|
Replies:
7
-
Last Post:
Jul 7, 2009 9:22 PM
by: cayhorstmann
|
|
|
|
|
|
|
Problem in using jdbc realm, i get "No LoginModules configured for jdbcrealm"
Posted:
Nov 29, 2007 1:47 AM
|
|
|
|
|
Problem in using jdbc realm, i get "No LoginModules configured for jdbcrealm" Hi Thank you for reading my post I have configured a 1- connection pool 2- date source pointing to that pool 3- adding some users and groups to the database table 4- creating a jdbc realm using several tutorial which are available in the web for a jdbc tutorial 5- add configuration to web.xml and sun-web.xml 6- trying to use the realm and i get the following exception (when using finest level of logging)
Processing login with credentials of type: class com.sun.enterprise.security.auth.login.PasswordCredential Logging in user [admin] into realm: jdbcrealm using JAAS module: jdbcrealm SEC5046: Audit: Authentication refused for [admin]. doPasswordLogin fails javax.security.auth.login.LoginException: No LoginModules configured for jdbcrealm at javax.security.auth.login.LoginContext.init(LoginContext.java :256) at javax.security.auth.login.LoginContext.<init>(LoginContext.java :367) at javax.security.auth.login.LoginContext.<init>(LoginContext.java :444) at com.sun.enterprise.security.auth.LoginContextDriver.doPasswordLogin( LoginContextDriver.java:294) at com.sun.enterprise.security.auth.LoginContextDriver.login( LoginContextDriver.java:170) at com.sun.enterprise.security.auth.LoginContextDriver.login( LoginContextDriver.java:123) at com.sun.web.security.RealmAdapter.authenticate(RealmAdapter.java :479) at com.sun.web.security.RealmAdapter.authenticate(RealmAdapter.java :419) at org.apache.catalina.authenticator.BasicAuthenticator.authenticate (BasicAuthenticator.java:161) at com.sun.web.security.RealmAdapter.invokeAuthenticateDelegate( RealmAdapter.java:1146) at org.apache.catalina.authenticator.AuthenticatorBase.invoke( AuthenticatorBase.java:627) at org.apache.catalina.core.StandardPipeline.doInvoke( StandardPipeline.java:609) at org.apache.catalina.core.StandardPipeline.doInvoke( StandardPipeline.java:577) at com.sun.enterprise.web.WebPipeline.invoke(WebPipeline.java:94) at org.apache.catalina.core.StandardHostValve.invoke( StandardHostValve.java:206) at org.apache.catalina.core.StandardPipeline.doInvoke( StandardPipeline.java:632) at org.apache.catalina.core.StandardPipeline.doInvoke( StandardPipeline.java:577) at org.apache.catalina.core.StandardPipeline.invoke( StandardPipeline.java:571) at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java :1080) at org.apache.catalina.core.StandardEngineValve.invoke( StandardEngineValve.java:150) at org.apache.catalina.core.StandardPipeline.doInvoke( StandardPipeline.java:632) at org.apache.catalina.core.StandardPipeline.doInvoke( StandardPipeline.java:577) at org.apache.catalina.core.StandardPipeline.invoke( StandardPipeline.java:571) at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java :1080) at org.apache.coyote.tomcat5.CoyoteAdapter.service( CoyoteAdapter.java:270) at com.sun.enterprise.web.connector.grizzly.DefaultProcessorTask.invokeAdapter( DefaultProcessorTask.java:637) at com.sun.enterprise.web.connector.grizzly.DefaultProcessorTask.doProcess( DefaultProcessorTask.java:568) at com.sun.enterprise.web.connector.grizzly.DefaultProcessorTask.process( DefaultProcessorTask.java:813) at com.sun.enterprise.web.connector.grizzly.DefaultReadTask.executeProcessorTask (DefaultReadTask.java:339) at com.sun.enterprise.web.connector.grizzly.DefaultReadTask.doTask( DefaultReadTask.java:261) at com.sun.enterprise.web.connector.grizzly.DefaultReadTask.doTask( DefaultReadTask.java:212) at com.sun.enterprise.web.connector.grizzly.TaskBase.run( TaskBase.java:265) at com.sun.enterprise.web.connector.grizzly.ssl.SSLWorkerThread.run( SSLWorkerThread.java:106) Web login failed: Login failed: javax.security.auth.login.LoginException: No LoginModules configured for jdbcrealm
the realm name is jdbcrealm and "jass context" attribute value is "jdbcrealm", I made the role and group mapping correctly and i used "jdbcrealm" as the realm name in web.xml configuration. Is there some other places to register the realm in order to make it possible for the application server/ web application use it?
