LoginModule dont execute everytime

[Gabriel Ozeas]

Hi, i have a problem about the login modules.

When i try to login with a user identity that is already login in another computer, the login modules are not executed. Why?
Is anything from the specification or jboss or i'm doing something wrong?


Thanks.

[Peter Johnson]

Which version of JBoss AS? JDK and OS versions might help also.

What login module are you using?

What do you mean by "the login modules are not executed"? What is the behavior that you expected but did not see?

[Gabriel Ozeas]

Hi Peter,

Thanks for the help.

I'm using jboss 5.1 with JDK 1.6 in a Ubuntu 10.10.

The role history is that i'm trying to make a unique login per user, denying that two users enter with the same account simutaneously in a portal (eXo Platform).

So for that I wrote a login module that do this job. And i'm testing with a configuration that includes 2 login modules. First the UsersRolesLoginModule and second my login module.

Ok it is working when the user enter for the first time. But when i try to login in another machine with the same account, the JBoss might think "Hey this guy is already loaded, what a hell, i won't will execute the login modules again." And all the 2 login modules don't display any log information like if they didnt be executed.

Thanks again
Bye bye

[Peter Johnson]

Sounds like JBoss AS is caching the user's credentials after the first time it looks up the user. I don't see any configuration option that governs this. You might try turning logging up to the TRACE level for the login module code. You can do that by adding this to the jboss-log4j.xml file:

   <category name="org.jboss.security">
      <priority value="TRACE"/>
   </category>

Perhaps the differences in the log file between first and second login will point you to some code to look at. If you are lucky, you'll see that the behavior is governed by an option which you can change. If you are not lucky, you will have to modify the code.

[Gabriel Ozeas]

Hi Peter,

Thanks for your advice. I solved the problem, thanks for the help. Apparently as you told me the problem is that the JBoss was making cache from the login. So i changed the jboss-service.xml to not make cache from it.

<!-- 
      DefaultCacheTimeout: Specifies the default timed cache policy timeout
      in seconds.
      If you want to disable caching of security credentials, set this to 0 to
      force authentication to occur every time. This has no affect if the
      AuthenticationCacheJndiName has been changed from the default value.
-->
<attribute name="DefaultCacheTimeout">0</attribute>

And it works. But not for my case, because the login module execute the logout before the login everytime the user attempt to enter again in the other browser.

Solution for my case:

Create a filter that manages the users online that are keeping in a set in the application scope. Use a session listener to remove the user from the set.

Other problem:

The solution must be clustered, so the application scope is not distributed.

Solution:

Maybe i need to access the JBoss Cache from the JBoss to keep the set.

How to do that: I dont know, some advice? ehhe