unable to add web-console user/password authentication

[chen young]

Hi,

I succeed to add user/password authentication for the jmx-console but when I continue and try to add also user/password for the web-console nothing as worked.

I used the following instruction : securethejmxconsole

I get the following message:

at java.lang.Thread.run(Thread.java:595)
17:59:43,913 ERROR [UsersRolesLoginModule] Failed to load users/passwords/role files
java.io.IOException: No properties file: users.properties or defaults: defaultUsers.properties found
at org.jboss.security.auth.spi.Util.loadProperties(Util.java:249)
at org.jboss.security.auth.spi.UsersRolesLoginModule.loadUsers(UsersRolesLoginModule.java:164)
at org.jboss.security.auth.spi.UsersRolesLoginModule.initialize(UsersRolesLoginModule.java:111)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at javax.security.auth.login.LoginContext.invoke(LoginContext.java:756)
at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
at org.jboss.security.plugins.JaasSecurityManager.defaultLogin(JaasSecurityManager.java:483)
at org.jboss.security.plugins.JaasSecurityManager.authenticate(JaasSecurityManager.java:425)
at org.jboss.security.plugins.JaasSecurityManager.isValid(JaasSecurityManager.java:251)
at org.jboss.web.tomcat.security.JBossSecurityMgrRealm.authenticate(JBossSecurityMgrRealm.java:230)
at org.apache.catalina.authenticator.BasicAuthenticator.authenticate(BasicAuthenticator.java:181)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:446)
at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:59)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:856)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.processConnection(Http11Protocol.java:744)
at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:527)
at org.apache.tomcat.util.net.MasterSlaveWorkerThread.run(MasterSlaveWorkerThread.java:112)
at java.lang.Thread.run(Thread.java:595)

any suggestions ?

Thanks

[Peter Johnson]

Well, you obviously did something wrong, but posting the error message doesn't help. Please post the configuration changes that you made, and provide the contents for the server/xxx/conf/props directory.

[chen young]

Configuration changes:

In /jboss-4.0.2/server/default/deploy/jmx-console.war/WEB-INF/web.xml enable the security-constraint tag:

<security-constraint>
     <web-resource-collection>
       <web-resource-name>HtmlAdaptor</web-resource-name>
       <description>An example security config that only allows users with the
         role JBossAdmin to access the HTML JMX console web application
       </description>
       <url-pattern>/*</url-pattern>
       <http-method>GET</http-method>
       <http-method>POST</http-method>
     </web-resource-collection>
     <auth-constraint>
       <role-name>JBossAdmin</role-name>
     </auth-constraint>
   </security-constraint>

<login-config>
      <auth-method>BASIC</auth-method>
      <realm-name>JBoss JMX Console</realm-name>
   </login-config>

<security-role>
      <role-name>JBossAdmin</role-name>
   </security-role>

In /jboss-4.0.2/server/default/deploy/jmx-console.war/WEB-INF/jboss-web.xml enable the security-domain tag

<security-domain>java:/jaas/jmx-console</security-domain>

In /jboss-4.0.2/server/default/deploy/management/console-mgr.sar/web-console.war/WEB-INF/web.xml enable the security-constraint tag:

<security-constraint>
   <web-resource-collection>
   <web-resource-name>HtmlAdaptor</web-resource-name>
   <description>An example security config that only allows users with the
   role JBossAdmin to access the HTML JMX console web application
   </description>
   <url-pattern>/*</url-pattern>
   <http-method>GET</http-method>
   <http-method>POST</http-method>
   </web-resource-collection>
   <auth-constraint>
   <role-name>JBossAdmin</role-name>
   </auth-constraint>
   </security-constraint>
  

   <login-config>
      <auth-method>BASIC</auth-method>
      <realm-name>JBoss WEB Console</realm-name>
   </login-config>

   <security-role>
      <role-name>JBossAdmin</role-name>
   </security-role>

In /jboss-4.0.2/server/default/deploy/management/console-mgr.sar/web-console.war/WEB-INF/jboss-web.xml enable the security-domain tag

<security-domain>java:/jaas/web-console</security-domain>

Copy /jboss-4.0.2/server/default/deploy/management/console-mgr.sar/web-console.war/WEB-INF/classes/web-console-roles.properties into /jboss-4.0.2/server/default/conf/props
Copy /jboss-4.0.2/server/default/deploy/management/console-mgr.sar/web-console.war/WEB-INF/classes/ web-console-users.properties into /jboss-4.0.2/server/default/conf/props

Change the names of:
/jboss-4.0.2/server/default/deploy/management/console-mgr.sar/web-console.war/WEB-INF/classes/web-console-roles.properties into web-console-roles.properties_OLD
/jboss-4.0.2/server/default/deploy/management/console-mgr.sar/web-console.war/WEB-INF/classes/web-console-users.properties into web-console-users.properties_OLD

Change password and user in (same user & password for jmx and web console):
/jboss-4.0.2/server/default/conf/props/jmx-console-users.properties
/jboss-4.0.2/server/default/conf/props/web-console-users.properties

In /jboss-4.0.2/server/default/conf/login-config.xml change the web-console module-option name:

<application-policy name = "jmx-console">
       <authentication>
          <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
             flag = "required">
           <module-option name="usersProperties">props/jmx-console-users.properties</module-option>
           <module-option name="rolesProperties">props/jmx-console-roles.properties</module-option>
          </login-module>
       </authentication>
    </application-policy>

<application-policy name = "web-console">
       <authentication>
          <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
             flag = "required">
             <module-option name="usersWebConsoleProperties">props/web-console-users.properties</module-option>
             <module-option name="rolesWebConsoleProperties">props/web-console-roles.properties</module-option>
          </login-module>
       </authentication>
    </application-policy>

/jboss-4.0.2/server/default/conf/props content:

-rwxrwxr-x   1 gti crs1025     101 Dec  7 15:46 jmx-console-roles.properties
-rwxrwxr-x   1 gti crs1025     86 Dec  7 16:27 jmx-console-users.properties
-rwxr-xr-x   1 gti crs1025      89 Dec  7 17:51 web-console-roles.properties
-rwxr-xr-x   1 gti crs1025 0      86 Dec  7 17:54 web-console-users.properties

Thanks

[Peter Johnson]

Please use the code tag, not the color tag, to mark source code. The cyan text was especially hard to read (actually, I could not read it at all).

Unless someone else jumps in with the solution I'll look at your settings tomorrow - it's been a loooooong day and my brain has gone on strike....

[Jaikiran Pai]

The "web-console" login module configuration in login-config.xml looks wrong:

<application-policy name = "web-console">
       <authentication>
          <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
             flag = "required">
             <module-option name="usersWebConsoleProperties">props/web-console-users.properties</module-option>
             <module-option name="rolesWebConsoleProperties">props/web-console-roles.properties</module-option>
...

The property names should be usersProperties and rolesProperties and not usersWebConsoleProperties and rolesWebConsoleProperties. Change it to:

<application-policy name = "web-console">
       <authentication>
          <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
             flag = "required">
             <module-option name="usersProperties">props/web-console-users.properties</module-option>
             <module-option name="rolesProperties">props/web-console-roles.properties</module-option>
 ...//rest of it

[chen young]

Hi,

Sorry for the color mark tag
anyway I try to use usersProperties and usersWebConsoleProperties but still its didn't work.
I notice that when I enable only one meaning web-console or jmx-console its working but when I try to enable both its not working.