Here is web.xml content:
<security-constraint> <display-name>protect_all</display-name> <web-resource-collection> <web-resource-name>protected</web-resource-name> <description/>
<url-pattern>/*</url-pattern> <http-method>GET</http-method> <http-method>PUT</http-method> <http-method>HEAD</http-method> <http-method>POST</http-method> <http-method>OPTIONS</http-method> <http-method>TRACE</http-method> <http-method>DELETE</http-method> </web-resource-collection> <auth-constraint> <description>sample description</description> <role-name>ADMINISTRATORS</role-name> <role-name>USERS</role-name> </auth-constraint> </security-constraint> <login-config> <auth-method>BASIC</auth-method> <realm-name>jdbcrealm</realm-name> </login-config> <security-role> <description/> <role-name>USERS</role-name> </security-role> <security-role> <description/> <role-name>ADMINISTRATORS</role-name> </security-role>
Here is sun-web.xml content:
<security-role-mapping> <role-name>USERS</role-name> <group-name>USERS</group-name> </security-role-mapping> <security-role-mapping> <role-name>ADMINISTRATORS</role-name> <group-name>ADMINISTRATORS</group-name> </security-role-mapping>
here is realm definition in domain.xml:
<auth-realm classname=" com.sun.enterprise.security.auth.realm.jdbc.JDBCRealm" name="jdbcrealm"> <property name="jaas-context" value="jdbcrealm"/> <property name="datasource-jndi" value="jdbc/certhauth"/> <property name="user-table" value="USERTABLE"/> <property name="user-name-column" value="USERID"/> <property name="password-column" value="PASSWORD"/> <property name="group-table" value="GROUPTABLE"/> <property name="group-name-column" value="GROUPID"/> <property name="digest-algorithm" value="NONE"/> </auth-realm>
What did i miss here?
Thanks [att1.html]
|
|
|
|
|
|
|
Re: Problem in using jdbc realm, i get "No LoginModules configured for jdbcrealm"
Posted:
Nov 29, 2007 2:01 AM
in response to: Legolas Woodland
|
|
|
The jaas context should be
"jdbcRealm"
and not "jdbcrealm"
Please try with this.
