JBoss not seeing my custom login module part 2

[stevecoh1]

For some reason, my replies are not posting to the other thread, but new threads seem to work. So I will make my reply here.

Thank you very much peterje. It has been very frustrating for me to be so helpless and I imagine I am overlooking something really simple. That said, the documentation could be much improved. Instead of threading the ejb and web-app material, each could be presented as a simple example chapter. If I had a simple end-to-end example of a simple web-app (no ejbs) using authentication, I would not be in this mess now.

Anyway, thanks for taking a look. Attached are the files you requested.

[petertje]

Steve,

In the previous post you mentioned that you put the proper entries in the login-congif.xml, but i don't see any custom application policies in the login-config.xml attachted to this message. In particular, you'll need an application policy named "access-panel", as that is the security domain you are refering to in the jboss-web.xml file.....

Hth,
Peter

[stevecoh1]

Yes, it is there. It is the second one from the bottom, right above "other".

[petertje]

You're right, i just overlooked. Maybe your previous comment is right, and i am blind.... ;-)

I don't see (yet) anything wrong. I'll have a closer look later today. For now, let me just check a few points:
- you are using a standard JBoss 3.x installation (with integrated jetty)
- when surfing to a page in the /restricted dir, you do get a login form and the actual login succeeds or seems to succeed. if so: which username/password? how can it be validated, is it using a usersrolesloginmodule, or..>?
- the problem you have is that your custom module is not called (and you'r confident about this ;-)
- did you try it with a restarted jboss? you know login results are cached by jboss and therefore tracing might fool you ....

Peter

[stevecoh1]

> I don't see (yet) anything wrong. I'll have a closer
> look later today. For now, let me just check a few
> points:
> - you are using a standard JBoss 3.x installation
> (with integrated jetty)

Yes.

> - when surfing to a page in the /restricted dir, you
> do get a login form and the actual login succeeds or
> seems to succeed. if so: which username/password? how
> can it be validated, is it using a
> usersrolesloginmodule, or..>?

No, the login fails and my error pages shows up.

> - the problem you have is that your custom module is
> not called (and you'r confident about this ;-)

Yes, this is the problem. As currently coded my custom login module could be expected to fail. It is not complete. However, none of the logging messages associated with failure appear. And, as I said in an earlier message when I changed the access-panel domain to use one of your pre-built authenticators, it failed in exactly the same way, with exactly the same log message.

> - did you try it with a restarted jboss? you know
> login results are cached by jboss and therefore
> tracing might fool you ....

Yes, I restarted it several times. That did not make any difference.

Steve

[petertje]

From your web.xml, realm-name is missing (as part of the login-config). According to the dtd it is optional, but if i leave it out, i get an http error 500 (jboss 3.0.3)

[petertje]

if it still does not work, please provide me with the exact jboss version you are using, and copy of (the relevant part of) the log.

[stevecoh1]

I noticed that but I did not know what to put in for the realm name - also the DTD comments say that realm-name is only needed for BASIC method logins, not FORM method logins. I am willing to try it, but what realm-name should I use? Does it have to match up with some other name in some other file?

[petertje]

> I noticed that but I did not know what to put in for
> the realm name - also the DTD comments say that
> realm-name is only needed for BASIC method logins,
> not FORM method logins. I am willing to try it, but
> what realm-name should I use? Does it have to match
> up with some other name in some other file?

no, as far as i know there are no restrictions whatsoever.

[stevecoh1]

All right. I have added a realm-name to web.xml. I have also modified login-config.xml to point to a new Custom logging module that I have written that breaks it all down to the barest essentials - it either always succeeds or always fails depending on the config parameters. All methods are supposed to write to the log, regardless. At present, it is configured to always fail. It throws no excpetions.

None of this has made any difference. No logging messages are emitted from my module. I am now 100% convinced my module is never being seen.

I have attached all relevant files including the log.

Where to go from here? Is there any way to see within the Security Manager to see what it thinks is going on?

Where should my login module live? Right now it lives in a jar in <jboss-home>/server/default/lib (this is deployed on my default server.

I don't know what else to try.

[stevecoh1]

I DID attach all the relevant files I referred to in my previous post but either my browser or your forum application ate them. Let's try again.

[stevecoh1]

Can anyone tell me where, if anywhere in the JMX console I might go to find anything useful? None of the entries under jboss.security tell me what I want to know.

[stevecoh1]

Oh, in case you haven't been able to figure it out from the log, this is on jboss-3.0.6. The platform it is deployed on is SuSE Linux 8.0 (where I built JBoss from source). The java version is

Java(TM) 2 Runtime Environment, Standard Edition (build 1.3.1_05-b02)

[stevecoh1]

> The java version is
>
> Java(TM) 2 Runtime Environment, Standard Edition
> (build 1.3.1_05-b02)

Could this be the problem? Is there anything special I must do to use jaas in jboss with jdk-1.3???

[stevecoh1]

Oops, was using a bad login-config.xml. However, fixing this and restarting jboss did not solve the problem. Corrected login-config.xml attached.