[Security & JAAS/JBoss] - Re: Authentication in ejb container fails to use security do
by clin1
Thanks for your responses.
We have tried using JBoss 5.1.0GA and ran into exactly the same problem.
We also tried using <security-domain>FileNet</security-domain> as jaikiran mentioned, and the result was the same.
We could ran Java client application using EJB transport without problems.
This problem only occurs when we use an application that uses Web Services transport to connect to our application engine, which involves in having the WSI listener propagating the security information to EJB's security domain for authentication. Our WSI listener is implemented as a web servlet in JBoss web container which invokes FnClientLoginModule initially under the "FileNetP8Engine" application-policy, the authentication against LDAP is then performed in EJB container through the "FileNet" application-policy which is defined as the EJB security domain in jboss.xml.
Here is the excerpt of the login-config.xml:
<?xml version="1.0" encoding="UTF-8"?>
<application-policy name="FileNetP8Engine">
<login-module code="com.filenet.api.authentication.jboss.login.FnClientLoginModule" flag="required">
<module-option name="multi-threaded">true</module-option>
</login-module>
</application-policy>
<application-policy name = "FileNet">
<login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="required">
<module-option name="java.naming.provider.url">ldap://ldaphost:389</module-option>
<module-option name="java.naming.security.authentication">simple</module-option>
<module-option name="allowEmptyPasswords">false</module-option>
<module-option name="bindDN">cn=CEAdmin,ou=FileNet,dc=ldaphost,dc=com</module-option>
<module-option name="bindCredential">password</module-option>
<module-option name="baseCtxDN">dc=ldaphost,dc=com</module-option>
<module-option name="baseFilter">(cn={0})</module-option>
<module-option name="rolesCtxDN">dc=ldaphost,dc=com</module-option>
<module-option name="roleFilter">(uniqueMember={0})</module-option>
<module-option name="matchOnUserDN">true</module-option>
<module-option name="roleAttributeID">cn</module-option>
<module-option name="uidAttributeID">cn</module-option>
<module-option name="roleAttributeIsDN">false</module-option>
</login-module>
</application-policy>
This mechanism has been working in JBoss 4.0.5 and 4.2.x.
We will try reproduce the problem on a sample application.
View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4237730#4237730
Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4237730
17 years, 1 month
[Clustering/JBoss] - Migration from mod_jk to mod_proxy
by pinipinilla
I have two servers jboss 4.0.4.GA in cluster. The web server is apache Apache/2.0.52 which is using module mod_jk/1.2.25 to load_balancing and failover. The OS is RHEL AS 4.5. All this system run very well.
I'm trying to migrate this old system to a newer one. The new cluster has two nodes jboss 4.0.4.GA, but the OS is RHEL 5.3 and web server Apache/2.2.3 which is using modules proxy_module,proxy_ajp_module,proxy_balancer_module instead of mod_jk.
I can't reproduce the behaviour of mod_jk with mod_proxy.
In old system I have the next config files:
/etc/httpd/conf/workers.properties
worker.list=loadbalancer,status
worker.nodo1.port=8009
worker.nodo1.host=localhost
worker.nodo1.type=ajp13
worker.nodo1.lbfactor=10
worker.nodo2.port=8009
worker.nodo2.host= 10.10.1.158
worker.nodo2.type=ajp13
worker.nodo2.lbfactor=30
worker.loadbalancer.type=lb
worker.loadbalancer.balance_workers=nodo1,nodo2
worker.loadbalancer.sticky_session=1
worker.status.type=status
/etc/httpd/conf/uriworkermap.properties
/jmx-console=loadbalancer
/jmx-console/*=loadbalancer
/web-console=loadbalancer
/web-console/*=loadbalancer
/*.jsp=loadbalancer
/*.do=loadbalancer
/*.asp=loadbalancer
/services/*=loadbalancer
/servlet/*=loadbalancer
/index.html=loadbalancer
/promo/*=loadbalancer
/sanvalentin=loadbalancer
/sanvalentin/*=loadbalancer
/JSON-RPC*=loadbalancer
-----
With this configuration the static contents was served by apache y the dynamic contents are served by JBoss (*.jsp, *.do, *.asp, etc). Both contents could be in the same directories. For this reason I used /*.do, /*.asp, /*.jsp in uriworkermap.properties.
In other hand the configuration of mod_proxy is:
-----
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
<Proxy balancer://mycluster>
Order deny,allow
Allow from all
BalancerMember ajp://nodeA:8009 route=nodo1 retry=60 loadfactor=10
BalancerMember ajp://nodeB:8009 route=nodo2 retry=60 loadfactor=10
<Location / >
Allow From All
ProxyPass balancer://mycluster/ stickysession=JSESSIONID nofailover=on lbmethod=byrequests
ProxyPassReverse balancer://mycluster/
<Location /balancer>
SetHandler balancer-manager
Order Deny,Allow
Deny from all
Allow from 192.100.30.161
ProxyStatus On
-------------------
With this configuration all the contents are served by jboss nodes.
If I change the <Location / > in order to use the form <Location /*.jsp > or similar it doesn't forward the calls to the JBoss. I want to achieve the same behaviour that I achieved with uriworkermap.properties.
In Addition I think the stickysession is not running. I've made a jsp (whoami.jsp) who tell me what's the node which is serving the page. I've detected the next behaviour:
>From a Browser I request the page whoami.jsp and when the response is given by the server A, If I refresh this page the next times, I get the response from server B. Why is not served by the server A?
Do you know what is happening and how could i get the same behaviour like the mod_jk?
Thanks in advance
View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4237720#4237720
Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4237720
17 years, 1 month