Josh,

This is an interesting problem, that is not imediately obvious to me. But, I can offer some suggestions to remove potential issues. That way we can narrow the focus better.

Josh,

With the added detail you provided, I have a better picture. I am not suggesting that your SSO valve extend authenticator. I thought you only had that one valve that was acting a both a SSO valve, and an authenticator.

The Context that is stored in AuthenticatorBase (as refered by context.getRealm()) may not be the same Context that is stored in the request (as used by the valve.) Is there a way you can find out what those implementations are?

cgriffith

I going out on a limb here...

When executing your custom Authenticator, the Classloader is your web app's classloader. Then the realm is obtained using same classloader. So JNDI context is that of the webapp's classloader.

Because your custom SSO valve is set at Host level, it has a different classloader when it is executed.

If this is the case, you will need to see if you get the classloader from the request somehow.

cgriffith

Josh,

I am glad you are on the track to fixing your problem. I do want to comment on your last statement. When an web-application is being deployed, a private JNDI context is constructed by deployer for that web-app. It would be a bad idea to have web-apps share one JNDI context. That said, JBoss stores a reference to the security service needed by that web-app in that JNDI context. This is what allows each web-app to link into JBoss' security layer specific for that application. It is unreasonable to expect JBossSecurityMgrRealm to work outside of an applications JNDI context.

later, cgriffith

Hi Josh,

I am facing a similar issue as you did sometime back ie. the JBossSecurityMgrRealm instance that is provided to me in my custom valve has a null securityCtx. I am still a newbee to Jboss and JAAS. I could not understand your last post as to which code did you move to the authenticator ? In my case I have only created a custom valve - NO custom authenticator.

Can you please help me with this as I have been struggling with this issue for a week now.

Thanks,
Swati

Hi Josh,

Some more information on my problem. I am just implementing a basic custom valve (and not a SSO valve). I am attaching the code for my valve below. Isn't this similar to the authenticator that you talk about in your last post ? If so then the Realm object that I get should have the JNDI namespace correctly set ?

/*
 * JBoss, Home of Professional Open Source.
 * Copyright 2006, Red Hat Middleware LLC, and individual contributors
 * as indicated by the @author tags. See the copyright.txt file in the
 * distribution for a full listing of individual contributors.
 *
 * This is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this software; if not, write to the Free
 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
 */
package org.jboss.web.tomcat.security;

import java.io.IOException;
import java.security.Principal;
import java.security.acl.Group;
import java.util.ArrayList;
import java.util.List;

import javax.security.auth.Subject;
import javax.servlet.ServletException;

import org.apache.catalina.connector.Request;
import org.apache.catalina.connector.Response;
import org.apache.catalina.Context;
import org.apache.catalina.Session;

import org.apache.catalina.realm.GenericPrincipal;
import org.apache.catalina.valves.ValveBase;
import org.jboss.logging.Logger;
import org.jboss.security.SecurityAssociation;
import org.jboss.security.SimpleGroup;

//import com.sun.security.auth.UserPrincipal;

//import com.sun.security.auth.UserPrincipal;

/** A valve that provides information on the jaas login exception seen in the
 SecurityAssociation exception data. The useExceptionAsMsg flag indicates if
 the exception message should be set as the http response message. The
 exceptionHeader attribute if set is the header name that should be populated
 with the exception message.

 @author Scott.Stark@jboss.org
 @version $Revision: 57206 $
 */
public class BasicAuthValve
 extends ValveBase
{
 private static Logger log = Logger.getLogger(BasicAuthValve.class);
 private static boolean trace = log.isTraceEnabled();

 /** Should the exception message be used as the request status message */
 private boolean useExceptionAsMsg = false;
 /** A flag indicating if the auth exception thread local should be cleared */
 private boolean clearAuthException = true;
 /** The name of the reply header to use to return the exception message */
 private String exceptionHeader = null;

 public boolean isUseExceptionAsMsg()
 {
 return useExceptionAsMsg;
 }
 public void setUseExceptionAsMsg(boolean useExceptionAsMsg)
 {
 this.useExceptionAsMsg = useExceptionAsMsg;
 }

 public String getExceptionHeader()
 {
 return exceptionHeader;
 }
 public void setExceptionHeader(String exceptionHeader)
 {
 this.exceptionHeader = exceptionHeader;
 }

 public void invoke(Request request, Response response)
 throws IOException, ServletException
 {
 // TODO Auto-generated method stub
 List roles = new ArrayList();
 roles.add("Authenticated");
 roles.add("User");
 roles.add("Admin");
 roles.add("CustomRole");

 String password = "user";
 String username = "user";

 username = request.getRemoteUser();
 if (username != null) {
 Principal p = this.getContainer().getRealm().authenticate(username, (String)null);
 request.setAuthType("FORM");
 request.setUserPrincipal(new GenericPrincipal(request.getContext().getRealm(), username, password, roles));
 }

 this.getNext().invoke(request, response);
 if (request.getAttribute("org.jboss.portal.logout") != null) {
 request.getSession().invalidate();
 }
 }

}