Regards, Harsha
Legolas Woodland wrote, On Thursday 29 November 2007 03:17 PM: > > Problem in using jdbc realm, i get "No LoginModules configured for > jdbcrealm" > Hi > Thank you for reading my post > I have configured a > 1- connection pool > 2- date source pointing to that pool > 3- adding some users and groups to the database table > 4- creating a jdbc realm using several tutorial which are available in > the web for a jdbc tutorial > 5- add configuration to web.xml and sun-web.xml > 6- trying to use the realm and i get the following exception (when > using finest level of logging) > > Processing login with credentials of type: class > com.sun.enterprise.security.auth.login.PasswordCredential > Logging in user [admin] into realm: jdbcrealm using JAAS module: jdbcrealm > SEC5046: Audit: Authentication refused for [admin]. > doPasswordLogin fails > javax.security.auth.login.LoginException: No LoginModules configured > for jdbcrealm > at > javax.security.auth.login.LoginContext.init(LoginContext.java:256) > at javax.security.auth.login.LoginContext > .<init>(LoginContext.java:367) > at > javax.security.auth.login.LoginContext.<init>(LoginContext.java:444) > at > com.sun.enterprise.security.auth.LoginContextDriver.doPasswordLogin(LoginContextDriver.java > :294) > at > com.sun.enterprise.security.auth.LoginContextDriver.login(LoginContextDriver.java:170) > at > com.sun.enterprise.security.auth.LoginContextDriver.login(LoginContextDriver.java:123) > at > com.sun.web.security.RealmAdapter.authenticate(RealmAdapter.java:479) > at > com.sun.web.security.RealmAdapter.authenticate(RealmAdapter.java:419) > at > org.apache.catalina.authenticator.BasicAuthenticator.authenticate > (BasicAuthenticator.java:161) > at > com.sun.web.security.RealmAdapter.invokeAuthenticateDelegate(RealmAdapter.java:1146) > at > org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java > :627) > at > org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:609) > at > org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:577) > at com.sun.enterprise.web.WebPipeline.invoke (WebPipeline.java:94) > at > org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:206) > at > org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:632) > at org.apache.catalina.core.StandardPipeline.doInvoke > (StandardPipeline.java:577) > at > org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:571) > at > org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:1080) > at org.apache.catalina.core.StandardEngineValve.invoke > (StandardEngineValve.java:150) > at > org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:632) > at > org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:577) > at > org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:571) > at > org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:1080) > at org.apache.coyote.tomcat5.CoyoteAdapter.service > (CoyoteAdapter.java:270) > at > com.sun.enterprise.web.connector.grizzly.DefaultProcessorTask.invokeAdapter(DefaultProcessorTask.java:637) > at > com.sun.enterprise.web.connector.grizzly.DefaultProcessorTask.doProcess > (DefaultProcessorTask.java:568) > at > com.sun.enterprise.web.connector.grizzly.DefaultProcessorTask.process(DefaultProcessorTask.java:813) > at > com.sun.enterprise.web.connector.grizzly.DefaultReadTask.executeProcessorTask > (DefaultReadTask.java:339) > at > com.sun.enterprise.web.connector.grizzly.DefaultReadTask.doTask(DefaultReadTask.java:261) > at > com.sun.enterprise.web.connector.grizzly.DefaultReadTask.doTask(DefaultReadTask.java > :212) > at > com.sun.enterprise.web.connector.grizzly.TaskBase.run(TaskBase.java:265) > at > com.sun.enterprise.web.connector.grizzly.ssl.SSLWorkerThread.run(SSLWorkerThread.java:106) > Web login failed: Login failed: > javax.security.auth.login.LoginException: No LoginModules configured > for jdbcrealm > > > the realm name is jdbcrealm and "jass context" attribute value is > "jdbcrealm", > I made the role and group mapping correctly and i used "jdbcrealm" as > the realm name in web.xml configuration. > Is there some other places to register the realm in order to make it > possible for the application server/ web application use it? > > Here is web.xml content: > > <security-constraint> > <display-name>protect_all</display-name> > <web-resource-collection> > <web-resource-name>protected</web-resource-name> > <description/> > > > <url-pattern>/*</url-pattern> > <http-method>GET</http-method> > <http-method>PUT</http-method> > <http-method>HEAD</http-method> > <http-method>POST</http-method> > <http-method>OPTIONS</http-method> > <http-method>TRACE</http-method> > <http-method>DELETE</http-method> > </web-resource-collection> > <auth-constraint> > <description>sample