maxThread setting is set to 500. The problem is because of session stickiness almost all the request coming in goes to one application server. Hence when the concurrent request reaches the value of 500 JBOSS on port 443 becomes slow in responding to request and eventually gives "Page cannot be displayed" error. What is the maximum thread size I can increase for port 443 in server.xml. Is there an alternative approach of doing which can reslove the above problem? -Thank you View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4039542#4039542 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4039542

19 years

1
0
0 / 0

[Management, JMX/JBoss] - Re: jboss JMX notification type

by dimitris＠jboss.org

Simple: According to the JMX spec, handleNotification(..) is the method that should be implemented by NotificationListeners. The ListenerServiceMBeanSupport base class however, in order to implement the "dynamic" notification subscription feature (when doing subscribe(true)), it needs to monitor the registration/unregistration of mbeans in the mbean server and apply the subscription criteria. So it overrides the handleNotification() method in the baseclass to intercept, act upon, and remove, those notifications, before passing on the call to the handleNotification2() method, that you are supposed to implement. It just occurred to me I could have probably implemented it differently, by forking a seperate notification listener, but thats history now :) View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4039540#4039540 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4039540

19 years

1
0
0 / 0

[JBoss Seam] - Error when deploying project generated with seam-gen

by amitev

16:25:49,437 ERROR [MainDeployer] Could not create deployment: file:....t/servers/jboss-4.0.4.GA/server/default/tmp/deploy/tmp18413SeamGenProject.ear- contents/SeamGenProject.jar org.jboss.deployment.DeploymentException: ejb-jar.xml must either obey the right xml schema or define a valid DOCTYPE! at org.jboss.metadata.ApplicationMetaData.importEjbJarXml(ApplicationMet aData.java:339) Idea what's wrong? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4039539#4039539 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4039539

19 years

1
0
0 / 0

[JBoss Seam] - Re: Integrating Tomahawk with Seam

by atao

anonymous wrote : As noted in my post, I added the mappings to my web.xml and that just made my application crash. yes but your error message states that anonymous wrote : ExtensionsFilter not correctly configured so... And about anonymous wrote : tomahawk,jar have to be in the web-inf/lib I think it's ok in the war/WEB-INF/lib directory. In my configuration, I put it in the root of the ear archive and I add its reference in the classpath of war/META-INF/MANIFEST.MF View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4039538#4039538 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4039538

19 years

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-user April 2007