9:13 a.m.
Hello, I am writing a custom Authenticator class that collects credentials from a
Siteminder SMSESSION cookie. I created a security domain called CustomSMAuth and assigned
the SimpleServerLoginModule to it. According to JBoss doc, this authenticator assigns a
role of 'user' if the username and password are the same value. That is the
behavior I'm trying to get.
I can confirm that the Authenticator is executed and is working, but access is denied
based on the user role authorization. I'm not sure if my authenticator class should be
doing something different, or if I have a configuration issue with JBoss. Any help would
be appreciated!
The authenticator, after retrieving the userid value, does the following:
GenericPrincipal userPrincipal = new GenericPrincipal(context.getRealm(),
userid.trim(),userid.trim());
session.setAttribute(Constants.SESS_USERNAME_NOTE, userPrincipal);
request.setUserPrincipal(userPrincipal);
register(request, response, userPrincipal, "SMSESSION", userid.trim(),
userid.trim());
return true;
my web.xml:
<security-constraint>
<web-resource-collection>
<web-resource-name>Success</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>user</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>SMSESSION</auth-method>
</login-config>
<security-role>
<role-name>user</role-name>
</security-role>
jboss-web.xml:
<jboss-web>
<security-domain>java:/jaas/CustomSMAuth</security-domain>
</jboss-web>
login-config.xml:
<application-policy name="CustomSMAuth">
<login-module code =
"org.jboss.security.auth.spi.SimpleServerLoginModule"
flag = "required">
</login-module>
</application-policy>
and the log excerpt showing output from my authenticator and the authorization failure:
2007-12-03 09:54:44,518 DEBUG [com.sas.smutil.SMSESSIONAuthenticator] Login return code:
1
2007-12-03 09:54:44,518 DEBUG [com.sas.smutil.SMSESSIONAuthenticator] Validation Accepted,
setting user principal
2007-12-03 09:54:44,533 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase]
Authenticated 'sasdemo' with type 'SMSESSION'
2007-12-03 09:54:44,533 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase]
Calling accessControl()
2007-12-03 09:54:44,533 TRACE [org.jboss.web.tomcat.security.JBossSecurityMgrRealm]
Checking roles GenericPrincipal[sasdemo()]
2007-12-03 09:54:44,533 DEBUG [org.apache.catalina.realm.RealmBase] Username sasdemo does
NOT have role user
2007-12-03 09:54:44,533 TRACE [org.jboss.web.tomcat.security.JBossSecurityMgrRealm] No
role found: user
2007-12-03 09:54:44,533 TRACE [org.jboss.web.tomcat.security.JBossSecurityMgrRealm]
Checking for all roles mode: authOnly
2007-12-03 09:54:44,533 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase]
Failed accessControl() test
2007-12-03 09:54:44,533 TRACE [org.jboss.security.SecurityAssociation] clear, server=true
2007-12-03 09:54:44,533 INFO
[org.apache.catalina.core.ContainerBase.[jboss.web].[localhost]]
---------------------------------------------------------------
2007-12-03 09:54:44,533 INFO
[org.apache.catalina.core.ContainerBase.[jboss.web].[localhost]]
authType=SMSESSION
2007-12-03 09:54:44,533 INFO
[org.apache.catalina.core.ContainerBase.[jboss.web].[localhost]] contentLength=-1
2007-12-03 09:54:44,533 INFO
[org.apache.catalina.core.ContainerBase.[jboss.web].[localhost]]
contentType=text/html;charset=utf-8
2007-12-03 09:54:44,533 INFO
[org.apache.catalina.core.ContainerBase.[jboss.web].[localhost]]
cookie=JSESSIONID=6F898FB15DD78EC4EEBC503B5593873C; domain=null; path=/
2007-12-03 09:54:44,533 INFO
[org.apache.catalina.core.ContainerBase.[jboss.web].[localhost]]
header=Pragma=No-cache
2007-12-03 09:54:44,533 INFO
[org.apache.catalina.core.ContainerBase.[jboss.web].[localhost]]
header=Cache-Control=no-cache
2007-12-03 09:54:44,533 INFO
[org.apache.catalina.core.ContainerBase.[jboss.web].[localhost]]
header=Expires=Wed, 31 Dec 1969 19:00:00 EST
2007-12-03 09:54:44,533 INFO
[org.apache.catalina.core.ContainerBase.[jboss.web].[localhost]]
header=Set-Cookie=JSESSIONID=6F898FB15DD78EC4EEBC503B5593873C; Path=/
2007-12-03 09:54:44,549 INFO
[org.apache.catalina.core.ContainerBase.[jboss.web].[localhost]] message=Access
to the requested resource has been denied
2007-12-03 09:54:44,549 INFO
[org.apache.catalina.core.ContainerBase.[jboss.web].[localhost]]
remoteUser=sasdemo
2007-12-03 09:54:44,549 INFO
[org.apache.catalina.core.ContainerBase.[jboss.web].[localhost]] status=403
2007-12-03 09:54:44,549 INFO
[org.apache.catalina.core.ContainerBase.[jboss.web].[localhost]]
===============================================================
View the original post :
http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4109878#...
Reply to the post :
http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...