Getting my web application to use the DatabaseServerLoginModule

[Mark E Hansen]

I'm trying to configure my J2EE web application to use the DatabaseServerLoginModule.
I'm following the instructions in the book: JBoss in Action, but I think I must be missing something, as the application continues to try to use the UsersRolesLoginModule instead.

I'm running JBoss AS 5.1.0.GA with JDK 1.6, and my web application contains HTML files as well as a Servlet.

First, I've created the security tables in a MySQL database, and have deployed a -ds.xml deployment descriptor for my database. Also, I've enabled the HTTPS connector (with a home-made certificate) so I can access the web application via https (on port 8443) - which is working.

I then added the following <application-policy> block element to the login-config.xml file in my server's conf directory:

  <application-policy name = "database-domain">
    <authentication>
      <login-module
	  code="org.jboss.security.auth.spi.DatabaseServerLoginModule"
	  flag = "required">
	<module-option name="dsJndiName">
	    java:/MySQLDS
	</module-option>
	<module-option name="principalsQuery">
	    SELECT Password FROM Principals WHERE PrincipalID=?
	</module-option>
	<module-option name="rolesQuery">
	    SELECT Role, RoleGroup FROM Roles WHERE PrincipalID=?
	</module-option>
      </login-module>
    </authentication>
  </application-policy>

Note that the policy name is database-domain

Next, I created a jboss-web.xml file in the web application's WEB-INF directory, which looks like this:

<!DOCTYPE jboss-web PUBLIC
   "-//JBoss//DTD Web Application 5.0//EN"
   "http://www.jboss.org/j2ee/dtd/jboss-web_5_0.dtd">
   
<jboss-web>
      <security-domain>java:/jaas/database-domain</security-domain>
</jboss-web>

Finally, I have the following web.xml file in my web application's WEB-INF directory:

<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" version="2.5"
 xmlns="http://java.sun.com/xml/ns/javaee"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
 <display-name>library-web</display-name>
 <servlet>
  <servlet-name>CreateUserServlet</servlet-name>
  <servlet-class>library.servlets.CreateUser</servlet-class>
 </servlet>
 <servlet-mapping>
  <servlet-name>CreateUserServlet</servlet-name>
  <url-pattern>/create_user</url-pattern>
 </servlet-mapping>
 <security-constraint>
  <web-resource-collection>
   <web-resource-name>Some Web Resource Name</web-resource-name>
   <url-pattern>/authorized/*</url-pattern>
   <http-method>GET</http-method>
   <http-method>POST</http-method>
  </web-resource-collection>
  <auth-constraint>
   <role-name>ADMIN</role-name>
  </auth-constraint>
  <user-data-constraint>
   <transport-guarantee>CONFIDENTIAL</transport-guarantee>
  </user-data-constraint>
 </security-constraint>
 <login-config>
  <auth-method>BASIC</auth-method>
  <realm-name>MEH</realm-name>
 </login-config>
 <security-role>
  <role-name>USER</role-name>
 </security-role>
 <security-role>
  <role-name>ADMIN</role-name>
 </security-role>
</web-app>

When I attempt to access the restricted page (/authroized/create_user.html) I am prompted for credentials, but when I enter them, the application server writes the following to the server.log file:

2009-12-30 17:40:11,529 TRACE [org.jboss.security.auth.spi.UsersRolesLoginModule] (http-127.0.0.1-8443-1) abort

2009-12-30 17:40:11,529 TRACE [org.jboss.security.plugins.auth.JaasSecurityManagerBase.database-domain] (http-127.0.0.1-8443-1) Login failure

javax.security.auth.login.LoginException: Missing users.properties file.

	at org.jboss.security.auth.spi.UsersRolesLoginModule.login(UsersRolesLoginModule.java:148)

	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

It seems the application is still configured to use the UsersRolesLoginModule, rather than the DatabaseServerLoginModule.

I must be missing a configuration someplace, but I can't tell where.

Can someone please point me in the right direction?

Thanks,

[Peter Johnson]

Try changing the rolesQuery to:

SELECT Role, 'Roles' FROM Roles WHERE PrincipalID=?

Other than that, I don't see anything obviously wrong.

Are the user and role queries going to the database? I'm wondering if a failure there is causing JBoss AS to revert to the user login module.

Also, try adding debug tracing to the login module and see if the server.log gives any more hints as to what is going on. To do this, add these lines to the server/xxx/conf/jboss-log4j.xml file:

<category name="org.jboss.security.auth">
  <priority value="DEBUG"/>
</category>

[Mark E Hansen]

Well, it looks like I did something silly. I made changes to the login-config.xml, but didn't restart the application server

After restarting the application server, it is working as expected.

Thanks, and I'm sorry for the false issue.