• Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other Pie Elite all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Jeanne Boyarsky
  • Ron McLeod
  • Paul Clapham
  • Liutauras Vilda
Sheriffs:
  • paul wheaton
  • Rob Spoor
  • Devaka Cooray
Saloon Keepers:
  • Stephan van Hulst
  • Tim Holloway
  • Carey Brown
  • Frits Walraven
  • Tim Moores
Bartenders:
  • Mikalai Zaikin

Single Sign-on across web-apps

 
Greenhorn
Posts: 9
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Hello everyone,

I am using JBoss 4.0.2 w/Tomcat 5.5.9 (integrated) along with jTDS and SQLServer for a project.

I would like to use DatabaseServerLoginModule and single sign-on. I've created the approprite tables in my database for users and roles. I've created simple jsp pages for login and login error. I've also modified my login-config.xml, jboss-web.xml and web.xml to handle the security. I am using the Tomcat valve for singlesignon.

However, when I test the protected resource with a valid userid and password, I get a 403 error message. If I try to login with an invalid userid and password, I get the error jsp that I created.

This tells me that I am authenticating the user, but I am probably screwing something up with the roles as I cannot get access to the restricted resource even with the correct userid and password.

What I am trying to accomplish is

1. Authenticate a user against the database tables for userid and appropriate roles.

2. Use a custom error page when the user does not have access to the resource. Uid/pw combo AND role

3. Use SSO across the various web-apps that will comprise this project. Is it possible or correct for one web-app to handle all of the login/logout processing? If a user tries to access a web-app can that web-app redirect the user to a login page in another web-app? All of these web-apps will be in the same container.

Any help that could be provided, would be most appreciated.

Thanks,
Howler


Here is my stuff

web.xml



login-config.xml



jboss-web.xml

[ July 07, 2005: Message edited by: Howler ]
 
ranger
Posts: 17347
11
Mac IntelliJ IDE Spring
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
"Howler"-
Welcome to the JavaRanch! Please adjust your displayed name to meet the

JavaRanch Naming Policy.

You can change it

here.

Thanks! and welcome to the JavaRanch!

Mark
 
John Brosan
Greenhorn
Posts: 9
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Sorry about that Mark.

All set now. :-)
 
John Brosan
Greenhorn
Posts: 9
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Well,

I added the following to my log4j.xml file to get logging information.



After checking server.log I see that it looks like I'm getting authenticated and the correct role is being picked up. I'm still not sure why I am getting 403'd on my resource if I've got all of the information and assigned the correct role to the resource.



[ July 07, 2005: Message edited by: John Brosan ]

[ July 07, 2005: Message edited by: John Brosan ]

[ July 07, 2005: Message edited by: John Brosan ]
[ July 07, 2005: Message edited by: John Brosan ]
 
John Brosan
Greenhorn
Posts: 9
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Well, after much pounding of my head during the last few days, I actually found a solution.

As it turns out, I needed to remove the security role tag from the web.xml file and place an '*' into the role-name tag.

It's currently my assumption, that once the user is authenticated, the code would check the user's roles to make sure they could have access to the application.

 
reply
    Bookmark Topic Watch Topic
  • New Topic