8 Replies Latest reply on Apr 26, 2006 12:06 AM by anil.saldhana

SSO Testsuite Failures

brian.stansberry Apr 7, 2006 12:35 AM

The SSO unit tests are failing on the test of security propagation to the EJB tier. Looks like something has changed in JBossSX whereby it's no longer sufficient to associate a SingleSignOnEntry's cached principal with the request; it is once again necessary to reauthenticate to the Realm using the cached username/password.

If I set the "requireReauthentication" flag on the SSO valve to true, the tests pass.

Following is the error log in the server when the call fails:

2006-04-06 21:32:45,640 ERROR [org.apache.catalina.core.ContainerBase.[jboss.web].[localhost].[/war2].[EJBServlet]] Servlet.service() for servlet EJBServlet threw exception
java.rmi.AccessException: SecurityException; nested exception is:
 javax.security.auth.login.FailedLoginException: Password Incorrect/Password Required
 at org.jboss.ejb.plugins.LogInterceptor.handleException(LogInterceptor.java:391)
 at org.jboss.ejb.plugins.LogInterceptor.invokeHome(LogInterceptor.java:139)
 at org.jboss.ejb.plugins.ProxyFactoryFinderInterceptor.invokeHome(ProxyFactoryFinderInterceptor.java:107)
 at org.jboss.ejb.SessionContainer.internalInvokeHome(SessionContainer.java:632)
 at org.jboss.ejb.Container.invoke(Container.java:948)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
 at java.lang.reflect.Method.invoke(Method.java:324)
 at org.jboss.mx.interceptor.ReflectedDispatcher.invoke(ReflectedDispatcher.java:155)
 at org.jboss.mx.server.Invocation.dispatch(Invocation.java:94)
 at org.jboss.mx.server.Invocation.invoke(Invocation.java:86)
 at org.jboss.mx.server.AbstractMBeanInvoker.invoke(AbstractMBeanInvoker.java:260)
 at org.jboss.mx.server.MBeanServerImpl.invoke(MBeanServerImpl.java:659)
 at org.jboss.invocation.local.LocalInvoker$MBeanServerAction.invoke(LocalInvoker.java:169)
 at org.jboss.invocation.local.LocalInvoker.invoke(LocalInvoker.java:118)
 at org.jboss.invocation.InvokerInterceptor.invokeLocal(InvokerInterceptor.java:209)
 at org.jboss.invocation.InvokerInterceptor.invoke(InvokerInterceptor.java:195)
 at org.jboss.proxy.TransactionInterceptor.invoke(TransactionInterceptor.java:61)
 at org.jboss.proxy.SecurityInterceptor.invoke(SecurityInterceptor.java:70)
 at org.jboss.proxy.ejb.HomeInterceptor.invoke(HomeInterceptor.java:184)
 at org.jboss.proxy.ClientContainer.invoke(ClientContainer.java:100)
 at $Proxy54.create(Unknown Source)
 at org.jboss.test.web.servlets.EJBServlet.processRequest(EJBServlet.java:61)
 at org.jboss.test.web.servlets.EJBServlet.doGet(EJBServlet.java:90)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:697)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:810)
 at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:252)
 at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
 at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)
 at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
 at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
 at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
 at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178)
 at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:174)
 at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:524)
 at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:74)
 at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
 at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
 at org.apache.catalina.authenticator.SingleSignOn.invoke(SingleSignOn.java:419)
 at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
 at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
 at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869)
 at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:664)
 at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:527)
 at org.apache.tomcat.util.net.MasterSlaveWorkerThread.run(MasterSlaveWorkerThread.java:112)
 at java.lang.Thread.run(Thread.java:534)
Caused by: javax.security.auth.login.FailedLoginException: Password Incorrect/Password Required
 at org.jboss.security.auth.spi.UsernamePasswordLoginModule.login(UsernamePasswordLoginModule.java:213)
 at org.jboss.security.auth.spi.UsersRolesLoginModule.login(UsersRolesLoginModule.java:152)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
 at java.lang.reflect.Method.invoke(Method.java:324)
 at javax.security.auth.login.LoginContext.invoke(LoginContext.java:675)
 at javax.security.auth.login.LoginContext.access$000(LoginContext.java:129)
 at javax.security.auth.login.LoginContext$4.run(LoginContext.java:610)
 at java.security.AccessController.doPrivileged(Native Method)
 at javax.security.auth.login.LoginContext.invokeModule(LoginContext.java:607)
 at javax.security.auth.login.LoginContext.login(LoginContext.java:534)
 at org.jboss.security.plugins.JaasSecurityManager.defaultLogin(JaasSecurityManager.java:601)
 at org.jboss.security.plugins.JaasSecurityManager.authenticate(JaasSecurityManager.java:535)
 at org.jboss.security.plugins.JaasSecurityManager.isValid(JaasSecurityManager.java:344)
 at org.jboss.ejb.plugins.SecurityInterceptor.checkSecurityAssociation(SecurityInterceptor.java:211)
 at org.jboss.ejb.plugins.SecurityInterceptor.invokeHome(SecurityInterceptor.java:135)
 at org.jboss.ejb.plugins.LogInterceptor.invokeHome(LogInterceptor.java:135)
 ... 45 more

