JBoss 5.1.0 GA. FORM based authentication

[Jose Alvarez de Lara]

Hi,

I have been reading the post,

Failed to load users/passwords/role files

and I feel quite lost

I think that is the idea but I need it for a FORM based authentication.

This is the exception I get when I try to login,

06:44:10,343 ERROR [UsersRolesLoginModule] Failed to load users/passwords/role files
java.io.IOException: No properties file: users.properties or defaults: defaultUsers.properties found
at org.jboss.security.auth.spi.Util.loadProperties(Util.java:198)
at org.jboss.security.auth.spi.UsersRolesLoginModule.loadUsers(UsersRolesLoginModule.java:186)
at org.jboss.security.auth.spi.UsersRolesLoginModule.createUsers(UsersRolesLoginModule.java:200)
at org.jboss.security.auth.spi.UsersRolesLoginModule.initialize(UsersRolesLoginModule.java:127)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at javax.security.auth.login.LoginContext.invoke(LoginContext.java:756)
at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
at org.jboss.security.plugins.auth.JaasSecurityManagerBase.defaultLogin(JaasSecurityManagerBase.java:552)
at org.jboss.security.plugins.auth.JaasSecurityManagerBase.authenticate(JaasSecurityManagerBase.java:486)
at org.jboss.security.plugins.auth.JaasSecurityManagerBase.isValid(JaasSecurityManagerBase.java:365)
at org.jboss.security.plugins.JaasSecurityManager.isValid(JaasSecurityManager.java:160)
at org.jboss.web.tomcat.security.JBossWebRealm.authenticate(JBossWebRealm.java:384)
at org.apache.catalina.authenticator.FormAuthenticator.authenticate(FormAuthenticator.java:258)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:417)
at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:92)
at org.jboss.web.tomcat.security.SecurityContextEstablishmentValve.process(SecurityContextEstablishmentValve.java:126)
at org.jboss.web.tomcat.security.SecurityContextEstablishmentValve.invoke(SecurityContextEstablishmentValve.java:70)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:158)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:330)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:829)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:598)
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
at java.lang.Thread.run(Thread.java:595)

My LoginModule is as follows,

public class MyLoginModule implements LoginModule {

	private  boolean commitSucceeded = false;  
	private boolean succeeded = false;  
	   
	private User user;  
	private Set<Role> roles = new HashSet<Role>();  
	  
	protected Subject subject;  
	protected CallbackHandler callbackHandler;
	
	protected Map<String, ?> sharedState = new HashMap<String, Object>();    
	
    private String username;
    private char[] password;
    
    private UsertableController usertableController;
    private GrouptableController grouptableController;

    /**
     * Clears out password state.
     */
    public void clearPassword() {
        if (password != null) {
            for (int i = 0; i < password.length; i++)
                password[i] = ' ';
            password = null;
        }
    }

	public Subject getSubject() {
		return subject;
	}

	public void setSubject(Subject subject) {
		this.subject = subject;
	}

	public CallbackHandler getCallbackHandler() {
		return callbackHandler;
	}

	public void setCallbackHandler(CallbackHandler callbackHandler) {
		this.callbackHandler = callbackHandler;
	}
	
	@SuppressWarnings("unchecked")
	public void initialize(Subject subject, CallbackHandler callbackHandler,
			Map<String, ?> sharedState, Map<String, ?> options) {
		// TODO Auto-generated method stub
		System.err.println("Empezando");
		this.subject = subject;
		this.callbackHandler = callbackHandler;
		this.sharedState = sharedState;
		HashSet<Object> hs = new HashSet(this.subject.getPrivateCredentials());
		Iterator<Object> it = hs.iterator();
		while(it.hasNext()){
			PasswordCredential pc = (PasswordCredential)it.next();
			this.username = pc.getUserName();
			this.password = pc.getPassword();
			System.err.println(this.username);
			System.err.println(this.password.toString());
		}
	}
	
	public boolean login() throws LoginException {
		// TODO Auto-generated method stub
		try {
			getUsernamePassword();
		} catch (UnsupportedCallbackException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		}
		validaUsuario();
		
