auth-method none? for a JBoss simple SSO using digital signature?

[Joan Pujol]

Hello,

I have made a simply SSO solution for us using digital signature in a parameter of the request (We recive simple request from a third party that we trust).

My LoginModule takes the request and validates if it trust the digital signature of the request. If it trusts, the login is Ok.
The problem that I have is that in the web.xml <auth-method> I have to put FORM,BASIC,DIGEST or CLIENT-CERT. There is somthing like none? Because I don't want any interaction with the user, and I don't need any info (only the request).

What I have know is a "working" solution with the problem that the user gets a BASIC auth dialog asking the password, what it's entered doesn't matter because the Loginmodule only looks at the request.

My question is there is something like auth-method NONE, or any workarround to don't ask any info to the user?�

A workarround that I have in mind, is use a nonprotected servlet in the app that manually puts the credentials. But, is that possible?

I've been reading at the docs of Jboss but I dont know.
I have:

    UsernamePasswordHandler handler = new UsernamePasswordHandler("none", "none");
    LoginContext lc = new LoginContext("xclinicportal", handler);
    lc.login();

The problem is that this is a local LoginContext, isn't it? How can I get the LoginContext that Jboss uses for the webapp?

A lot, lot, lot of thanks in advance, because this is a little nigthmare

[Jaikiran Pai]

My question is there is something like auth-method NONE, or any workarround to don't ask any info to the user?�

Let me tell you, i am not good at the security related stuff. But going by what you mention as a requirement, you are looking for programatic login instead of declarative login. In your case you need not mention the restrictions in the web.xml. You can have an unsecured servlet, where you can do the programatic login.

Now coming to your other question

The problem is that this is a local LoginContext, isn't it? How can I get the LoginContext that Jboss uses for the webapp?

There's a file in %JBOSS_HOME%/server/default/conf folder named login-config.xml where you mention your application policy:

The outline of the application-policy is:
<application-policy name="xclinicportal">
<authentication>
<login-module code="login.module1.class.name" flag="control_flag">
<module-option name = "option1-name">option1-value</module-option>
<module-option name = "option2-name">option2-value</module-option>
...
</login-module>

<login-module code="login.module2.class.name" flag="control_flag">
...
</login-module>
...
</authentication>
</application-policy>

You can then use this login module from the servlet through the code that you have already posted.

[Joan Pujol]

That's correct. A programatic login is ok for me. I can use a non protected server to to the task.

But the problem is that then I don't know how to put manually a credential in my jboss realm..... (That's a requirement for me).

I've been reading Jboss documentation but it's a little nigthmare.

Cheers,

[Joan Pujol]

Originally posted by Jaikiran Pai:


You can then use this login module from the servlet through the code that you have already posted.

Yes I can use the login module code. But then the credentials aren't put on the session.
I need to get the LoginContext that Jboss uses when I put restrictions in the apps to leave the credentials in the session.

Cheers,

[Jaikiran Pai]

But the problem is that then I don't know how to put manually a credential in my jboss realm..... (That's a requirement for me).

You mean, once you have logged in programatically, you want to pass the credentials forward? That can be done by adding the ClientLoginModule to your application policy that you configured in the login-config.xml. This might not make much sense unless you are able to you get the configurations right, first. Have you been able to add your application policy the the config file and use it in the servlet? If not, then i would start with this as a first step.

[Jaikiran Pai]

Originally posted by Jaikiran Pai:
That can be done by adding the ClientLoginModule to your application policy that you configured in the login-config.xml.

To know more about how to do this, look at Q3 at JBossSecurityFAQ

[Joan Pujol]

Originally posted by Jaikiran Pai:


You mean, once you have logged in programatically, you want to pass the credentials forward? That can be done by adding the ClientLoginModule to your application policy that you configured in the login-config.xml. This might not make much sense unless you are able to you get the configurations right, first. Have you been able to add your application policy the the config file and use it in the servlet? If not, then i would start with this as a first step.

Yes the login modules work OK, and my loginmodule succefully validates de user. But the credentials aren't propagated.
I tried to add the ClientLoginModule but it doesn't works for me. When I go to another app with the same realm there is no credential.

