12:28 a.m.
I was working at a client site recently and ran into this issue. They have a custom Realm
and security context listener to allow the deployment of one of their applications on to a
JBoss server. Originally they defined this Realm at the Engine level, replacing the
default org.jboss.web.tomcat.security.JBossSecurityMgrRealm.
Since defining this custom Realm at the Engine level prevented other applications from
being deployed on the same server, I moved the Realm definition to the Context level
within server.xml. What ended up happening was that the listener would recognize the
custom Realm for that Context when the server started up. However, once the application
was deployed, the custom Realm's association with that Context was lost and the
default security realm took over once again.. preventing the application from working. I
could not find any good examples of creating a Context and a Realm at the context level. I
suspect some further configuration is needed within the EAR/WAR in order to maintain the
correct Realm association.
--------------------------
server.xml
--------------------------
| <Server>
| <Listener className="org.apache.catalina.core.AprLifecycleListener"
SSLEngine="on" />
| /docs/jasper-howto.html -->
| <Listener className="org.apache.catalina.core.JasperListener" />
|
| <Service name="jboss.web">
|
| <Connector port="8080" address="${jboss.bind.address}"
| maxThreads="250" maxHttpHeaderSize="8192"
| emptySessionPath="true" protocol="HTTP/1.1"
| enableLookups="false" redirectPort="8443"
acceptCount="100"
| connectionTimeout="20000" disableUploadTimeout="true"
/>
|
| <!-- Define an AJP 1.3 Connector on port 8009 -->
| <Connector port="8009" address="${jboss.bind.address}"
protocol="AJP/1.3"
| emptySessionPath="true" enableLookups="false"
redirectPort="8443" />
|
| <Engine name="jboss.web" defaultHost="localhost">
|
| <Realm className="org.jboss.web.tomcat.security.JBossSecurityMgrRealm"
|
certificatePrincipal="org.jboss.security.auth.certs.SubjectDNMapping"
| allRolesMode="authOnly"
| />
|
| <Host name="localhost"
| autoDeploy="false" deployOnStartup="false"
deployXML="false"
|
configClass="org.jboss.web.tomcat.security.config.JBossContextConfig"
| >
|
| <Valve
className="org.jboss.web.tomcat.service.jca.CachedConnectionValve"
|
cachedConnectionManagerObjectName="jboss.jca:service=CachedConnectionManager"
|
transactionManagerObjectName="jboss:service=TransactionManager" />
|
| <Context path="/SampleJpaWeb" docBase="work"
reloadable="false">
| <Realm className="com.rpmsfa.auth.catalina.SfaSecurityMgrRealm"
| certificatePrincipal="org.jboss.security.auth.certs.SubjectDNMapping"
| allRolesMode="authOnly"
| />
| </Context>
| </Host>
| </Engine>
| </Service>
| </Server>
|
--------------------------
web.xml snippet
--------------------------
| <web-app id="WebApp_ID" version="2.4"
| xmlns="http://java.sun.com/xml/ns/j2ee"
| xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
| xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee
| http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
| <display-name>SampleJpaWeb</display-name>
| <distributable />
| <listener>
|
<listener-class>com.rpmsfa.auth.catalina.SfaSecurityContextListener</listener-class>
| </listener>
|
--------------------------
listener code snippet:
--------------------------
| private void printRealms()
| {
| Server server = ServerFactory.getServer();
| Service service = server.findService("jboss.web");
|
| Engine engine = (Engine) service.getContainer();
| Host host = (Host) engine.findChild(engine.getDefaultHost());
|
| try
| {
| Container[] cArr = host.findChildren();
| for (int i = 0; i < cArr.length; i++)
| {
| System.out.println("===== c[" + i + "] container name: " +
cArr.getName());
| System.out.println("===== c[" + i + "] realm name: " +
cArr.getRealm().getClass().getName());
| }
| }
| catch (Exception e)
| {
| }
| }
|
------------------------------------------------------
listener code snippet output on server startup
(application is not deployed)
------------------------------------------------------
| [STDOUT] ===== c[3] container name: /SampleJpaWeb
| [STDOUT] ===== c[3] realm name: com.rpmsfa.auth.catalina.SfaSecurityMgrRealm
|
-------------------------------------------------------
listener code snippet output on hot deployment
-------------------------------------------------------
| [STDOUT] ===== c[2] container name: /SampleJpaWeb
| [STDOUT] ===== c[2] realm name: org.jboss.web.tomcat.security.JBossSecurityMgrRealm
|
So the association of the WAR's context to the custom Realm is lost on hot deployment.
Any information on what I have missed would be appreciated. If there's any other
information I should provide, let me know. Thanks.
View the original post :
http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4126873#...
Reply to the post :
http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...