I have the exact same problem with an extended  UsernamePasswordLoginModule. It worked under JBoss 4 and it gets an encrypted username under JBoss 7.1 final. Why is the username encrytpted?

It is not encrypted - the value is not getting passed from the SASL authentication tier to the login module so a unique id is being generated.

Can you please show the configuration of both the security realm and your security domain.

On the client side in .java.login.config I have:

MyDomain {
      org.jboss.security.ClientLoginModule requisite;
};

I added this to the JBoss AS configuration file:

<security-domain name="MyDomain" cache-type="default">
      <authentication>
           <login-module code = "org.jboss.security.auth.spi.RunAsLoginModule" flag="required">
                <module-option name="roleName" value="administrator"/>
           </login-module>
          <login-module code="my.custom.login.module.ClassName" flag="required">
                <module-option name="hashUserPassword" value="false"/>
           </login-module>
      </authentication>
</security-domain>

I'm facing the same problem. Has somebody an idea?

Hi,

I'm trying to configure something similar and struggle based on AS7.1.3:

if I change the security-realm to "MyRealm" the client can't connect any more, because of "javax.security.sasl.SaslException: Authentication failed: all available authentication mechanisms failed"

if the security-realm is set to "ApplicationRealm" I experience the following:

using as custom login module:

<login-module code="Remoting" flag="optional">
                            <module-option name="password-stacking" value="useFirstPass"/>
                        </login-module>
                        <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule" flag="required">
                            <module-option name="unauthenticatedIdentity" value="anonymous"/>
                            <module-option name="defaultUsersProperties" value="${jboss.server.config.dir}/application-users.properties"/>
                            <module-option name="defaultRolesProperties" value="${jboss.server.config.dir}/application-roles.properties"/>
                            <module-option name="usersProperties" value="${jboss.server.config.dir}/application-users.properties"/>
                            <module-option name="rolesProperties" value="${jboss.server.config.dir}/application-roles.properties"/>
                            <module-option name="password-stacking" value="useFirstPass"/>
                        </login-module>

it works fine - like documented in may blogs.

switching the login-module to

<login-module code="org.jboss.security.auth.spi.LdapLoginModule" flag="required">
                            <module-option name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory"/>
                            <module-option name="java.naming.provider.url" value="ldap://ldap.acme.com:389"/>
                            <module-option name="java.naming.security.authentication" value="simple"/>
                            <module-option name="principalDNPrefix" value="cn="/>
                            <module-option name="principalDNSuffix" value=",ou=People,dc=acme,dc=com"/>
                            <module-option name="searchTimeLimit" value="5000"/>
                            <module-option name="searchScope" value="ONELEVEL_SCOPE"/>
                        </login-module>

always causes a "PBOX000283: Bad password for username dummy"

at the client I tried same set of properties and lot variants to get it working. Up to my investigation the credential get send encrpyted to the server.
In case of properties based login-module it can get directly compared with the file content, while the LDAP authentication would cause a decrpytion.

So how to send the credential plain text to the server? - I'm aware on the security impact :-)

Hi,

I'm also trying to get get Username/Password credentials in my custom Login Module, which extends org.jboss.security.auth.spi.UsernamePasswordLoginModule.

My LoginModule is correctly initialized, but I always get a king of an hash instead in the login() method. This, seams to be due to the username/password credentials are not properly propagated from the Remote EJB client to the server.

I Always get the following (in log):

    18:41:51,253 TRACE [org.jboss.security.authentication.JBossCachedAuthenticationManager] (EJB default - 1) defaultLogin, principal=80e88281-66ed-42d9-acd0-61a13c5880fb

    18:41:51,254 TRACE [org.jboss.security.auth.login.XMLLoginConfigImpl] (EJB default - 1) Begin getAppConfigurationEntry(testLoginModule), size=3

    18:41:51,254 TRACE [org.jboss.security.auth.login.XMLLoginConfigImpl] (EJB default - 1) End getAppConfigurationEntry(testLoginModule), authInfo=AppConfigurationEntry[]:

    [0]

    LoginModule Class: testLoginModule.loginModule.UserPassTestLoginModule

    ControlFlag: LoginModuleControlFlag: required

    Options:

    name=realm, value=ApplicationRealm

    name=debug, value=true

    name=password-stacking, value=useFirstPass

    18:41:51,256 INFO  [stdout] (EJB default - 1) UserPassTestLoginModule.login()