description</description> > <role-name>ADMINISTRATORS</role-name> > <role-name>USERS</role-name> > </auth-constraint> > </security-constraint> > <login-config> > <auth-method>BASIC</auth-method> > <realm-name>jdbcrealm</realm-name> > </login-config> > <security-role> > <description/> > <role-name>USERS</role-name> > </security-role> > <security-role> > <description/> > <role-name>ADMINISTRATORS</role-name> > </security-role> > > > Here is sun-web.xml content: > > <security-role-mapping> > <role-name>USERS</role-name> > <group-name>USERS</group-name> > </security-role-mapping> > <security-role-mapping> > <role-name>ADMINISTRATORS</role-name> > <group-name>ADMINISTRATORS</group-name> > </security-role-mapping> > > here is realm definition in domain.xml: > > > <auth-realm > classname="com.sun.enterprise.security.auth.realm.jdbc.JDBCRealm" > name="jdbcrealm"> > <property name="jaas-context" value="jdbcrealm"/> > <property name="datasource-jndi" value="jdbc/certhauth"/> > <property name="user-table" value="USERTABLE"/> > <property name="user-name-column" value="USERID"/> > <property name="password-column" value="PASSWORD"/> > <property name="group-table" value="GROUPTABLE"/> > <property name="group-name-column" value="GROUPID"/> > <property name="digest-algorithm" value="NONE"/> > </auth-realm> > > > > What did i miss here? > > Thanks >
--------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscribe@glassfish.dev.java.net For additional commands, e-mail: users-help@glassfish.dev.java.net
|
|
|
|
|
|
|
|
Re: Problem in using jdbc realm, i get "No LoginModules configured for jdbcrealm"
Posted:
Jun 30, 2009 10:18 PM
in response to: Harsha R A
|
|
|
Hi there,
I am also getting same problem. I verifed the configuration which is almost same as yours and i am getting same exception
"Login failed: javax.security.auth.login.LoginException: No LoginModules configured for myRealm "
Please let me know if you get any solution to this problem or any workaround.
Thanks
Message was edited by: jigar
|
|
|
|
|
|
|
|
Re: Problem in using jdbc realm, i get "No LoginModules configured for jdbcrealm"
Posted:
Jul 7, 2009 3:57 PM
in response to: jigar
|
|
|
Add me to the list of people with the same problem.
WARNING: Web login failed: Login failed: javax.security.auth.login.LoginException: No LoginModules configured for corejsfRealm WARNING: Can not find resource bundle for this logger. class name that failed: com.sun.web.security.RealmAdapter
This is with the current Glassfish v3 Preview. (The package containing security.jar, which contains the JDBCRealm class, is GF Common Components 3.0-53.) Here is the snippet from domain.xml:
<auth-realm classname="com.sun.enterprise.security.auth.realm.jdbc.JDBCRealm" name="corejsfRealm"> <property name="jaas-context" value="corejsfRealm" /> <property name="datasource-jndi" value="jdbc/mydb" /> <property name="user-table" value="Credentials" /> <property name="user-name-column" value="username" /> <property name="password-column" value="password" /> <property name="group-table" value="Groups" /> <property name="group-name-column" value="groupname" /> </auth-realm>
Following some (probably useless) advice, I then added an entry in login.conf, mimicking exactly that for jdbcRealm. I was rewarded with a different failure:
WARNING: Web login failed: Login failed: javax.security.auth.login.LoginException: Security Exception WARNING: Can not find resource bundle for this logger. class name that failed: com.sun.web.security.RealmAdapter
Cay
|
|
|
|
|
|
|
|
Re: Problem in using jdbc realm, i get "No LoginModules configured for jdbcrealm"
Posted:
Jul 7, 2009 5:15 PM
in response to: cayhorstmann
|
|
|
Ok, I figured out the significance of login.conf. The jaas context must be one of the magic names listed there. (Hello, Glassfish, why can't you then list them in a dropdown in the realm configuration?) So, now I have
<auth-realm classname="com.sun.enterprise.security.auth.realm.jdbc.JDBCRealm" name="corejsfRealm"> <property name="jaas-context" value="jdbcRealm" /> <property name="datasource-jndi" value="jdbc/mydb" /> <property name="user-table" value="Credentials" /> <property name="user-name-column" value="username" /> <property name="password-column" value="passwd" /> <property name="group-table" value="Groups" /> <property name="group-name-column" value="groupname" /> <property name="digest-algorithm" value="none" /> </auth-realm>
(I changed the password column to passwd because some people somewhere say that with some databases, you can't use password as a column name, it being one of the hundreds of SQL reserved words. Fair enough.)
