2 Replies Latest reply on Apr 7, 2015 12:38 AM by pradyumna13

    Accessing application with 'localhost' has problem when 'public' interface is configured for <any-address/> in wildfly

    pradyumna13
    pradyumna13 Mar 27, 2015 12:32 AM

      This is bugging me for last few days, I felt sharing here would help really. Let me directly jump into details, appreciate any response.

       

       

      Environemt Details: Wildfly-8.2.0.Final + Picketlink 2.7.0.CR2

       

       

      Coping the configuration file details below:

       

       

      Windfly Standalone.xml few sections::  please note , we have supplied idp.url, app.url with specific IP.

       

       

      <system-properties>

              <property name="org.apache.catalina.connector.Request.USE_PRINCIPAL_FROM_SESSION" value="false"/>

              <property name="org.apache.catalina.authenticator.AuthenticatorBase.CHANGE_SESSIONID_ON_AUTH" value="true"/>

              <property name="hibernate.config" value="apollo.cfg.xml"/>

              <property name="hibernate.udt.config" value="userdefined.cfg.xml"/>

              <property name="hibernate.standalone.config" value="apollo_standalone.cfg.xml"/>

              <property name="jboss.server.home.dir" value="jboss.server.base.dir"/>

              <property name="javax.net.ssl.trustStore" value="C:\jboss\wildfly-8.2.0\wildfly-8.2.0.Final\configuration\icp.keystore"/>

              <property name="javax.net.ssl.trustStorePassword" value="ingenix1"/>

              <property name="idp.url" value="http://192.168.1.101:8080/idp/"/>

              <property name="app.url" value="http://192.168.1.101:8080/ices/app/"/>      

          </system-properties>

       

       

      <subsystem xmlns="urn:jboss:domain:undertow:1.2"> // under wildfly modules the corresponding jar version is 1.1.0.Final except 'jsp' which is 'jastow-1.0.0.Final'

                  <buffer-cache name="default"/>

                  <server name="default-server">

                      <http-listener name="default" socket-binding="http" max-post-size="100000000" no-request-timeout="1800000"/>

                      <host name="default-host" alias="localhost">

                          <location name="/" handler="welcome-content"/>

                          <filter-ref name="server-header"/>

                          <filter-ref name="x-powered-by-header"/>

                      </host>

                  </server>

                  <servlet-container name="default">

                      <jsp-config/>

                  </servlet-container>

                  <handlers>

                      <file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>

                  </handlers>

                  <filters>

                      <response-header name="server-header" header-name="Server" header-value="WildFly/8"/>

                      <response-header name="x-powered-by-header" header-name="X-Powered-By" header-value="Undertow/1"/>

                  </filters>

              </subsystem>

       

       

                <security-domain name="idp" >

                          <authentication>

                              <login-module code="Database" flag="required">

                                  <module-option name="dsJndiName" value="......"/>

                                  <module-option name="principalsQuery" value="......'"/>

                                  <module-option name="rolesQuery" value=........"/>

                                  <module-option name="hashAlgorithm" value="SHA-256"/>

                                  <module-option name="hashEncoding" value="base64"/>

                              </login-module>

                          </authentication>

                      </security-domain>

                      <security-domain name="sp" cache-type="default">

                          <authentication>

                              <login-module code="org.picketlink.identity.federation.bindings.wildfly.SAML2LoginModule" flag="required"/>

                          </authentication>

                      </security-domain>

       

       

      <interfaces>

              <interface name="management">

                  <inet-address value="${jboss.bind.address.management:127.0.0.1}"/>

              </interface>

              <interface name="public">

                  <any-address/>

              </interface>

              <interface name="unsecure">

                  <any-address/>

              </interface>

          </interfaces>

       

       

      IDP Picketlink.xml:

       

       

      <PicketLink xmlns="urn:picketlink:identity-federation:config:2.1">

        <PicketLinkIDP xmlns="urn:picketlink:identity-federation:config:2.1"

                         AttributeManager="org.picketlink.identity.federation.bindings.wildfly.idp.UndertowAttributeManager"

