10 Replies Latest reply on Oct 23, 2008 4:22 PM by Alejandro Montenegro

    JBoss SSO: App with multiple style sheets/javascript files c

    Walter Barrow Newbie

      Hello,

      I could use some help with a problem I have discovered with JBoss-SSO.

      I am using JBoss-SSO version 1.0CR1 and I am running a JSF application, using JASS, form-based security, which loads multiple CSS and JAVASCRIPT files for each page displayed. I use an IE-6.0 browser and am urunning JBoss locally on my Windows XP machine.

      The problem is that when I have SSO configured and I try to log into the application, invariably one of the CSS or JAVASCRIPT files do not get loaded properly.

      I build the SSO JAR and SAR files from scratch using the SSO code, so I am able to instrument the code with log statements to see what is happening. It appears that after form-authentication, there follow multiple requests from the browser to load the CSS and JAVASCRIPT files. Unfortunately, these requests only have the authenticated Principal in them and, even though SSO has generated the SSO_TOKEN, these requests do not contain it.

      I presume that IE has sent a batch of requests off to the server while trying to load the first page of the application.

      What I notice is that the first CSS request causes the SSO_TOKEN to be generated and monitoring of the SSO session to start. When the second CSS request arrives, since it does not contain the SSO_TOKEN and the SSO session thinks monitoring is active, the code performs a forced-logout, essentially throwing away the CSS request.

      The next request, which contains the authenticated Principal, seems to work and the cycle starts over, again. When it's all done, I'm not sure of the state of the application from a security point-of-view.

      I have included a snippet of the log file showing the sequence of events as they happened. Unfortunately, some of the events overlap in time and log4j jumbles the output a bit.

      Is this a problem with the design of the SSO code or am I missing something? Any help anyone can give me will be greatly appreciated.

      Thanks!

      Walt Barrow
      walter.barrow@afscn.com


      Log snippet:

