GeeCON Prague 2014*
The moose likes JBoss/WildFly and the fly likes Authorization issue while implementing login module with DatabaseServerLoginModule Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login


JavaRanch » Java Forums » Products » JBoss/WildFly
Bookmark "Authorization issue while implementing login module with DatabaseServerLoginModule" Watch "Authorization issue while implementing login module with DatabaseServerLoginModule" New topic
Author

Authorization issue while implementing login module with DatabaseServerLoginModule

Siddhesh Deodhar
Ranch Hand

Joined: Mar 05, 2009
Posts: 118
Hi all
I am trying to implement form based authentication using DatabaseServerLoginModule using jboss 6.0
By referring guides and several tutorials I implemented and configured it. My application is working till authentication phase.
Authorization fails giving following errors in logs. Here are my logs



Here is my Databse called book having following structure


values of "PrincipalID" and "Password" are "sidd" and "pass".
values "PrincipalID" "Role" "RoleGroup" are "sidd" "WebAppUser" "WebAppUser"

My web.xml is as follows



login-config.xml has following entry



jboss-web.xml has folliwng


Even if I remove
<authorization>
<policy-module code="org.jboss.security.authorization.modules.DelegatingAuthorizationModule" flag="required"/>
</authorization>
from login-config.xml, I get the same error.

As per the logs, user "sidd" is getting authenticated successfully. But on GUI i see

HTTP Status 403 - Access to the requested resource has been denied
type Status report
message Access to the requested resource has been denied
description Access to the specified resource (Access to the requested resource has been denied) has been forbidden.

Am i missing on any flag or any configuration ?


Good, Better, Best, Don't take rest until, Good becomes Better, and Better becomes Best.
Sidd : (SCJP 6 [90%] )
Siddhesh Deodhar
Ranch Hand

Joined: Mar 05, 2009
Posts: 118
After analyzing about the status code I learn t that Tomact will return such message if proper role is not getting retrieved from the database.
Considering I have made mistake somewhere(might be a simple spelling mistake too) I gave one more try by trying everything from scratch.

Login module is working fine.

# 11:18:53,272 TRACE [org.jboss.security.plugins.authorization.JBossAuthorizationC
# ontext] Control flag for entryrg.jboss.security.authorization.config.Authoriza
# tionModuleEntry{org.jboss.security.authorization.modules.DelegatingAuthorization
# Module:{}REQUIRED}is:[REQUIRED]
# 11:18:53,287 TRACE [org.jboss.security.SecurityRolesAssociation] Setting threadl
# ocal:null

I guess the above once are just trace messages and nothing to be worried about.

If you want user to land up in a different page to tell user that he has not having required role then you can specify separate page redirection as follows

<error-page>
<error-code>403</error-code>
<location>MyCustomPage.jsp</location>
</error-page>
 
GeeCON Prague 2014
 
subject: Authorization issue while implementing login module with DatabaseServerLoginModule