    18:41:51,256 INFO  [stdout] (EJB default - 1) username 80e88281-66ed-42d9-acd0-61a13c5880fb, password 846496d7-8155-41e9-bfef-12d329ba21c4

    18:41:51,257 INFO  [stdout] (EJB default - 1) username '80e88281-66ed-42d9-acd0-61a13c5880fb', password '846496d7-8155-41e9-bfef-12d329ba21c4'

    18:41:51,257 INFO  [stdout] (EJB default - 1) Returning result = false

my security configuration in standalone-full.xml in JBoss 7.1.1.FINAL

                <security-domain name="testLoginModule" cache-type="default">

                    <authentication>

                        <login-module code="testLoginModule.loginModule.UserPassTestLoginModule" flag="required" module="deployment.server-login-module-test.jar">

                            <module-option name="password-stacking" value="useFirstPass"/>

                            <module-option name="debug" value="true"/>

                            <module-option name="realm" value="ApplicationRealm"/>

                        </login-module>

                    </authentication>

                </security-domain>

my EJB Client

public static void test_protectedBean_approach_1()

  {

        ProtectedGreeter protectedGreeterBean;

        final Properties jndiProperties = new Properties();

        jndiProperties.put(Context.URL_PKG_PREFIXES, "org.jboss.ejb.client.naming");

        jndiProperties.put(Context.PROVIDER_URL, "127.0.0.1:4447");

        jndiProperties.put("remote.connectionprovider.create.options.org.xnio.Options.SSL_ENABLED", "false");

        jndiProperties.put("remote.connections", "default");

        jndiProperties.put("remote.connection.default.port", "4447");

        jndiProperties.put("remote.connection.default.host", "127.0.0.1");

        //jndiProperties.put("remote.connection.default.connect.options.org.xnio.Options.SASL_POLICY_NOANONYMOUS", "false");

        //jndiProperties.put("remote.connection.default.connect.options.org.xnio.Options.SASL_POLICY_NOPLAINTEXT", "false");

        jndiProperties.put("jboss.naming.client.connect.options.org.xnio.Options.SASL_POLICY_NOPLAINTEXT", "false");

        jndiProperties.put("jboss.naming.client.connect.options.org.xnio.Options.SASL_DISALLOWED_MECHANISMS", "JBOSS-LOCAL-USER");

        // This tels JBOss ejb-client to not use remoting instead of ByPassing

        jndiProperties.put("remote.connection.default.connect.options.org.xnio.Options.SASL_DISALLOWED_MECHANISMS", "JBOSS-LOCAL-USER");

        jndiProperties.put("remote.connection.default.username", "appuser1");

        jndiProperties.put("remote.connection.default.password", "appuser");

        // this is to configure JBoss EJB client API by code instead of jboss-ejb-client.propeties file

        EJBClientConfiguration cc = new PropertiesBasedEJBClientConfiguration(jndiProperties);

        ContextSelector<EJBClientContext> selector = new ConfigBasedEJBClientContextSelector(cc);

        EJBClientContext.setSelector(selector);

        try

        {

            final Context context = new InitialContext(jndiProperties);

            String result_message = "";

            ProtectedGreeter unprotectedGreeterBean = (ProtectedGreeter) context.lookup(UnprotectedGreeterBean_url);

            result_message = unprotectedGreeterBean.tell_me_hello(" Alice");

            System.out.println(result_message);

            protectedGreeterBean = (ProtectedGreeter) context.lookup(ProtectedGreeter_url);

            result_message = protectedGreeterBean.tell_me_hello(" Bob");

            System.out.println(result_message);

        }

        catch (Exception e)

        {

            e.printStackTrace();

        }

    }

the call to the unprotectedGreeterBean works just fine. the call to protectedGreeterBean instantiates the my Login module as expected, but the username/password credentials are not passed to the server.

Could please someone tell-me whats wrong/missing?

Please check out my attached code (Just with login-module an EJB Client and standalone configuration file).

• server application with login module:

> mvn clean install && mvn jboss-as:deploy    to deploy the server-login-module-test

• to run EJB Client Test

> mvn clean compile assembly:single

> java -jar target/client-login-module-test-jar-with-dependencies.jar