4 Replies Latest reply on Jul 24, 2006 2:06 AM by Jérémy SCHAAL

    Using JGuard to secure the portal

    Jérémy SCHAAL Newbie

      Hello,

      I would like to use jguard with pentaho (which is deployed on JBoss 4.03) to secure the portal.

      After downloading the jguard zip and install it, i was able to launch start-pentaho.bat but i had the following errors :


      2006-07-07 10:55:29,984 WARN [org.jboss.system.ServiceController] Problem starting service portal:service=CMS
      java.lang.NoSuchMethodError: org.objectweb.asm.ClassVisitor.visit(IILjava/lang/String;Ljava/lang/String;[Ljava/lang/String;Ljava/ lang/String;)V
      at net.sf.cglib.core.ClassEmitter.begin_class(ClassEmitter.java:77)
      at net.sf.cglib.core.KeyFactory$Generator.generateClass(KeyFactory.java:173)
      at net.sf.cglib.core.DefaultGeneratorStrategy.generate(DefaultGeneratorStrategy.java:25)
      at net.sf.cglib.core.AbstractClassGenerator.create(AbstractClassGenerator.java:215)
      at net.sf.cglib.core.KeyFactory$Generator.create(KeyFactory.java:145)
      at net.sf.cglib.core.KeyFactory.create(KeyFactory.java:117)
      at net.sf.cglib.core.KeyFactory.create(KeyFactory.java:108)
      at net.sf.cglib.core.KeyFactory.create(KeyFactory.java:104)
      at org.hibernate.impl.SessionFactoryImpl.(SessionFactoryImpl.java:362)
      ............




      [org.jboss.deployment.scanner.URLDeploymentScanner] Incomplete Deployment listing:

      --- MBeans waiting for other MBeans ---
      ObjectName: portal:service=CMS
      State: FAILED
      Reason: java.lang.NoSuchMethodError: org.objectweb.asm.ClassVisitor.visit(IILjava/lang/String;Ljava/lang/String;[Ljava/lang/String;Ljava/ lang/String;)V
      I Depend On:
      jboss.jca:name=PortalDS,service=DataSourceBinding
      portal:service=JAASLoginModule
      Depends On Me:
      portal:mapper=CMSObject

      ObjectName: portal:service=TreeCache,type=persistent
      State: FAILED
      Reason: java.lang.NoClassDefFoundError
      I Depend On:
      jboss.jca:name=PortalDS,service=DataSourceBinding
      Depends On Me:
      portal:service=TreeCacheProvider,type=persistent

      ObjectName: portal:service=Hibernate
      State: FAILED
      Reason: java.lang.NoClassDefFoundError
      I Depend On:
      jboss.jca:name=PortalDS,service=DataSourceBinding
      Depends On Me:
      portal:service=Module,type=User
      portal:service=Module,type=Role

      ObjectName: portal:service=Hibernate,type=globalinstance
      State: FAILED
      Reason: java.lang.NoClassDefFoundError
      I Depend On:
      jboss.jca:name=PortalDS,service=DataSourceBinding
      Depends On Me:
      portal:container=Instance,type=global

      ObjectName: portal:service=Hibernate,type=globalportal
      State: FAILED
      Reason: java.lang.NoClassDefFoundError
      I Depend On:
      jboss.jca:name=PortalDS,service=DataSourceBinding
      Depends On Me:
      portal:container=PortalObject,type=global

      --- MBEANS THAT ARE THE ROOT CAUSE OF THE PROBLEM ---
      ObjectName: portal:service=Hibernate,type=globalportal
      State: FAILED
      Reason: java.lang.NoClassDefFoundError
      I Depend On:
      jboss.jca:name=PortalDS,service=DataSourceBinding
      Depends On Me:
      portal:container=PortalObject,type=global

      ObjectName: portal:service=CMS
      State: FAILED
      Reason: java.lang.NoSuchMethodError: org.objectweb.asm.ClassVisitor.visit(IILjava/lang/String;Ljava/lang/String;[Ljava/lang/String;Ljava/ lang/String;)V
      I Depend On:
      jboss.jca:name=PortalDS,service=DataSourceBinding
      portal:service=JAASLoginModule
      Depends On Me:
      portal:mapper=CMSObject

      ObjectName: portal:service=Hibernate,type=globalinstance
      State: FAILED
      Reason: java.lang.NoClassDefFoundError
      I Depend On:
      jboss.jca:name=PortalDS,service=DataSourceBinding
      Depends On Me:
      portal:container=Instance,type=global

      ObjectName: portal:service=Hibernate
      State: FAILED
      Reason: java.lang.NoClassDefFoundError
      I Depend On:
      jboss.jca:name=PortalDS,service=DataSourceBinding
      Depends On Me:
      portal:service=Module,type=User
      portal:service=Module,type=Role

      ObjectName: portal:service=TreeCache,type=persistent
      State: FAILED
      Reason: java.lang.NoClassDefFoundError
      I Depend On:
      jboss.jca:name=PortalDS,service=DataSourceBinding
      Depends On Me:
      portal:service=TreeCacheProvider,type=persistent


      However, my jguard example worked... (pentaho didn't work at this time)

      I have resolved this problem, Jguard needs asm-2.0 when jboss uses asm 1.5.03, i have also change the cglib from /jboss/server/default/lib/ with the latest cglib-nodep version...

      I don't have errors anymore but my jguard example don't really work because i have only access to the login,logon and access denied pages which is according to the jguard forum the basic accessible pages...

      However, if i comment this part of the /jboss/server/default/deploy/jboss-portal.sar/META-INF/jboss-service.xml


      <mbean
      code="org.jboss.portal.server.deployment.WebAppAdapter"
      name="portal:deployer=Adapter"
      xmbean-dd="org/jboss/portal/server/deployment/WebAppAdapter.xml">
      portal:deploymentFactory=Object
      portal:deploymentFactory=PortletApp
      portal:deploymentFactory=Layout
      portal:deploymentFactory=LayoutFeatures
      portal:deploymentFactory=Theme
      portal:service=Module,type=User
      portal:service=Module,type=Role
      portal:service=Module,type=Mail
      <depends optional-attribute-name="Deployer" proxy-type="attribute">portal:deployer=PortalWebApp
      <depends optional-attribute-name="InterceptedDeployer">jboss.web:service=WebServer




      I obtain approximatively the same errors that the second quoted errors and my jguard example work again....


      So i deduce that my problem comes from the portal configuration but i don't know where or what search....


      Can you please help me ?


      Thanks for your response !

      Jérémy
      (French student)

        • 1. Re: Using JGuard to secure the portal
          Viet Master

          what is jguard ? does it do bytecode manipulation ?

          • 2. Re: Using JGuard to secure the portal
            Jérémy SCHAAL Newbie

            jGuard is a library that provides security (authentication and authorization) for Java web applications.

            It is built over the JAAS framework and as i said in the previous post it uses the asm-2.0 library...
            Apparently this version of asm isn't compatible with the cglib version of jboss...
            However, i tried to use the latest cglib version available (nodeps - version) and had the asm-2.0 library...
            By doing this i don"t have errors anymore but jguard don't work...
            Moreover, I had post first in the security & jaas forum and this is the response to my topic :


            Ask in the portal forums.

            Looks like a mismatch in hibernate/cglib/objectweb codebase.




            I have try to use only on jboss 4.03/4.04 (without jboss-portal) and it works but when i add the jboss-portal (or use the bundled version) jguard don't work anymore...

            • 3. Re: Using JGuard to secure the portal
              Jérémy SCHAAL Newbie

              Hello,

              there is any response to my problem. Nobody can help me please ?

              • 4. Re: Using JGuard to secure the portal
                Jérémy SCHAAL Newbie


                I tried something different...
                As i ever said with jboss the jGuardExample works fine but by adding the jboss-portal i have only access to the access denied/ login pages.
                So i tried different thing and by deleting the subdirectory portal-cms (and all his references) in jboss-portal directory i have a little improvement...

                I have first access to all pages but by "playing" with authentification/unauthentification i fall in the same problem :-(


                Cheers,

                Jérémy