6 Replies Latest reply on Dec 16, 2015 1:19 AM by arnab_ghosh

Wildfly 8.2.Final: JBAS011843:Failed instantiate InitialContextFactory com.sun.jndi.ldap.LdapCtxFactory

arnab_ghosh Dec 10, 2015 3:47 PM

Hi All,

I am migrating our enterprise application from JBoss EAP 5.1.2 to Wildfly 8.2.Final. Our application uses LDAP for login authentication. After moving to Wildfly, when the authentication fails for a incorrect credential we are getting the below exception. The root cause which is the authentication exception is getting wrapped by javax.naming.NamingException: JBAS011843: Failed instantiate InitialContextFactory com.sun.jndi.ldap.LdapCtxFactory.

Please help.

2015-12-10 20:13:46,445 ERROR [com.sonymusic.aoma.common.SecurityManager] (default task-24) Exception occured while authenticating: javax.naming.NamingException: JBAS011843: Failed instantiate Init

ialContextFactory com.sun.jndi.ldap.LdapCtxFactory from classloader ModuleClassLoader for Module "deployment.aoma.ear.aoma.war:main" from Service Module Loader [Root exception is javax.naming.Authe

nticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 775, v1db1^@]]

at org.jboss.as.naming.InitialContext.getDefaultInitCtx(InitialContext.java:116)

at org.jboss.as.naming.InitialContext.init(InitialContext.java:99)

at javax.naming.ldap.InitialLdapContext.<init>(InitialLdapContext.java:154) [rt.jar:1.8.0_40]

at org.jboss.as.naming.InitialContext.<init>(InitialContext.java:90)

at org.jboss.as.naming.InitialContextFactory.getInitialContext(InitialContextFactory.java:44)

at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684) [rt.jar:1.8.0_40]

at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:313) [rt.jar:1.8.0_40]

at javax.naming.InitialContext.init(InitialContext.java:244) [rt.jar:1.8.0_40]

at javax.naming.ldap.InitialLdapContext.<init>(InitialLdapContext.java:154) [rt.jar:1.8.0_40]

at com.sonymusic.aoma.common.security.ActiveDirectoryAccess.bind(ActiveDirectoryAccess.java:231) [aoma.jar:]

at com.sonymusic.aoma.common.SecurityManager.getAOMASecurity(SecurityManager.java:113) [aoma.jar:]

at com.sonymusic.aoma.login.LoginDoLoginAction.executeAction(LoginDoLoginAction.java:65) [aoma.jar:]

at com.sonymusic.aoma.AOMADispatcherServlet$DispatcherAction.execute(AOMADispatcherServlet.java:302) [aoma.jar:]

at com.sonymusic.aoma.AOMADispatcherServlet.doChain(AOMADispatcherServlet.java:137) [aoma.jar:]

at com.sonymusic.aoma.AOMADispatcherServlet.service(AOMADispatcherServlet.java:94) [aoma.jar:]

at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) [jboss-servlet-api_3.1_spec-1.0.0.Final.jar:1.0.0.Final]

at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]

at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:61) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]

at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]

at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)

at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.1.0.Final.jar:1.1.0.Final]

at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]

at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:56) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]

at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.1.0.Final.jar:1.1.0.Final]

at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:45) [undertow-core-1.1.0.Final.jar:1.1.0.Final]

at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:63) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final

]

at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:58) [undertow-core-1.1.0.Final.jar:1.1.0.Final]

at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:70) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]

at io.undertow.security.handlers.SecurityInitialHandler.handleRequest(SecurityInitialHandler.java:76) [undertow-core-1.1.0.Final.jar:1.1.0.Final]

at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.1.0.Final.jar:1.1.0.Final]

at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)

at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.1.0.Final.jar:1.1.0.Final]

at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:261) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]

at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:247) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]

at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:76) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]

at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:166) [undertow-servlet-1.1.0.Final.jar:1.1.0.Final]

at io.undertow.server.Connectors.executeRootHandler(Connectors.java:197) [undertow-core-1.1.0.Final.jar:1.1.0.Final]

at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:759) [undertow-core-1.1.0.Final.jar:1.1.0.Final]

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [rt.jar:1.8.0_40]

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [rt.jar:1.8.0_40]

at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_40]