                         RoleGenerator="org.picketlink.identity.federation.bindings.wildfly.idp.UndertowRoleGenerator">

        <IdentityURL>${idp.url::http://localhost:8080/idp/}</IdentityURL>

        <Trust>

        <Domains>localhost,jboss.com,jboss.org,amazonaws.com</Domains>

        </Trust>

        </PicketLinkIDP>

        <Handlers xmlns="urn:picketlink:identity-federation:handler:config:2.1">

            <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2LogOutHandler"/>

            <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler"/>

            <Handler class="org.picketlink.identity.federation.web.handlers.saml2.RolesGenerationHandler"/>

            <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2AttributeHandler">

              <Option Key="ATTRIBUTE_CHOOSE_FRIENDLY_NAME" Value="true"/>

            </Handler>

        </Handlers>

        <!--

        The configuration bellow defines a token timeout and a clock skew. Both configurations will be used during the SAML Assertion creation.

        This configuration is optional. It is defined only to show you how to set the token timeout and clock skew configuration.

        <PicketLinkSTS xmlns="urn:picketlink:identity-federation:config:1.0" TokenTimeout="5000" ClockSkew="0">

        <TokenProviders>

        <TokenProvider

        ProviderClass="org.picketlink.identity.federation.core.saml.v1.providers.SAML11AssertionTokenProvider"

        TokenType="urn:oasis:names:tc:SAML:1.0:assertion"

        TokenElement="Assertion" TokenElementNS="urn:oasis:names:tc:SAML:1.0:assertion" />

        <TokenProvider

        ProviderClass="org.picketlink.identity.federation.core.saml.v2.providers.SAML20AssertionTokenProvider"

        TokenType="urn:oasis:names:tc:SAML:2.0:assertion"

        TokenElement="Assertion" TokenElementNS="urn:oasis:names:tc:SAML:2.0:assertion" />

        </TokenProviders>

        </PicketLinkSTS>

           -->

       

       

      </PicketLink>

       

       

      IDP jboss-web.xml::

       

       

      <jboss-web>

        <security-domain>idp</security-domain>

        <context-root>idp</context-root>

      </jboss-web>

       

       

      we have IDPFilter configured

       

       

      SP Picketlink.xml :

       

       

      <PicketLink xmlns="urn:picketlink:identity-federation:config:2.1">

        <PicketLinkSP xmlns="urn:picketlink:identity-federation:config:2.1"

        ServerEnvironment="tomcat" BindingType="REDIRECT" RelayState="someURL">

        <IdentityURL>${idp.url::http://localhost:8080/idp/}</IdentityURL>

          <ServiceURL>${app.url::http://localhost:8080/ices/app/}</ServiceURL>

        </PicketLinkSP>

        <Handlers xmlns="urn:picketlink:identity-federation:handler:config:2.1">

          <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2LogOutHandler"/>

         

          <Handler class="com.ingenix.sso.handlers.SAML2ICPAuthenticationHandler"/> //we have our own AuthenticationHandler but doing nothing. The problem is present even with default handler//

        

           <!--

          <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler"/>

          -->

          <Handler class="org.picketlink.identity.federation.web.handlers.saml2.RolesGenerationHandler"/>

        </Handlers>

      </PicketLink>

       

       

      SP jboss-web.xml::

       

       

      <?xml version="1.0" encoding="UTF-8"?>

      <jboss-web>

        <security-domain>sp</security-domain>

        <context-root>ices/app</context-root>

      </jboss-web>

       

       

      Problem:: when I access with http://192.168.1.101:8080/ices/app everything is working fine login page is displayed, when i give credentials user is authenticated and application main screen is displayed.The url that appears in the browser is  "http://192.168.1.101:8080/ices/app" .But when I access with http://localhost:8080/ices/app login page is displayed. After giving proper credentials a white screen is displayed wih url in the browser as"http://192.168.1.101:8080/ices/app/". Observe the trailing '/'. If I remove that slash and press enter, then our main screen is displayed.

       

       

      Please let me know if need more details.

      • 374 Views
      • Tags: