[Tomcat, HTTPD, Servlets & JSP] - Passing LDAP-authenticated users from Apache to JBoss
by dan957
Hi Everyone,
I was hoping to get your insights. I am trying to migrate an Apache+LDAP+Tomcat application to an Apache+LDAP+JBoss set-up.
Authentication is done by Apache via LDAP for protected resources. While it works fine for the existing Tomcat set-up, on my JBoss set-up, it does not work; server.log shows nullpointer exceptions because it is not able to pick up the user that just logged in. I can confirm via Apache's logs that LDAP authentication is happening correctly, but looking at the JBoss request dumper logs, I observe that remoteuser=null. Other parameters have values in them, such as request uri, header referer, remoteaddr, servletpath, etc.
Now since I am not a developer, I am not sure if picking up the username from the Apache request should be done programatically, or if I am missing something in the JBoss configuration.
Apache 2.0.63, JBossAS4.2.3GA, mod_jk1.2.27
Kind regards,
Dan
View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4210874#4210874
Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4210874
17 years, 2 months
[Security & JAAS/JBoss] - Re: Can I create a login .war module that my other .war modu
by vparmar
We have a solution for Web applications deployed on same JBoss Instance to delegate Authentication to different co-hosted web application.
Essentially For Web Application/Module ABC1, ABC2, , a Servlet Filter checks for Request/Session parameters (for example USER_NAME, etc). If the Servlet Filter does not find a user in request/session, then it forwards the Request to the LOGON_XYZ Web App responsible for Authentication.
The LOGON_XYZ web application authenticates the User by validating the credentials provided by the User.
Once the User is successfully Authenticated, the LOGON_XYZ web application a) Sets the User information in the Request b) forwards the Request to the ABC1 web application. The ABC1 Web app Servlet Filter checks and finds a User in the Request and allows User to continue to the requested page flow.
The Servlet Filter code is somewhat like this
| package somepackage;
|
| import java.io.IOException;
| import javax.servlet.Filter;
| import javax.servlet.FilterChain;
| import javax.servlet.FilterConfig;
| import javax.servlet.RequestDispatcher;
| import javax.servlet.ServletContext;
| import javax.servlet.ServletException;
| import javax.servlet.ServletRequest;
| import javax.servlet.ServletResponse;
| import javax.servlet.http.HttpServletRequest;
| import javax.servlet.http.HttpSession;
|
| /**
| *
| * MyServletFilter intercepts host web applications requests inspects to verify if a User is logged in.
| * If a User is not logged in to the Host web application, the User is forwarded to the LOGON_XYZ Web application for Authentication.
| * @author parmarv
| *
| */
|
| public class MyServletFilter implements Filter {
|
|
| private FilterConfig filterConfig = null;
|
| // This method is called once on server startup
| public void init(FilterConfig filterConfig) {
| this.filterConfig = filterConfig;
| }
| // This method is called once on server shut down
| public void destroy() {
| this.filterConfig = null;
| }
|
| public void doFilter(ServletRequest request, ServletResponse response,
| FilterChain chain) throws IOException, ServletException {
|
| // Check if Attribute for this SessionID is available in the ServletContext.
| boolean invokeLOGON_XYZ = false;
| if (request instanceof HttpServletRequest) {
| HttpSession session = ((HttpServletRequest) request)
| .getSession(true);
| if (session != null && session.isNew()) {
| // Invoke LOGON_XYZ.
| invokeLOGON_XYZ = true;
| } else {
| // Check For User in Session
| if (session.getAttribute("USER_NAME_TOKEN_OR_ID") == null) {
| // User is not logged in since USER_NAME_TOKEN_OR_ID is not available.
| // Invoke LOGON_XYZ
| invokeLOGON_XYZ = true;
| }else{
| // User is logged in since USER_NAME_TOKEN_OR_ID is available.
| // Continue normal operation
| chain.doFilter(request, response);
| }
| if(invokeLOGON_XYZ){
| if (filterConfig != null) {
| String appContextLOGON_XYZ = filterConfig.getInitParameter("LOGON_XYZ_CONTEXT");
| String dispatchPath = "/ABC1_User_home.jsp";
| ServletContext sc = this.filterConfig.getServletContext().getContext("/"+appContextLOGON_XYZ);
| RequestDispatcher rd = sc.getRequestDispatcher(dispatchPath);
| rd.forward(request, response);
| return;
| }
| }
| }
| }
| chain.doFilter(request, response);
| return;
| }
| }
|
|
This solution only works for Web application that DO NOT use JBoss Container Managed Security. This solution is advisable for a work around solution only. I am currently working on a solution for the same for the current issue for my project.
I have posted this solution only to show that it is possible to use a second web app to delegate the authentication logic to.
HTH,
vparmar
View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4210866#4210866
Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4210866
17 years, 2 months