I also added <jvm-options>-Djava.security.debug=logincontext</jvm-options>
and set
javax.enterprise.system.core.security.level=FINEST
in logging.properties.
I know that JAAS now looks at my table, because at first I forgot to rename the table column, and I got an error message that there was no PASSWD column. Now I changed it back, and I get
SEVERE: [LoginContext]: original security exception with detail msg replaced by new exception with empty detail msg SEVERE: [LoginContext]: original security exception: com.sun.enterprise.security.auth.login.common.LoginException: Failed jdbc login for troosevelt. SEVERE: [LoginContext]: login REQUIRED failure SEVERE: [LoginContext]: abort ignored INFO: SEC5046: Audit: Authentication refused for [troosevelt]. WARNING: Web login failed: Login failed: javax.security.auth.login.LoginException: Security Exception WARNING: Can not find resource bundle for this logger. class name that failed: com.sun.web.security.RealmAdapter
WTF? I googled for "original security exception with detail msg replaced by new exception with empty detail msg". I want to see that original message. There are dozens and dozens of people with the same problem, and with various random suggestions, such as setting the charset to UTF-8. (No, it doesn't work.)
Now, this is obviously a feature that is full of pitfalls, with several dials that must be set just right for it to work. It is a major usability flaw that there are no clear messages. I want to know what the damn thing tried. Did the password match? (If not, then I'd know to tinker with digest-algorithm=none.) What roles did it find? Did it use them as-is or try to map them? I should not have to spend a day fussing with all those dials in the blind, not knowing whether I am even getting closer.
In the meantime, if someone has another random suggestion to try, I'd much appreciate it.
Cay
|
|
|
|
|
|
|
|
Re: Problem in using jdbc realm, i get "No LoginModules configured for jdbcrealm"
Posted:
Jul 7, 2009 9:20 PM
in response to: cayhorstmann
|
|
|
More in this wretched saga. I turned on tracing in Derby. (To do this, add the magic name/value pairs traceFile=trace.out and traceLevel=-1 to the connection pool properties. You'll get a file /path/to/glassfishv3-preview/glassfish/domains/domain1/config/trace.out that contains enough detail about the driver calls that you can figure out what has happened. In my case, what happened is that the JDBC realm prepares a statement
SELECT passwd FROM Credentials WHERE username = ?
calls setString (1, bar), executes the query, calls next on the result set, calls getString(1), and gets the string
5ebe2294ecd0e0f08eab7690d2a6ee69
That is the MD5 encoding of "secret". (echo -n secret | md5sum) I went to MD5 encoding, just in case there was something to the rumors that "none" is not supported.
That's it. No further queries. Why no query for the role? I guess it must have "concluded" that the passwords don't match. But they do. Or do they?
I dimly recalled some grief with trailing spaces in Derby. Sure enough, when I changed CHAR(40) to CHAR(32) for the password, I was able to log in, but authentication still failed. A couple of hours later, it dawned upon me...it was the same reason. I have to use VARCHAR, not CHAR.
Now if some programmer out there had taken it upon him- or herself to issue a log message that "registereduser" doesn't match "registereduser ", I could have spent that couple of hours with my adorable twin daughters instead. Arggh!
So, if anyone gets to this message, the lesson is:
1) The jaas-context must be jdbcRealm 2) You must use VARCHAR, not CHAR for your column types 3) The rumor that hashing type "none" doesn't work is bogus. It works fine. (The rumor that you need to set the charset to UTF-8 is equally bogus. In those two hours, I read the source of the JDBCRealm class...) 4) If you ever implement stuff like this, and feel "oh my, I must fail completely silently so that hackers can't glean any information from the logs", have pity on your fellow programmer and instead emit a message "Login failed. For full information, set the logger com.foo.security to FINEST". And then make that logger spell out every step of the process!
