Dashboard 403 error

[lucboudreau]

I was working on making the portal CAS compliant and when I finally suceeded, it turns out that I changed some config option and now the dashboard page keeps answering with a 403 unauthorized error. I verified every portlet-instance.xml file and portal-object file but I don't remember where I tweaked it.

Here's a server log excerpt.

2007-08-27 10:21:27,505 DEBUG [org.apache.jk.server.JkCoyoteHandler] Invoke R( /portal/auth/dashboard) org.apache.coyote.Response@547c9a /portal/auth/dashboard

2007-08-27 10:21:27,505 DEBUG [org.apache.catalina.connector.CoyoteAdapter] Requested cookie session id is 3A0BF35C49C69D2B5A2ED7B741588E44

2007-08-27 10:21:27,505 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase] Security checking request GET /portal/auth/dashboard

2007-08-27 10:21:27,505 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase] We have cached auth type FORM for principal GenericPrincipal[SIM\boudrel(Authenticated,User,(...))]

2007-08-27 10:21:27,506 DEBUG [org.apache.catalina.realm.RealmBase] Checking constraint 'SecurityConstraint[Authenticated]' against GET /auth/dashboard --> true

2007-08-27 10:21:27,506 DEBUG [org.apache.catalina.realm.RealmBase] Checking constraint 'SecurityConstraint[Secure]' against GET /auth/dashboard --> false

2007-08-27 10:21:27,506 DEBUG [org.apache.catalina.realm.RealmBase] Checking constraint 'SecurityConstraint[Secure+Authenticated]' against GET /auth/dashboard --> false

2007-08-27 10:21:27,506 DEBUG [org.apache.catalina.realm.RealmBase] Checking constraint 'SecurityConstraint[Authenticated]' against GET /auth/dashboard --> true

2007-08-27 10:21:27,506 DEBUG [org.apache.catalina.realm.RealmBase] Checking constraint 'SecurityConstraint[Secure]' against GET /auth/dashboard --> false

2007-08-27 10:21:27,506 DEBUG [org.apache.catalina.realm.RealmBase] Checking constraint 'SecurityConstraint[Secure+Authenticated]' against GET /auth/dashboard --> false

2007-08-27 10:21:27,506 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase] Calling hasUserDataPermission()

2007-08-27 10:21:27,506 DEBUG [org.apache.catalina.realm.RealmBase] User dataconstraint has no restrictions

2007-08-27 10:21:27,506 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase] Calling authenticate()






2007-08-27 10:21:27,506 DEBUG [org.apache.catalina.authenticator.FormAuthenticator] Already authenticated 'SIM\boudrel'

2007-08-27 10:21:27,506 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase] Calling accessControl()

2007-08-27 10:21:27,506 DEBUG [org.apache.catalina.realm.RealmBase] Username SIM\boudrel has role Authenticated

2007-08-27 10:21:27,506 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase] Successfully passed all security constraints

2007-08-27 10:21:27,531 DEBUG [org.apache.jk.core.MsgContext] COMMIT

2007-08-27 10:21:27,531 DEBUG [org.apache.jk.common.JkInputStream] COMMIT sending headers org.apache.coyote.Response@547c9a === MimeHeaders ===Pragma = No-cacheCache-Control = no-cacheExpires = Wed, 31 Dec 1969 19:00:00 ESTX-Powered-By = Servlet 2.4; JBoss-4.0.5.GA (build: CVSTag=Branch_4_0 date=200610162339)/Tomcat-5.5

The response headers are these :

Date: Mon, 27 Aug 2007 14:34:44 GMT
Server: Apache/2.2.4 (Unix) mod_ssl/2.2.4 OpenSSL/0.9.8b DAV/2 mod_jk/1.2.23
Pragma: No-cache
Cache-Control: no-cache
Expires: Wed, 31 Dec 1969 19:00:00 EST
X-Powered-By: Servlet 2.4; JBoss-4.0.5.GA (build: CVSTag=Branch_4_0 date=200610162339)/Tomcat-5.5
Content-Length: 964
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html;charset=utf-8

403 Forbidden

[nm-156]

Try this:

http://www.jboss.com/index.html?module=bb&op=viewtopic&t=119733

[lucboudreau]

This is not the problem, since I'm only using a custom login module for CAS SSO and a SynchronizingModule to copy the users in the database.

[nm-156]

I corrected my problem by taking a step back. I commented out my custom login module so that my login-config.xml file resembled the original portal download configuration, and then I tested. The dashboard link worked again. Then, I added my custom LoginModule back into login-config until I found the ordering that worked.

Hope this helps.

[lucboudreau]

Do you mean that the IdentityLoginModule is NOT optional, and that even if I want to use my own login module, it has to be in the login chain before any other module ?

[nm-156]

No. I am just describing what worked for me, and I am trying to offer a possible debugging technique for anybody who is stuck on this error.

When you change the login-module settings back to those of the portal's default installation, does your dashboard link work again? If it does, you have narrowed the scope of where the problem might be. It's either in your login-module code (check the log for exceptions), or else it's in the configuration of the login modules.

[nm-156]

I found the piece that controls the dashboard link. Check here for solution:

http://jboss.org/index.html?module=bb&op=viewtopic&p=4090281#4090281

[bdaw]

http://jira.jboss.com/jira/browse/JBPORTAL-1779

Related bug is fixed for 2.6.3. You can check with sources from svn.

[jaasjaws]

Hi

I am trying to develop a Custom Login Module by extending AbstractServerLoginModule. I have implemented the necessary methods and the login() method returns a true or a false depending on the username/password provided.

But the problem is that the returned true/false is being undone by the JaasAuthenicationManager that is overwriting the login flag.

Did any one face the same problem. Any help is appreciated.

thanks