1. Re: SSO Testsuite Failures

starksm64 Apr 7, 2006 12:48 AM (in response to brian.stansberry)

The last change was to throw away the JBossSecurityMgrRealm principal to roles cache in favor of the request GenericPrincipal as it has the correct user principal. Create a jira issue if you want me to look at it.
Actions
2. Re: SSO Testsuite Failures

anil.saldhana Apr 7, 2006 12:53 AM (in response to brian.stansberry)

http://jira.jboss.com/jira/browse/JBAS-3043

What about this, Scott? You think this may be related.
Actions
3. Re: SSO Testsuite Failures

starksm64 Apr 7, 2006 12:58 AM (in response to brian.stansberry)

That is the change I'm talking about.
Actions
4. Re: SSO Testsuite Failures

brian.stansberry Apr 7, 2006 1:07 AM (in response to brian.stansberry)

http://jira.jboss.com/jira/browse/JBAS-3077
Actions
5. Re: SSO Testsuite Failures

anil.saldhana Apr 25, 2006 6:39 PM (in response to brian.stansberry)

The SSO tests seem to be failing because SecurityAssociation.principal and SA.credential are not getting set (the ejb proxies depend on them). I have to investigate further.
Actions
6. Re: SSO Testsuite Failures

anil.saldhana Apr 25, 2006 8:57 PM (in response to brian.stansberry)

The reason for the failure is due to this change:
http://tinyurl.com/jbjt4

This change was done for http://jira.jboss.com/jira/browse/JBAS-2820

The ejb proxies depend on the principal and credential in the SecurityAssociation. Since they are not set, after the first successful authentication, by the web layer, the EJB layer is not allowing thru.

I think the ejb proxies should rather peek into the subject context set in the SA rather than relying on the legacy principal/credential in the SA.
Actions

7. Re: SSO Testsuite Failures

anil.saldhana Apr 25, 2006 10:03 PM (in response to brian.stansberry)

Further insight:
In the JaccContextValve:

public void invoke(Request request, Response response)
 throws IOException, ServletException
 {
 activeCS.set(warCS);
 HttpServletRequest httpRequest = (HttpServletRequest) request.getRequest();

 try
 {
 // Set the JACC context id
 PolicyContext.setContextID(contextID);
 // Set the JACC HttpServletRequest PolicyContextHandler data
 HttpServletRequestPolicyContextHandler.setRequest(httpRequest);
 // Perform the request
 getNext().invoke(request, response);
 }
 finally
 {
 SecurityAssociationActions.clear();
 activeCS.set(null);
 }

After the request to the first war completes, the SA stack is cleared in the finally block.

When the request goes to the second war, the SSO valve allows access to the servlet. But when the servlet makes a call to an ejb, the ejb proxy has to deal with an empty SA.

Need to validate SecurityAssociationValve.

8. Re: SSO Testsuite Failures

anil.saldhana Apr 26, 2006 12:06 AM (in response to brian.stansberry)

Atleast the regular SSO test now passes. This happened due to solving the following JIRA issue:
http://jira.jboss.com/jira/browse/JBAS-3152 and updating the SecurityAssociationValve to use request.getPrincipal rather than request.getUserPrincipal (as part of JBAS-3043)

To solve the Clustered SSO tests, I will appreciate if Brian could comment on why there is a NoClassDef error on FieldClusteredSession while installing the JBossCacheManager as detailed in this forum post:
http://www.jboss.com/index.html?module=bb&op=viewtopic&t=81747

Unless the JBossCacheManager installs, I cannot solve the clustertedSSo test. :(
Actions

Go to original post