		String[] groups = new String[roles.size()];
		
		Iterator<Role> it = roles.iterator();
		int i = 0;
		while (it.hasNext()) {
			groups[i] = it.next().getName();
			i++;
		}
		//CTJDBCLoginModuleUser login = new CTJDBCLoginModuleUser("dukesbankRealm", username, groups);
		//sharedState.put("javax.security.auth.principal", user);
		//sharedState.put("javax.security.auth.roles", roles);

		return true;
	}
	
	public boolean commit() throws LoginException {
		// TODO Auto-generated method stub
		if (user != null && !subject.getPrincipals().contains(user)) {
			subject.getPrincipals().add(user);
		}
		if (roles != null) {
			Iterator<Role> it = roles.iterator();
			while (it.hasNext()) {
				Role role = new Role(it.next().getName());
				if (!subject.getPrincipals().contains(role)) {
					subject.getPrincipals().add(role);
				}
			}
		}	
		commitSucceeded = true;
		return true;
	}
	
	public boolean logout() throws LoginException {
		// TODO Auto-generated method stub
		subject.getPrincipals().removeAll(roles);
		subject.getPrincipals().remove(user);
		return true;
	}

	public boolean abort() throws LoginException {
		// TODO Auto-generated method stub
		if (!succeeded) {
			return false;
		} else if (succeeded && !commitSucceeded) {
			succeeded = false;
		} else {
			succeeded = false;
			logout();
		}

		this.subject = null;
		this.callbackHandler = null;
		this.sharedState = null;
		this.roles = new HashSet<Role>();

		return succeeded;
	}

	private void validaUsuario() throws LoginException {
		Usertable myUser = null;
		String pass = null;
		try {
			usertableController = (UsertableController)((new InitialContext()).lookup("java:global/dukesbank/dukesbank-ejb/UsertableControllerBean"));
			myUser = usertableController.getUser(username);
			if (myUser != null) {
				pass = myUser.getPassword();
			} else {
				succeeded = false;
				throw new LoginException("User not found.");
			}
		} catch (Exception e) {
			succeeded = false;
			throw new LoginException(e.getClass().getName() + ": " + e.getMessage());
		}
		
		if (passInformado.equals(pass)) {
			user = new User(loginInformado);
			recuperaRoles(myUser);
			Iterator<Role> it = roles.iterator();
			Set<String> userRoles = new HashSet<String>();
			while(it.hasNext()){
				String userRole = ((Role)it.next()).getName();
				userRoles.add(userRole);
			}
			user.setRoles(userRoles);
			return;
		} else {
			throw new LoginException("Invalid password.");
		}
	}

	public void recuperaRoles(Usertable user) throws LoginException {
		try {
			String username = user.getUsername();
			grouptableController = (GrouptableController)((new InitialContext()).lookup("java:global/dukesbank/dukesbank-ejb/GrouptableControllerBean"));
			List<Grouptable> list = grouptableController.findGroupByName(username);
			Iterator<Grouptable> it = list.iterator();
			while (it.hasNext()) {
				Grouptable role = it.next();
				if(role.getId().getUsername().equals(username)){
					roles.add(new Role(role.getId().getGroupname()));
				}
			}
		} catch (Exception e) {
			succeeded = false;
			throw new LoginException("Error while retrieving roles: " + e.getClass().getName() + ": " + e.getMessage());
		}
	}

	/**
	 * User.
	 */
	protected String loginInformado;
	/**
	 * Password.
	 */
	protected String passInformado;

	protected void getUsernamePassword() throws LoginException, UnsupportedCallbackException {
		if (callbackHandler == null)
			throw new LoginException("Error: no CallbackHandler available to garner authentication information from the user");