      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
      DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/faces/index.jsp
      DEBUG [org.jboss.security.valve.SSOSession] ********** Creating new SSOSession
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: true
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: null
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Invoking next valve (SSOTokenManager)
      DEBUG [org.jboss.security.valve.SSOTokenManager] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOTokenManager] SSOToken found: false
      DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookieFound: true
      DEBUG [org.jboss.security.valve.SSOTokenManager] Invoking next valve (SSOAutoLogin)
      DEBUG [org.jboss.security.valve.SSOAutoLogin] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogin] ********** ssoToken is invalid
      DEBUG [org.jboss.security.valve.SSOAutoLogin] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOTokenManager] Did NOT find principal
      DEBUG [org.jboss.security.valve.SSOTokenManager] Extracting domain from serverName: test.l3database.com
      DEBUG [org.jboss.security.valve.SSOTokenManager] Domain found is: .l3database.com
      DEBUG [org.jboss.security.valve.SSOTokenManager] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
      DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/css/schemePDM.css
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: true
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: null
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Invoking next valve (SSOTokenManager)
      DEBUG [org.jboss.security.valve.SSOTokenManager] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOTokenManager] SSOToken found: true
      DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookieFound: false
      DEBUG [org.jboss.security.valve.SSOTokenManager] Invoking next valve (SSOAutoLogin)
      DEBUG [org.jboss.security.valve.SSOAutoLogin] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogin] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOTokenManager] Did NOT find principal
      DEBUG [org.jboss.security.valve.SSOTokenManager] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
      DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/images/Cogs_background.gif
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: true
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: null
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Invoking next valve (SSOTokenManager)
      DEBUG [org.jboss.security.valve.SSOTokenManager] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOTokenManager] SSOToken found: true
      DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookieFound: false
      DEBUG [org.jboss.security.valve.SSOTokenManager] Invoking next valve (SSOAutoLogin)
      DEBUG [org.jboss.security.valve.SSOAutoLogin] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogin] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOTokenManager] Did NOT find principal
      DEBUG [org.jboss.security.valve.SSOTokenManager] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
      DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/faces/j_security_check
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: true
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: null
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Invoking next valve (SSOTokenManager)
      DEBUG [org.jboss.security.valve.SSOTokenManager] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOTokenManager] SSOToken found: true
      DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookieFound: false
      DEBUG [org.jboss.security.valve.SSOTokenManager] Invoking next valve (SSOAutoLogin)
      DEBUG [org.jboss.security.valve.SSOAutoLogin] --------------------------------------------------> invoke
      INFO [com.itapps.common.sso.login.CustomLdapLoginModule] ********** calling super.login()
      INFO [com.itapps.common.sso.login.CustomLdapLoginModule] ********** validatePassword called
      INFO [com.itapps.common.sso.login.CustomLdapLoginModule] ********** calling super.validatePassword()
      INFO [com.itapps.common.sso.login.CustomLdapLoginModule] ********** login was successful
      INFO [com.itapps.common.sso.login.CustomLdapLoginProvider] ********** Reading identity
      DEBUG [org.jboss.security.valve.SSOAutoLogin] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOTokenManager] Did NOT find principal
      DEBUG [org.jboss.security.valve.SSOTokenManager] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
      DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/faces/index.jsp
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: true
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: null
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Invoking next valve (SSOTokenManager)
      DEBUG [org.jboss.security.valve.SSOTokenManager] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOTokenManager] SSOToken found: true
      DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookieFound: false
      DEBUG [org.jboss.security.valve.SSOTokenManager] Invoking next valve (SSOAutoLogin)
      DEBUG [org.jboss.security.valve.SSOAutoLogin] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
      DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/css/schemePDM.css
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: true
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: null
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Invoking next valve (SSOTokenManager)
      DEBUG [org.jboss.security.valve.SSOTokenManager] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOTokenManager] SSOToken found: true
      DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookieFound: false
      DEBUG [org.jboss.security.valve.SSOTokenManager] Invoking next valve (SSOAutoLogin)
      DEBUG [org.jboss.security.valve.SSOAutoLogin] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogin] ********** setting principal on SSOSession
      DEBUG [org.jboss.security.valve.SSOAutoLogin] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOTokenManager] Found principal
      DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookie NOT found
      DEBUG [org.jboss.security.valve.SSOTokenManager] Extracting domain from serverName: test.l3database.com
      DEBUG [org.jboss.security.valve.SSOTokenManager] Domain found is: .l3database.com
      DEBUG [org.jboss.security.valve.SSOTokenManager] ********** Creating SSOToken: token
      DEBUG [org.jboss.security.valve.SSOSession] ?????????? setting monitor to true
      DEBUG [org.jboss.security.valve.SSOTokenManager] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
      DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/css/menuComponent.css
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: true
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: true
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ********** forced logout, user logged out in different partner site
      DEBUG [org.jboss.security.valve.SSOAutoLogout] contextPath: /pdapp
      DEBUG [org.jboss.security.valve.SSOAutoLogout] requestContext: /pdapp
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ********** performing signout: /pdapp/faces/logout.jsp?target=%2Fpdapp%2Fcss%2FmenuComponent.css
      DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke(2)
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
      DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/css/dateTimeComponent.css
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: true
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: null
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Invoking next valve (SSOTokenManager)
      DEBUG [org.jboss.security.valve.SSOTokenManager] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOTokenManager] SSOToken found: true
      DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookieFound: false
      DEBUG [org.jboss.security.valve.SSOTokenManager] Invoking next valve (SSOAutoLogin)
      DEBUG [org.jboss.security.valve.SSOAutoLogin] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogin] ********** setting principal on SSOSession
      DEBUG [org.jboss.security.valve.SSOAutoLogin] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOTokenManager] Found principal
      DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookie NOT found
      DEBUG [org.jboss.security.valve.SSOTokenManager] Extracting domain from serverName: test.l3database.com
      DEBUG [org.jboss.security.valve.SSOTokenManager] Domain found is: .l3database.com
      DEBUG [org.jboss.security.valve.SSOAutoLogin] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOTokenManager] Found principal
      DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookie NOT found
      DEBUG [org.jboss.security.valve.SSOTokenManager] Extracting domain from serverName: test.l3database.com
      DEBUG [org.jboss.security.valve.SSOTokenManager] Domain found is: .l3database.com
      DEBUG [org.jboss.security.valve.SSOTokenManager] ********** Creating SSOToken: token
      DEBUG [org.jboss.security.valve.SSOSession] ?????????? setting monitor to true
      DEBUG [org.jboss.security.valve.SSOTokenManager] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
      DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/javascript/menuComponent.js
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: true
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: true
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ********** forced logout, user logged out in different partner site
      DEBUG [org.jboss.security.valve.SSOAutoLogout] contextPath: /pdapp
      DEBUG [org.jboss.security.valve.SSOAutoLogout] requestContext: /pdapp
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ********** performing signout: /pdapp/faces/logout.jsp?target=%2Fpdapp%2Fjavascript%2FmenuComponent.js
      DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke(2)
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOTokenManager] ********** Creating SSOToken: token
      DEBUG [org.jboss.security.valve.SSOSession] ?????????? setting monitor to true
      DEBUG [org.jboss.security.valve.SSOTokenManager] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ######################################################################
      DEBUG [org.jboss.security.valve.SSOAutoLogout] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Request URL: /pdapp/css/print.css
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOSession found: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] SSOToken found: true
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ssoCookieFound: false
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Monitoring: true
      DEBUG [org.jboss.security.valve.SSOAutoLogout] ********** forced logout, user logged out in different partner site
      DEBUG [org.jboss.security.valve.SSOAutoLogout] contextPath: null
      DEBUG [org.jboss.security.valve.SSOAutoLogout] requestContext: /pdapp
      DEBUG [org.jboss.security.valve.SSOAutoLogout] Invoking next valve (SSOTokenManager)
      DEBUG [org.jboss.security.valve.SSOTokenManager] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOTokenManager] SSOToken found: true
      DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookieFound: false
      DEBUG [org.jboss.security.valve.SSOTokenManager] Invoking next valve (SSOAutoLogin)
      DEBUG [org.jboss.security.valve.SSOAutoLogin] --------------------------------------------------> invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogin] ********** setting principal on SSOSession
      DEBUG [org.jboss.security.valve.SSOAutoLogin] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOTokenManager] Found principal
      DEBUG [org.jboss.security.valve.SSOTokenManager] ssoCookie NOT found
      DEBUG [org.jboss.security.valve.SSOTokenManager] Extracting domain from serverName: test.l3database.com
      DEBUG [org.jboss.security.valve.SSOTokenManager] Domain found is: .l3database.com
      DEBUG [org.jboss.security.valve.SSOTokenManager] ********** Creating SSOToken: token
      DEBUG [org.jboss.security.valve.SSOSession] ?????????? setting monitor to true
      DEBUG [org.jboss.security.valve.SSOTokenManager] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout] <-------------------------------------------------- invoke
      DEBUG [org.jboss.security.valve.SSOAutoLogout]
      DEBUG [org.jboss.security.valve.SSOAutoLogout]