[Joan Pujol]

I have been investigating a little more an thats what I have:

    
DEBUG (MyLoginModule.java.java:98)     - login()
INFO  (MyLoginModule.java.java:151)     - User XXX ok with role YYY
TRACE (org.jboss.security.ClientLoginModule.ClientLoginModule.java:103)     - Security domain: MyDomain
TRACE (org.jboss.security.ClientLoginModule.ClientLoginModule.java:121)     - Enabling restore-login-identity mode
TRACE (org.jboss.security.ClientLoginModule.ClientLoginModule.java:130)     - Enabling useFirstPass mode
TRACE (org.jboss.security.ClientLoginModule.ClientLoginModule.java:139)     - Begin login
TRACE (org.jboss.security.ClientLoginModule.ClientLoginModule.java:223)     - commit, subject=Asunto:
Principal: ajalife
Principal: Roles(members:YYY)
 
TRACE (org.jboss.security.SecurityAssociation.SecurityAssociation.java:460)     - pushSubjectContext, subject=Asunto:
Principal: XXX
Principal: Roles(members:YYY)
 

This is the debug code I get just after lc.login in my servlet.

    try {
    UsernamePasswordHandler handler = new UsernamePasswordHandler("XXX", "XXX");
    LoginContext lc = new LoginContext("MyDomain", handler);
    lc.login();
    
    }catch(Exception e ) {
      e.printStackTrace();
    }   
 

The problem is that then when the servlet ends I had this stacktrace:

ApplicationFilterChain.internalDoFilter(ServletRequest, ServletResponse) line: 252
ApplicationFilterChain.doFilter(ServletRequest, ServletResponse) line: 173
ReplyHeaderFilter.doFilter(ServletRequest, ServletResponse, FilterChain) line: 96
ApplicationFilterChain.internalDoFilter(ServletRequest, ServletResponse) line: 202
ApplicationFilterChain.doFilter(ServletRequest, ServletResponse) line: 173
StandardWrapperValve.invoke(Request, Response) line: 213
StandardContextValve.invoke(Request, Response) line: 178
SecurityAssociationValve.invoke(Request, Response) line: 175
BasicAuthenticator(AuthenticatorBase).invoke(Request, Response) line: 432
JaccContextValve.invoke(Request, Response) line: 74
StandardHostValve.invoke(Request, Response) line: 126
ErrorReportValve.invoke(Request, Response) line: 105
CachedConnectionValve.invoke(Request, Response) line: 156
SingleSignOn.invoke(Request, Response) line: 392
StandardEngineValve.invoke(Request, Response) line: 107
CoyoteAdapter.service(Request, Response) line: 148
Http11Processor.process(InputStream, OutputStream) line: 869
Http11Protocol$JmxHttp11ConnectionHandler(Http11BaseProtocol$Http11ConnectionHandler).processConnection(TcpConnection, Object[]) line: 664
PoolTcpEndpoint.processSocket(Socket, TcpConnection, Object[]) line: 527
MasterSlaveWorkerThread.run() line: 112
ThreadWithAttributes(Thread).run() line: 595

And when the arrives at BasicAuthenticator I get:

popRunAsIdentity, runAs=null
 
and then:
 
2007-02-28 17:43:17,688 TRACE (org.jboss.security.SecurityAssociation.SecurityAssociation.java:555)     - clear, server=true

It looks as if the credential are deleted, aren't they?

The login-config.xml has:

    <application-policy name="MyDomain">
      <authentication>
       <login-module code="MyModule"
          flag = "required">
          <module-option name="password-stacking">useFirstPass</module-option>
       </login-module>
 
       <login-module code="org.jboss.security.ClientLoginModule" flag="required">
       <module-option name="password-stacking">useFirstPass</module-option>
       <module-option name="restore-login-identity">false</module-option>
       </login-module>
 
      </authentication>
    </application-policy> 
 

Someone can help in this nigthmare?�

[Mark Spritzler]

I have a question, should this thread go the Servlet forum or the JBoss forum?

It is not an EJB question.

Mark

[Jaikiran Pai]

Its specific to JBoss so JBoss forum would be right