5:08 p.m.
Hello Forum,
seam 1.1.6.GA
jboss-4.0.5.GA
ajax4jsf-1.0.6
Facelets
I am trying out the new seam security.
I want to use the JAAS security as described in sec. 12.2.5.1 of the ref manual.
I would like to know if there is a working example anywhere I could look at.
What I have tried is:
We have our own policy & I have set the jaas-config-name accordingly.
Note that I saw the bug report about the documentation and am using
"jaas-config-name" instead of "jaasConfigName".
In my components.xml I have the following:
| <security:identity jaas-config-name="centina"/>
|
My login action authenticates like so:
| ....
| identity.setUsername(j_username);
| identity.setPassword(j_password);
| log.debug( "LoginAction: Identity Login result " + identity.login() ) ;
| ....
|
I removed the login-config an security-constraint tags from my web.xml
My web.xml now contains no JAAS security stuff in it.
When I give it a try, I find that the initial authentication works, calling our
authenticator as expected, & the identity.login() returns "success".
But the next call I make fails (see exception, below). This seems to
be due to the authentication prinicplal not being saved anywhere? The stack trace
shows a re-authentication attempt.
I looked at the source for JBossSecurityMgrRealm etc., to see how
"they did it" and noticed the following is executed if the
authentication passes: ( line 494 )
| ...
| SecurityAssociationActions.setPrincipalInfo(principal, certs,subject);
| . ..
|
The Seam Identity object does not do this (explicity anyway) as far as
I can tell.
I tried to call SecurityAssociationActions.setPrincipalInfo() myself
after my authentication, in my login action, but can't do so as the
class is not public. I suppose that this really means I shouldn't try to
do it this way :)
I get the following failure. This exception is thrown because the
username passed in is null. The username is normally set by
UsernamePasswordLoginModule.getUsernameAndPassword() via callback
functions.
Anyway, my exception is:
| javax.security.auth.login.LoginException: No username specified
| at
centina.sa.server.security.SecurityManagerLoginModule.createIdentity(SecurityManagerLoginModule.java:59)
| at
org.jboss.security.auth.spi.UsernamePasswordLoginModule.login(UsernamePasswordLoginModule.java:194)
| at
centina.sa.server.security.SecurityManagerLoginModule.login(SecurityManagerLoginModule.java:126)
| at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
| at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
| at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
| at java.lang.reflect.Method.invoke(Method.java:585)
| at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
| at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
| at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
| at java.security.AccessController.doPrivileged(Native Method)
| at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
| at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
| at
org.jboss.security.plugins.JaasSecurityManager.defaultLogin(JaasSecurityManager.java:601)
| at
org.jboss.security.plugins.JaasSecurityManager.authenticate(JaasSecurityManager.java:535)
| at
org.jboss.security.plugins.JaasSecurityManager.isValid(JaasSecurityManager.java:344)
| at
org.jboss.aspects.security.AuthenticationInterceptor.authenticate(AuthenticationInterceptor.java:123)
| at
org.jboss.aspects.security.AuthenticationInterceptor.invoke(AuthenticationInterceptor.java:66)
| at
org.jboss.ejb3.security.Ejb3AuthenticationInterceptor.invoke(Ejb3AuthenticationInterceptor.java:102)
| at
org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:101)
| at
org.jboss.ejb3.ENCPropagationInterceptor.invoke(ENCPropagationInterceptor.java:47)
| at
org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:101)
| at
org.jboss.ejb3.asynchronous.AsynchronousInterceptor.invoke(AsynchronousInterceptor.java:106)
| at
org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:101)
| at
org.jboss.ejb3.stateless.StatelessContainer.localInvoke(StatelessContainer.java:211)
| at
org.jboss.ejb3.stateless.StatelessLocalProxy.invoke(StatelessLocalProxy.java:79)
| at $Proxy1105.getUser(Unknown Source)
| .....
|
Here is the Thread.dumpStack() of the successful authentication by the Identity.login()
method:
| java.lang.Exception: Stack trace
| at java.lang.Thread.dumpStack(Thread.java:1158)
| at
centina.sa.server.security.SecurityManager.completeLogin(SecurityManager.java:507)
| at
centina.sa.server.security.SecurityManagerLoginModule.commit(SecurityManagerLoginModule.java:180)
| at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
| at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
| at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
| at java.lang.reflect.Method.invoke(Method.java:585)
| at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
| at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
| at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
| at java.security.AccessController.doPrivileged(Native Method)
| at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
| at javax.security.auth.login.LoginContext.login(LoginContext.java:580)
| at org.jboss.seam.security.Identity.authenticate(Identity.java:206)
| at org.jboss.seam.security.Identity.authenticate(Identity.java:199)
| at org.jboss.seam.security.Identity.login(Identity.java:184)
| at centina.sa.client.session.LoginAction.login(LoginAction.java:158)
| .....
|
Any ideas (esp. an example) would be much appreciated.
Thanks, PdP
View the original post :
http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4024493#...
Reply to the post :
http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...