		Callback[] callbacks = new Callback[2];
		callbacks[0] = new NameCallback(username);
		callbacks[1] = new PasswordCallback(password.toString(), false);
		for (Callback callback : callbacks) {
		    if (callback instanceof NameCallback) {
		        ((NameCallback) callback).setName(username);
		        continue;
		    } else if (callback instanceof PasswordCallback) {
		        ((PasswordCallback) callback).setPassword((password != null)
		                ? password : null);
		        continue;
		    }
		}
		//callbackHandler.handle(callbacks);
		loginInformado = ((NameCallback) callbacks[0]).getName();
		char[] tmpPassword = ((PasswordCallback) callbacks[1]).getPassword();
		passInformado = new String(tmpPassword);
		((PasswordCallback) callbacks[1]).clearPassword();
	}
}

As you can see I use validaUsuario() y recuperaRoles() to get the user and role against the database (Oracle)
but it seems this is not enough. Really I need som properties files they has to be in the classpath.

In my <jboss>\server\default\conf I have the following entry at login-config.xml,

<application-policy name="other">
    <!-- A simple server login module, which can be used when the number
    of users is relatively small. It uses two properties files:
    users.properties, which holds users (key) and their password (value).
    roles.properties, which holds users (key) and a comma-separated list of
    their roles (value).
    The unauthenticatedIdentity property defines the name of the principal
    that will be used when a null username and password are presented as is
    the case for an unuathenticated web client or MDB. If you want to
    allow such users to be authenticated add the property, e.g.,
    unauthenticatedIdentity="nobody"
    -->
    <authentication>
      <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
        flag="required"/>
    </authentication>
  </application-policy>
  
  <application-policy name = "jbossmq">
  <authentication>
    <login-module code = "org.jboss.security.auth.spi.DatabaseServerLoginModule"
       flag = "required">
       <module-option name = "unauthenticatedIdentity">guest</module-option>
       <module-option name = "dsJndiName">java:/OracleDS</module-option>
       <module-option name = "principalsQuery">SELECT PASSWORD FROM USERTABLE WHERE USERNAME=?</module-option>
       <module-option name = "rolesQuery">SELECT GROUPNAME, 'Roles' FROM GROUPTABLE WHERE USERNAME=?</module-option>
    </login-module>
  </authentication>
</application-policy>

being above what I guess I need and below of it my configuration.

How is it? Please help.

Best Regards,
Jose

[Jaikiran Pai]

What does your jboss-web.xml contain? And where have you configured your custom login module (MyLoginModule) in the login-config.xml (I don't see it in the content you posted).

[Jose Alvarez de Lara]

Hello,

This is what I did.

I have placed in server/default/conf the config file dukesbank-jboss-beans.xml with content,

<?xml version="1.0" encoding="UTF-8"?>

<deployment xmlns="urn:jboss:bean-deployer:2.0">

<application-policy xmlns="urn:jboss:security-beans:1.0" name="web-test">
<authentication>
<login-module code = "org.jboss.security.auth.spi.UsersRolesLoginModule"
flag = "required">
<module-option name = "unauthenticatedIdentity">anonymous</module-option>
<module-option name="usersProperties">users.properties</module-option>
<module-option name="rolesProperties">roles.properties</module-option>
</login-module>
</authentication>
</application-policy>

<application-policy xmlns="urn:jboss:security-beans:1.0" name="ejb-test">
<authentication>
<login-module code = "org.jboss.security.auth.spi.UsersRolesLoginModule"
flag = "required">
<module-option name = "unauthenticatedIdentity">anonymous</module-option>
<module-option name="usersProperties">users.properties</module-option>
<module-option name="rolesProperties">roles.properties</module-option>
</login-module>
</authentication>
</application-policy>

</deployment>

In the same folder server/default/conf I have placed the users.properties and roles.properties files
and I have got to get login but your questions make me wonder this is not the way.

I have no jboss-web.xml and my web app works ok.

How do I have to do?

Please, trace me the steps I have to follow and let me try it by myself.

Thanking in advance,
Jose