Caused by: javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 775, v1db1^@]

at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3135) [rt.jar:1.8.0_40]

at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3081) [rt.jar:1.8.0_40]

at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2883) [rt.jar:1.8.0_40]

at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2797) [rt.jar:1.8.0_40]

at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:319) [rt.jar:1.8.0_40]

at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:192) [rt.jar:1.8.0_40]

at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:210) [rt.jar:1.8.0_40]

at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:153) [rt.jar:1.8.0_40]

at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:83) [rt.jar:1.8.0_40]

at org.jboss.as.naming.InitialContext.getDefaultInitCtx(InitialContext.java:114)

1. Re: Wildfly 8.2.Final: JBAS011843:Failed instantiate InitialContextFactory com.sun.jndi.ldap.LdapCtxFactory

arnab_ghosh Dec 14, 2015 3:31 PM (in response to arnab_ghosh)

Hi All,

Any help on this ? Please let me know if you need more information.

Regards
Arnab
Actions
2. Re: Wildfly 8.2.Final: JBAS011843:Failed instantiate InitialContextFactory com.sun.jndi.ldap.LdapCtxFactory

jaysensharma Dec 14, 2015 11:45 PM (in response to arnab_ghosh)

The Error code [ [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 775] indicates that the user account is locked.

Please use a correct user name in whose LDAP account is not locked.

See the definition of data 755 meaning of this error: "user account locked"
https://confluence.atlassian.com/display/JIRAKB/LDAP+Error+Code+49

Regards
Jay SenSharma
Actions
3. Re: Wildfly 8.2.Final: JBAS011843:Failed instantiate InitialContextFactory com.sun.jndi.ldap.LdapCtxFactory

arnab_ghosh Dec 15, 2015 12:01 AM (in response to jaysensharma)

Jay,

Thanks for your reply. Yes i got the details of that error. My question is why the authentication exception is getting wrapped by Naming Exception:
javax.naming.NamingException: JBAS011843: Failed instantiate InitialContextFactory com.sun.jndi.ldap.LdapCtxFactory

This same code, when deployed in JBoss EAP 5.1.2, don't properly throws the Authentication Exception.
Please advice.

Regards
Arnab
Actions
4. Re: Wildfly 8.2.Final: JBAS011843:Failed instantiate InitialContextFactory com.sun.jndi.ldap.LdapCtxFactory

jaysensharma Dec 15, 2015 12:13 AM (in response to arnab_ghosh)

Hello Arnab,

Have you configured any LDAP security realm ? In that have you enabled the following module option:

<module-option name="throwValidateError" value="true"/>

Regards
Jay SenSharma
Actions
5. Re: Wildfly 8.2.Final: JBAS011843:Failed instantiate InitialContextFactory com.sun.jndi.ldap.LdapCtxFactory

arnab_ghosh Dec 15, 2015 2:47 AM (in response to jaysensharma)

No I have not. Here is code that we are using: Please note this is just a snippet, please ignore syntax errors

Hashtable<String, Object> env = new Hashtable<String, Object>();
env.put(Context.PROVIDER_URL, url.toExternalForm());
env.put(Context.SECURITY_PRINCIPAL, getUserDN(user));
env.put(Context.SECURITY_CREDENTIALS, password);
env.put("com.sun.jndi.ldap.connect.timeout", "2000");
env.put("com.sun.jndi.ldap.connect.pool", "false");
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.SECURITY_AUTHENTICATION, "simple");
try {
        if (trace) {
          log.trace("attempting an LDAP bind, bind attempt number " + bindAttempts);
        }
        context = new InitialLdapContext(env, null);

        if (trace) {
          log.trace("bind successful after " + bindAttempts + " attempt(s)");
        }
      } catch (AuthenticationException e) {
        // AuthenticationException must not be followed by retries, even if maxBindAttempts
        // is bigger than one: an authentication failure is definitive and the user must
        // be change something from the layer above in order for the next bind attempt to
        // succeed
        log.debug("authentication failure, not attempting bind again");
        throw e;
      } catch (Exception e) {
        if (bindAttempts >= maxBindAttempts) {
          // give up
          log.debug("LDAP bind failure, maximum bind attempts", e);
          throw e;
        }
Actions
6. Re: Wildfly 8.2.Final: JBAS011843:Failed instantiate InitialContextFactory com.sun.jndi.ldap.LdapCtxFactory

arnab_ghosh Dec 16, 2015 1:19 AM (in response to arnab_ghosh)

jaysensharma

Any idea ? Please advice. Please let me know if you need more information.

Regards
Arnab
Actions

Go to original post

	env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
	env.put(Context.SECURITY_AUTHENTICATION, "simple");