JBoss SSO: App with multiple style sheets/javascript files c

[waltbarrow]

Hello,

I could use some help with a problem I have discovered with JBoss-SSO.

I am using JBoss-SSO version 1.0CR1 and I am running a JSF application, using JASS, form-based security, which loads multiple CSS and JAVASCRIPT files for each page displayed. I use an IE-6.0 browser and am urunning JBoss locally on my Windows XP machine.

The problem is that when I have SSO configured and I try to log into the application, invariably one of the CSS or JAVASCRIPT files do not get loaded properly.

I build the SSO JAR and SAR files from scratch using the SSO code, so I am able to instrument the code with log statements to see what is happening. It appears that after form-authentication, there follow multiple requests from the browser to load the CSS and JAVASCRIPT files. Unfortunately, these requests only have the authenticated Principal in them and, even though SSO has generated the SSO_TOKEN, these requests do not contain it.

I presume that IE has sent a batch of requests off to the server while trying to load the first page of the application.

What I notice is that the first CSS request causes the SSO_TOKEN to be generated and monitoring of the SSO session to start. When the second CSS request arrives, since it does not contain the SSO_TOKEN and the SSO session thinks monitoring is active, the code performs a forced-logout, essentially throwing away the CSS request.

The next request, which contains the authenticated Principal, seems to work and the cycle starts over, again. When it's all done, I'm not sure of the state of the application from a security point-of-view.

I have included a snippet of the log file showing the sequence of events as they happened. Unfortunately, some of the events overlap in time and log4j jumbles the output a bit.

Is this a problem with the design of the SSO code or am I missing something? Any help anyone can give me will be greatly appreciated.

Thanks!

Walt Barrow
[e-mail]


Log snippet:

DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/faces/index.jsp
DEBUG [org.jboss.security.valve.SSOSession] ********** Creating new SSOSession
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: true
DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: null
DEBUG [org.jboss.security.valve.SSOAutoLogout] Invoking next valve (SSOTokenManager)
DEBUG [org.jboss.security.valve.SSOTokenManager] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOTokenManager] SSOToken found: false
DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookieFound: true
DEBUG [org.jboss.security.valve.SSOTokenManager] Invoking next valve (SSOAutoLogin)
DEBUG [org.jboss.security.valve.SSOAutoLogin] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOAutoLogin] ********** ssoToken is invalid
DEBUG [org.jboss.security.valve.SSOAutoLogin] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOTokenManager] Did NOT find principal
DEBUG [org.jboss.security.valve.SSOTokenManager] Extracting domain from serverName: test.l3database.com
DEBUG [org.jboss.security.valve.SSOTokenManager] Domain found is: .l3database.com
DEBUG [org.jboss.security.valve.SSOTokenManager] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/css/schemePDM.css
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: true
DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: null
DEBUG [org.jboss.security.valve.SSOAutoLogout] Invoking next valve (SSOTokenManager)
DEBUG [org.jboss.security.valve.SSOTokenManager] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOTokenManager] SSOToken found: true
DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookieFound: false
DEBUG [org.jboss.security.valve.SSOTokenManager] Invoking next valve (SSOAutoLogin)
DEBUG [org.jboss.security.valve.SSOAutoLogin] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOAutoLogin] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOTokenManager] Did NOT find principal
DEBUG [org.jboss.security.valve.SSOTokenManager] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/images/Cogs_background.gif
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: true
DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: null
DEBUG [org.jboss.security.valve.SSOAutoLogout] Invoking next valve (SSOTokenManager)
DEBUG [org.jboss.security.valve.SSOTokenManager] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOTokenManager] SSOToken found: true
DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookieFound: false
DEBUG [org.jboss.security.valve.SSOTokenManager] Invoking next valve (SSOAutoLogin)
DEBUG [org.jboss.security.valve.SSOAutoLogin] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOAutoLogin] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOTokenManager] Did NOT find principal
DEBUG [org.jboss.security.valve.SSOTokenManager] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/faces/j_security_check
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: true
DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: null
DEBUG [org.jboss.security.valve.SSOAutoLogout] Invoking next valve (SSOTokenManager)
DEBUG [org.jboss.security.valve.SSOTokenManager] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOTokenManager] SSOToken found: true
DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookieFound: false
DEBUG [org.jboss.security.valve.SSOTokenManager] Invoking next valve (SSOAutoLogin)
DEBUG [org.jboss.security.valve.SSOAutoLogin] --------------------------------------------------> invoke
INFO [com.itapps.common.sso.login.CustomLdapLoginModule] ********** calling super.login()
INFO [com.itapps.common.sso.login.CustomLdapLoginModule] ********** validatePassword called
INFO [com.itapps.common.sso.login.CustomLdapLoginModule] ********** calling super.validatePassword()
INFO [com.itapps.common.sso.login.CustomLdapLoginModule] ********** login was successful
INFO [com.itapps.common.sso.login.CustomLdapLoginProvider] ********** Reading identity
DEBUG [org.jboss.security.valve.SSOAutoLogin] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOTokenManager] Did NOT find principal
DEBUG [org.jboss.security.valve.SSOTokenManager] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/faces/index.jsp
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: true
DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: null
DEBUG [org.jboss.security.valve.SSOAutoLogout] Invoking next valve (SSOTokenManager)
DEBUG [org.jboss.security.valve.SSOTokenManager] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOTokenManager] SSOToken found: true
DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookieFound: false
DEBUG [org.jboss.security.valve.SSOTokenManager] Invoking next valve (SSOAutoLogin)
DEBUG [org.jboss.security.valve.SSOAutoLogin] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/css/schemePDM.css
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: true
DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: null
DEBUG [org.jboss.security.valve.SSOAutoLogout] Invoking next valve (SSOTokenManager)
DEBUG [org.jboss.security.valve.SSOTokenManager] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOTokenManager] SSOToken found: true
DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookieFound: false
DEBUG [org.jboss.security.valve.SSOTokenManager] Invoking next valve (SSOAutoLogin)
DEBUG [org.jboss.security.valve.SSOAutoLogin] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOAutoLogin] ********** setting principal on SSOSession
DEBUG [org.jboss.security.valve.SSOAutoLogin] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOTokenManager] Found principal
DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookie NOT found
DEBUG [org.jboss.security.valve.SSOTokenManager] Extracting domain from serverName: test.l3database.com
DEBUG [org.jboss.security.valve.SSOTokenManager] Domain found is: .l3database.com
DEBUG [org.jboss.security.valve.SSOTokenManager] ********** Creating SSOToken: token
DEBUG [org.jboss.security.valve.SSOSession] ?????????? setting monitor to true
DEBUG [org.jboss.security.valve.SSOTokenManager] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/css/menuComponent.css
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: true
DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: true
DEBUG [org.jboss.security.valve.SSOAutoLogout] ********** forced logout, user logged out in different partner site
DEBUG [org.jboss.security.valve.SSOAutoLogout] contextPath: /pdapp
DEBUG [org.jboss.security.valve.SSOAutoLogout] requestContext: /pdapp
DEBUG [org.jboss.security.valve.SSOAutoLogout] ********** performing signout: /pdapp/faces/logout.jsp?target=%2Fpdapp%2Fcss%2FmenuComponent.css
DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke(2)
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/css/dateTimeComponent.css
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: true
DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: null
DEBUG [org.jboss.security.valve.SSOAutoLogout] Invoking next valve (SSOTokenManager)
DEBUG [org.jboss.security.valve.SSOTokenManager] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOTokenManager] SSOToken found: true
DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookieFound: false
DEBUG [org.jboss.security.valve.SSOTokenManager] Invoking next valve (SSOAutoLogin)
DEBUG [org.jboss.security.valve.SSOAutoLogin] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOAutoLogin] ********** setting principal on SSOSession
DEBUG [org.jboss.security.valve.SSOAutoLogin] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOTokenManager] Found principal
DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookie NOT found
DEBUG [org.jboss.security.valve.SSOTokenManager] Extracting domain from serverName: test.l3database.com
DEBUG [org.jboss.security.valve.SSOTokenManager] Domain found is: .l3database.com
DEBUG [org.jboss.security.valve.SSOAutoLogin] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOTokenManager] Found principal
DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookie NOT found
DEBUG [org.jboss.security.valve.SSOTokenManager] Extracting domain from serverName: test.l3database.com
DEBUG [org.jboss.security.valve.SSOTokenManager] Domain found is: .l3database.com
DEBUG [org.jboss.security.valve.SSOTokenManager] ********** Creating SSOToken: token
DEBUG [org.jboss.security.valve.SSOSession] ?????????? setting monitor to true
DEBUG [org.jboss.security.valve.SSOTokenManager] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/javascript/menuComponent.js
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: true
DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: true
DEBUG [org.jboss.security.valve.SSOAutoLogout] ********** forced logout, user logged out in different partner site
DEBUG [org.jboss.security.valve.SSOAutoLogout] contextPath: /pdapp
DEBUG [org.jboss.security.valve.SSOAutoLogout] requestContext: /pdapp
DEBUG [org.jboss.security.valve.SSOAutoLogout] ********** performing signout: /pdapp/faces/logout.jsp?target=%2Fpdapp%2Fjavascript%2FmenuComponent.js
DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke(2)
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOTokenManager] ********** Creating SSOToken: token
DEBUG [org.jboss.security.valve.SSOSession] ?????????? setting monitor to true
DEBUG [org.jboss.security.valve.SSOTokenManager] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/css/print.css
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: true
DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: false
DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: true
DEBUG [org.jboss.security.valve.SSOAutoLogout] ********** forced logout, user logged out in different partner site
DEBUG [org.jboss.security.valve.SSOAutoLogout] contextPath: null
DEBUG [org.jboss.security.valve.SSOAutoLogout] requestContext: /pdapp
DEBUG [org.jboss.security.valve.SSOAutoLogout] Invoking next valve (SSOTokenManager)
DEBUG [org.jboss.security.valve.SSOTokenManager] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOTokenManager] SSOToken found: true
DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookieFound: false
DEBUG [org.jboss.security.valve.SSOTokenManager] Invoking next valve (SSOAutoLogin)
DEBUG [org.jboss.security.valve.SSOAutoLogin] --------------------------------------------------> invoke
DEBUG [org.jboss.security.valve.SSOAutoLogin] ********** setting principal on SSOSession
DEBUG [org.jboss.security.valve.SSOAutoLogin] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOTokenManager] Found principal
DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookie NOT found
DEBUG [org.jboss.security.valve.SSOTokenManager] Extracting domain from serverName: test.l3database.com
DEBUG [org.jboss.security.valve.SSOTokenManager] Domain found is: .l3database.com
DEBUG [org.jboss.security.valve.SSOTokenManager] ********** Creating SSOToken: token
DEBUG [org.jboss.security.valve.SSOSession] ?????????? setting monitor to true
DEBUG [org.jboss.security.valve.SSOTokenManager] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke
DEBUG [org.jboss.security.valve.SSOAutoLogout]
DEBUG [org.jboss.security.valve.SSOAutoLogout]

[salaboy21]

I think this issue is solved in the trunk code base...

[waltbarrow]

Thanks for the quick response!

I'm a bit new to this environment, so what do you mean by the "trunk code base"?

[salaboy21]

You download the binary distribution.. the trunk codebase is the source code that is continously changing.. you must download this code and then compile it and use it in your project.
This can be achive with:

svn co http://anonsvn.jboss.org/repos/jboss-sso/dev/trunk/

you must have SVN client installed.. you can look at my blog for instructions.. (and you can post comments) unfortunately my blog is in spanish.. but you can translate it with translate.google.com. My blog is:

http://salaboy.wordpress.com/category/jboss-sso/

[waltbarrow]

Also, I had a bug in my logging. In the log dump where you see "SSOToken found:" for SSOAutoLogout and SSOTokenManager, the value should be toggled. Sorry.

[waltbarrow]

Do you know when the next planned non-test release will be that fixes this problem? Our policy here is to use only officially released software for security-related functionality, so we cannot use development code.

Thanks!

Walt Barrow
[e-mail]

[aamonten]

The plan is release 1.0 GA at mid august.

thanks
Alejandro

[waltbarrow]

Thanks for the information.

Do you know if this new version will support SSL communication between Federation components? Our configuration requires SSL.

Thanks!

Walt Barrow

[aamonten]

Its already supporting SSL.

[waltbarrow]

You said that 1.0.GA would be out in mid-August and here it is mid-October. Do you have an updated release schedule? Also, do you know what version of Seam will incorporate SSO?

Thanks!

Walt Barrow

[aamonten]

we can't call it GA because of the lack of documentation, but the source code wont suffer any change, so just download the source and use it.
The seam integration has been delayed a couple of times by the seam team, maybe they can provide you a better answer for that question.