|
|
|
|
|
|
|
|
RE: Problem in using jdbc realm, i get "No LoginModules configured for jdbcrealm"
Posted:
Jul 7, 2009 5:24 PM
in response to: cayhorstmann
|
|
|
|
|
could you display the /WEB-INF/web.xml security-constraint e.g. <security-constraint> <web-resource-collection> <web-resource-name>Basic Realm</web-resource-name> <url-pattern>/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>admin-role</role-name> </auth-constraint> </security-constraint>
please check for jdbcRealm e.g. /domains/domain1/config/login.conf jdbcRealm { com.sun.enterprise.security.auth.login.JDBCLoginModule required; };
Martin ______________________________________________ Verzicht und Vertraulichkeitanmerkung/Note de déni et de confidentialité Diese Nachricht ist vertraulich. Sollten Sie nicht der vorgesehene Empfaenger sein, so bitten wir hoeflich um eine Mitteilung. Jede unbefugte Weiterleitung oder Fertigung einer Kopie ist unzulaessig. Diese Nachricht dient lediglich dem Austausch von Informationen und entfaltet keine rechtliche Bindungswirkung. Aufgrund der leichten Manipulierbarkeit von E-Mails koennen wir keine Haftung fuer den Inhalt uebernehmen. Ce message est confidentiel et peut être privilégié. Si vous n'êtes pas le destinataire prévu, nous te demandons avec bonté que pour satisfaire informez l'expéditeur. N'importe quelle diffusion non autorisée ou la copie de ceci est interdite. Ce message sert à l'information seulement et n'aura pas n'importe quel effet légalement obligatoire. Étant donné que les email peuvent facilement être sujets à la manipulation, nous ne pouvons accepter aucune responsabilité pour le contenu fourni.
> Date: Tue, 7 Jul 2009 15:57:36 -0700 > From: glassfish@javadesktop.org > To: users@glassfish.dev.java.net > Subject: Re: Problem in using jdbc realm, i get "No LoginModules configured for jdbcrealm" > > Add me to the list of people with the same problem. > > WARNING: Web login failed: Login failed: javax.security.auth.login.LoginException: No LoginModules configured for corejsfRealm > WARNING: Can not find resource bundle for this logger. class name that failed: com.sun.web.security.RealmAdapter > > This is with the current Glassfish v3 Preview. (The package containing security.jar, which contains the JDBCRealm class, is GF Common Components 3.0-53.) Here is the snippet from domain.xml: > > <auth-realm classname="com.sun.enterprise.security.auth.realm.jdbc.JDBCRealm" name="corejsfRealm"> > <property name="jaas-context" value="corejsfRealm" /> > <property name="datasource-jndi" value="jdbc/mydb" /> > <property name="user-table" value="Credentials" /> > <property name="user-name-column" value="username" /> > <property name="password-column" value="password" /> > <property name="group-table" value="Groups" /> > <property name="group-name-column" value="groupname" /> > </auth-realm> > > Following some (probably useless) advice, I then added an entry in login.conf, mimicking exactly that for jdbcRealm. I was rewarded with a different failure: > > WARNING: Web login failed: Login failed: javax.security.auth.login.LoginException: Security Exception > WARNING: Can not find resource bundle for this logger. class name that failed: com.sun.web.security.RealmAdapter > > Cay > [Message sent by forum member 'cayhorstmann' (cayhorstmann)] > > http://forums.java.net/jive/thread.jspa?messageID=354545 > > --------------------------------------------------------------------- > To unsubscribe, e-mail: users-unsubscribe@glassfish.dev.java.net > For additional commands, e-mail: users-help@glassfish.dev.java.net >
_________________________________________________________________ Windows Liveâ„¢: Keep your life in sync. http://windowslive.com/explore?ocid=TXT_TAGLM_WL_BR_life_in_synch_062009 [att1.html]
|
|
|
|
|
|
|
|
Re: RE: Problem in using jdbc realm, i get "No LoginModules configured for jdbcrealm"
Posted:
Jul 7, 2009 9:22 PM
in response to: Martin Gainty
|
|
|
Thanks very much for your note. It turned out something entirely different--see my other post.
Cheers,
Cay
|
|
|
|
|