Every single remote ejb call starts full authen...| JBoss.org Content Archive (Read Only)

30. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

danjee Apr 13, 2012 9:42 AM (in response to danjee)

Hello

I'm still facing the same issues with multiple calls to login module:

Here is the client code:

package com.asf.jndi.jboss7;


import java.rmi.RemoteException;
import java.util.Hashtable;


import javax.naming.Context;
import javax.naming.InitialContext;
import javax.naming.NamingException;


import com.asf.jboss7.RemoteCalculator;
import com.asf.kollecto.common.exception.AppException;


public class JndiTest {
          public static void main(String[] args) throws NamingException,
                              AppException, RemoteException {
                    final Hashtable<String, Object> jndiProperties = new Hashtable<String, Object>();


                    jndiProperties.put(Context.URL_PKG_PREFIXES,
                                        "org.jboss.ejb.client.naming");
                    jndiProperties.put(Context.INITIAL_CONTEXT_FACTORY,
                                        "org.jboss.naming.remote.client.InitialContextFactory");
                    jndiProperties.put(Context.PROVIDER_URL,
                                        "remote://localhost:4447");
                    jndiProperties.put(Context.SECURITY_PRINCIPAL, "support");
                    jndiProperties.put(Context.SECURITY_CREDENTIALS, "1");
                    jndiProperties.put("jboss.naming.client.ejb.context", true);
                    jndiProperties
                                        .put("jboss.naming.client.connect.options.org.xnio.Options.SASL_POLICY_NOPLAINTEXT",
                                                            "false");


                    final Context context = new InitialContext(jndiProperties);
                    final String appName = "myear";
                    final String moduleName = "myejb3";
                    final String distinctName = "";
                    final String beanName = "CalculatorBean";
                    final String viewClassName = RemoteCalculator.class.getName();
                    String lookup = "ejb:" + appName + "/" + moduleName + "/"
                                        + distinctName + "/" + beanName + "!" + viewClassName;
                    System.out.println("lookup name: " + lookup);
                    RemoteCalculator facade = (RemoteCalculator) context.lookup(lookup);
                    System.out.println(facade);
                    for (int i = 0; i < 10; i++) {
                              System.out.println("test: " + facade.add(i, 8));
                    }


          }
}

The login module is called for every remote call on that ejb.

I'm also attaching the ear, the standalone.xml file and the remote security jar that I add in the remoting module /home/servers/jboss-as-7.1.2.Final-SNAPSHOT/modules/org/jboss/as/remoting/main so I won't receive UUID as passwords.

This jar just contains a dummy login module that lets requests pass considering security will be done in other jaas.

I hope this will be enough not to consider this issue as closed.

Many thanks,

Daniel

31. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

danjee Apr 14, 2012 5:07 PM (in response to danjee)

Problem is solved now. The reason for this multiple calls was my login module.Due to the fact that my application was migrated from an OC4J application server, my custom login module class simply implemented the LoginModule interface so the option for password stacking was useless. After changing the login module so it will extend JBoss's UsernamePasswordLoginModule the cache begin to work. So for me this issue is resolved in 7.1.2 release.

Thank you,

Daniel

32. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

michael_gronau Apr 25, 2012 9:25 AM (in response to dlofthouse)

Hello Darran,

I've tried the current 7.1.2 build, but the problem still exists. Is it correct, that the caching only works, when I extend my login module from a Jboss specific login module (this is not suitable for our app so far.)?

33. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

robmv Jun 25, 2012 7:30 PM (in response to michael_gronau)

Michael Gronau wrote:

Hello Darran,
I've tried the current 7.1.2 build, but the problem still exists. Is it correct, that the caching only works, when I extend my login module from a Jboss specific login module (this is not suitable for our app so far.)?

Do your login module adds CallerPrincipal the way JBoss login modules require? I have another problem related to how caching works. If you are creating a Principal on your login module and not adding it to CallerPrincipal or your principal has a different name or class than an internal JBoss remoting principal instance (See RemotingLoginModule), then caching doesn't work as expected https://community.jboss.org/thread/201664

Your login module must understand password-stacking for remoting authentication to work correctly and be cached, AbstractServerLoginModule JBoss implementation helps a lot in providing the basic code to have a correct password-stacking behavior

34. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

jaikiran Jun 25, 2012 11:28 PM (in response to robmv)

Robert Marcano wrote:

Michael Gronau wrote:

Hello Darran,
I've tried the current 7.1.2 build, but the problem still exists. Is it correct, that the caching only works, when I extend my login module from a Jboss specific login module (this is not suitable for our app so far.)?
Do your login module adds CallerPrincipal the way JBoss login modules require? I have another problem related to how caching works. If you are creating a Principal on your login module and not adding it to CallerPrincipal or your principal has a different name or class than an internal JBoss remoting principal instance (See RemotingLoginModule), then caching doesn't work as expected https://community.jboss.org/thread/201664

Are you sure the Principal class that you are using implements the equals() method correctly https://issues.jboss.org/browse/AS7-4689?

35. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

michael_gronau Jun 26, 2012 2:27 AM (in response to jaikiran)

Hi,

as I said here: https://community.jboss.org/message/732715 the problem is solved now and the solution was to implement the equals() method.

Thanks alot,

Michael

36. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

gersonjohan Oct 4, 2012 2:52 PM (in response to michael_gronau)

I have my own SimplePrincipal and SimpleGroup classes. I solved the problem implementing equal method as it does JBoss in SimplePrincipal:

 
@Override
public boolean equals(Object another) {

if (!(another instanceof Principal)) {
return false;}

String anotherName = ((Principal) another).getName();


boolean equals = false;

if (name == null){equals = anotherName == 
null;} 
else {equals = 
name.equals(anotherName);}


return equals;
}

37. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

pgarner Nov 3, 2012 4:21 PM (in response to dlofthouse)

Hi,

I'm facing the same issue with local ejb calls in an app bundled as a war. I'm not using a custom login module. I'm using DatabaseUsers. I noticed the issue with v. 7.1.1.Final when I implemented a "change user password" workflow when immediately after the new password was persisted to the db JBossCachedAuthenticationManager threw a FailedLoginException. I deployed to 7.1.2.Final as well as 7.2.0.Alpha1-SNAPSHOT. I double checked that cache-type="default" was in my configuration after reading about the issue in jira: AS7-3498. However this did not resolve the problem. AS7-3498 was closed in March??

15:50:06,756 ERROR [org.jboss.security.authentication.JBossCachedAuthenticationManager] (http-/127.0.0.1:8443-6) Login failure: javax.security.auth.login.FailedLoginException: Password Incorrect/Password Required

at org.jboss.security.auth.spi.UsernamePasswordLoginModule.login(UsernamePasswordLoginModule.java:293) [picketbox-4.0.9.Final.jar:4.0.9.Final]

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) [rt.jar:1.7.0_07]

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) [rt.jar:1.7.0_07]

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) [rt.jar:1.7.0_07]

at java.lang.reflect.Method.invoke(Method.java:601) [rt.jar:1.7.0_07]

at javax.security.auth.login.LoginContext.invoke(LoginContext.java:784) [rt.jar:1.7.0_07]

at javax.security.auth.login.LoginContext.access$000(LoginContext.java:203) [rt.jar:1.7.0_07]

at javax.security.auth.login.LoginContext$4.run(LoginContext.java:698) [rt.jar:1.7.0_07]

at javax.security.auth.login.LoginContext$4.run(LoginContext.java:696) [rt.jar:1.7.0_07]

at java.security.AccessController.doPrivileged(Native Method) [rt.jar:1.7.0_07]

at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:695) [rt.jar:1.7.0_07]

at javax.security.auth.login.LoginContext.login(LoginContext.java:594) [rt.jar:1.7.0_07]

at org.jboss.security.authentication.JBossCachedAuthenticationManager.defaultLogin(JBossCachedAuthenticationManager.java:449) [picketbox-infinispan-4.0.9.Final.jar:4.0.9.Final]

at org.jboss.security.authentication.JBossCachedAuthenticationManager.proceedWithJaasLogin(JBossCachedAuthenticationManager.java:383) [picketbox-infinispan-4.0.9.Final.jar:4.0.9.Final]

at org.jboss.security.authentication.JBossCachedAuthenticationManager.authenticate(JBossCachedAuthenticationManager.java:371) [picketbox-infinispan-4.0.9.Final.jar:4.0.9.Final]

at org.jboss.security.authentication.JBossCachedAuthenticationManager.isValid(JBossCachedAuthenticationManager.java:160) [picketbox-infinispan-4.0.9.Final.jar:4.0.9.Final]

at org.jboss.as.security.service.SimpleSecurityManager.authenticate(SimpleSecurityManager.java:354) [jboss-as-security-7.1.2.Final.jar:7.1.2.Final]

at org.jboss.as.security.service.SimpleSecurityManager.push(SimpleSecurityManager.java:292) [jboss-as-security-7.1.2.Final.jar:7.1.2.Final]

at org.jboss.as.ejb3.security.SecurityContextInterceptor$1.run(SecurityContextInterceptor.java:49) [jboss-as-ejb3-7.1.2.Final.jar:7.1.2.Final]

at org.jboss.as.ejb3.security.SecurityContextInterceptor$1.run(SecurityContextInterceptor.java:45) [jboss-as-ejb3-7.1.2.Final.jar:7.1.2.Final]

at java.security.AccessController.doPrivileged(Native Method) [rt.jar:1.7.0_07]

at org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:74) [jboss-as-ejb3-7.1.2.Final.jar:7.1.2.Final]

at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]

at org.jboss.as.ejb3.component.interceptors.ShutDownInterceptorFactory$1.processInvocation(ShutDownInterceptorFactory.java:42) [jboss-as-ejb3-7.1.2.Final.jar:7.1.2.Final]

at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]

at org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:59) [jboss-as-ejb3-7.1.2.Final.jar:7.1.2.Final]

at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]

at org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50) [jboss-as-ee-7.1.2.Final.jar:7.1.2.Final]

at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]

at org.jboss.as.ejb3.component.interceptors.AdditionalSetupInterceptor.processInvocation(AdditionalSetupInterceptor.java:32) [jboss-as-ejb3-7.1.2.Final.jar:7.1.2.Final]

at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]

at org.jboss.as.ee.component.TCCLInterceptor.processInvocation(TCCLInterceptor.java:45) [jboss-as-ee-7.1.2.Final.jar:7.1.2.Final]

at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]

at org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61) [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]

at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165) [jboss-as-ee-7.1.2.Final.jar:7.1.2.Final]

at org.jboss.as.ee.component.ViewDescription$1.processInvocation(ViewDescription.java:176) [jboss-as-ee-7.1.2.Final.jar:7.1.2.Final]

at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]

at org.jboss.as.ejb3.component.stateful.StatefulComponentIdInterceptor.processInvocation(StatefulComponentIdInterceptor.java:52) [jboss-as-ejb3-7.1.2.Final.jar:7.1.2.Final]

at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]

at org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61) [jboss-invocation-1.1.1.Final.jar:1.1.1.Final]

at org.jboss.as.ee.component.ProxyInvocationHandler.invoke(ProxyInvocationHandler.java:72) [jboss-as-ee-7.1.2.Final.jar:7.1.2.Final]

at com.patrac.controller.statemachine.screen.ChangePasswordScreen$$$view29.findLeafStateAndExitUpward(Unknown Source) [Patrac-ejb.jar:]

at com.patrac.controller.statemachine.transition.Transition.exitSource(Transition.java:90) [Patrac-ejb.jar:]

at com.patrac.controller.statemachine.transition.Transition.fire(Transition.java:62) [Patrac-ejb.jar:]

at com.patrac.controller.statemachine.transition.GoToWorkflowTransition.fire(GoToWorkflowTransition.java:49) [Patrac-ejb.jar:]

at com.patrac.controller.statemachine.workflow.ChangePasswordWorkflow$1.evaluate(ChangePasswordWorkflow.java:62) [Patrac-ejb.jar:]

at com.patrac.controller.statemachine.workflow.ChangePasswordWorkflow$1.evaluate(ChangePasswordWorkflow.java:56) [Patrac-ejb.jar:]

at com.patrac.controller.statemachine.event.Event.trigger(Event.java:85) [Patrac-ejb.jar:]

at com.patrac.controller.backingbean.BackingBean.dispatch(BackingBean.java:68) [classes:]

at com.patrac.controller.backingbean.ChangePasswordBean$Proxy$_$$_WeldClientProxy.dispatch(ChangePasswordBean$Proxy$_$$_WeldClientProxy.java) [classes:]

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) [rt.jar:1.7.0_07]

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) [rt.jar:1.7.0_07]

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) [rt.jar:1.7.0_07]

at java.lang.reflect.Method.invoke(Method.java:601) [rt.jar:1.7.0_07]

at org.apache.el.parser.AstValue.invoke(AstValue.java:264) [jbossweb-7.0.16.Final.jar:]

at org.apache.el.MethodExpressionImpl.invoke(MethodExpressionImpl.java:278) [jbossweb-7.0.16.Final.jar:]

at org.jboss.weld.util.el.ForwardingMethodExpression.invoke(ForwardingMethodExpression.java:39) [weld-core-1.1.8.Final.jar:2012-04-29 10:45]

at org.jboss.weld.el.WeldMethodExpression.invoke(WeldMethodExpression.java:50) [weld-core-1.1.8.Final.jar:2012-04-29 10:45]

at com.sun.faces.facelets.el.TagMethodExpression.invoke(TagMethodExpression.java:105) [jsf-impl-2.1.7-jbossorg-2.jar:]

at javax.faces.component.MethodBindingMethodExpressionAdapter.invoke(MethodBindingMethodExpressionAdapter.java:88) [jboss-jsf-api_2.1_spec-2.0.2.Final.jar:2.0.2.Final]

at com.sun.faces.application.ActionListenerImpl.processAction(ActionListenerImpl.java:102) [jsf-impl-2.1.7-jbossorg-2.jar:]

at javax.faces.component.UICommand.broadcast(UICommand.java:315) [jboss-jsf-api_2.1_spec-2.0.2.Final.jar:2.0.2.Final]

at javax.faces.component.UIViewRoot.broadcastEvents(UIViewRoot.java:794) [jboss-jsf-api_2.1_spec-2.0.2.Final.jar:2.0.2.Final]

at javax.faces.component.UIViewRoot.processApplication(UIViewRoot.java:1259) [jboss-jsf-api_2.1_spec-2.0.2.Final.jar:2.0.2.Final]

at com.sun.faces.lifecycle.InvokeApplicationPhase.execute(InvokeApplicationPhase.java:81) [jsf-impl-2.1.7-jbossorg-2.jar:]

at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:101) [jsf-impl-2.1.7-jbossorg-2.jar:]

at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:118) [jsf-impl-2.1.7-jbossorg-2.jar:]

at javax.faces.webapp.FacesServlet.service(FacesServlet.java:593) [jboss-jsf-api_2.1_spec-2.0.2.Final.jar:2.0.2.Final]

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:329) [jbossweb-7.0.16.Final.jar:]

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248) [jbossweb-7.0.16.Final.jar:]

at org.jboss.weld.servlet.ConversationPropagationFilter.doFilter(ConversationPropagationFilter.java:62) [weld-core-1.1.8.Final.jar:2012-04-29 10:45]

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:280) [jbossweb-7.0.16.Final.jar:]

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248) [jbossweb-7.0.16.Final.jar:]

at com.patrac.filter.NoCacheFilter.doFilter(NoCacheFilter.java:46) [classes:]

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:280) [jbossweb-7.0.16.Final.jar:]

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248) [jbossweb-7.0.16.Final.jar:]

at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:275) [jbossweb-7.0.16.Final.jar:]

at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:161) [jbossweb-7.0.16.Final.jar:]

at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:489) [jbossweb-7.0.16.Final.jar:]

at org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50) [jboss-as-jpa-7.1.2.Final.jar:7.1.2.Final]

at org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:153) [jboss-as-web-7.1.2.Final.jar:7.1.2.Final]

at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:155) [jbossweb-7.0.16.Final.jar:]

at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [jbossweb-7.0.16.Final.jar:]

at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [jbossweb-7.0.16.Final.jar:]

at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:368) [jbossweb-7.0.16.Final.jar:]

at org.apache.coyote.http11.Http11AprProcessor.process(Http11AprProcessor.java:897) [jbossweb-7.0.16.Final.jar:]

at org.apache.coyote.http11.Http11AprProtocol$Http11ConnectionHandler.process(Http11AprProtocol.java:634) [jbossweb-7.0.16.Final.jar:]

at org.apache.tomcat.util.net.AprEndpoint$Worker.run(AprEndpoint.java:2039) [jbossweb-7.0.16.Final.jar:]

at java.lang.Thread.run(Thread.java:722) [rt.jar:1.7.0_07]

15:50:06,772 ERROR [org.jboss.as.ejb3.invocation] (http-/127.0.0.1:8443-6) JBAS014134: EJB Invocation failed on component ChangePasswordScreen for method public void com.patrac.controller.statemachine.state.LeafState.findLeafStateAndExitUpward(com.patrac.controller.statemachine.transferobject.TransferObject,com.patrac.controller.statemachine.state.State): javax.ejb.EJBAccessException: JBAS013323: Invalid User

at org.jboss.as.ejb3.security.SecurityContextInterceptor$1.run(SecurityContextInterceptor.java:54) [jboss-as-ejb3-7.1.2.Final.jar:7.1.2.Final]