JBoss and J2EE Security

[Viv Singh]

Hi,

I have a web application that runs on JBoss.

I need to implement form-based authentication and furthermore I have users with different roles (which are stored in a oracle database).

Now, according to the user-role, the user will only be allowed to access certain pages/sites. For example user with role "0" is allowed to access page1.jsp, page2.jsp and page3.jsp whereas the user with role "1" is only allowed to access page1.jsp and page2.jsp and the user with role "2" can only access page3.jsp.

I am not sure how I have to implement that in my deployment descriptor (web.xml).

At the moment I have the following:

   
<security-constraint>
    
        <display-name>Security</display-name>
        
        <web-resource-collection>
            <web-resource-name>sec_res</web-resource-name>
            <description></description>
            <url-pattern>/portal/*</url-pattern>
            <http-method>POST</http-method>
            <http-method>GET</http-method>
        </web-resource-collection>
        
        <auth-constraint>
            <description></description>
            <role-name>*</role-name>
        </auth-constraint>
    </security-constraint>	

Thanks for any help.

[Peter Johnson]

Before we go any further, I noticed this in the url-pattern: /portal/*

Are you working with JBoss Portal (or some other portal)? I ask because portals have their own security mechanism that are different from simple web app security.

[Viv Singh]

No, I dont use any portal. I just called it like that for my own purpose.

[Peter Johnson]

Look at http://pdf.moreservlets.com/More-Servlets-and-JSP-Chapter-07.pdf, specifically the section titled Specifying URLs That Should Be
Password Protected on page 362.

There is also source code for that chapter, see http://pdf.moreservlets.com/

[Viv Singh]

Thanks for the resources.

Now, I have encountered a bug/problem in my configuration.

I have a table in my oracle database that contains the username, role and role_group.

In my login-config.xml I have the following:

   
 <application-policy name="stl">
        <authentication>
            <login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule"
                          flag="required">
                <module-option name="dsJndiName">java:/Stool_db</module-option>
                <module-option name="principalsQuery">select password from s_users where username=?</module-option>
				<module-option name="rolesQuery">select role, role_group from s_users where username=?</module-option>
            </login-module>
        </authentication>
    </application-policy>

And I tried to test my web app with the following web.xml configuration:

  
<security-constraint>
    
        <display-name>Security</display-name>
        
        <web-resource-collection>
            <web-resource-name>sec res</web-resource-name>
            <description></description>
            <url-pattern>/portal/*</url-pattern>
            <http-method>POST</http-method>
            <http-method>GET</http-method>
        </web-resource-collection>
        
        <auth-constraint>
            <description>test</description>
            <role-name>0</role-name>
        </auth-constraint>
    </security-constraint>	
			
	<security-role>
		<role-name>0</role-name>
	</security-role>

The table in the db contains an entry with an username who has the role "0" assigned.
However, when I try to login through the form I get the following message:

HTTP Status 403 - Access to the requested resource has been denied

type Status report

message Access to the requested resource has been denied

description Access to the specified resource (Access to the requested resource has been denied) has been forbidden.

What am I doing wrong here?

Thanks in advance.

[Jaikiran Pai]

Enable the security package TRACE logging to see what's going on. See Q4 here for enabling TRACE level logging.

[Viv Singh]

Thanks, I have enables the debug and trace and the log file shows me the following:


(just a few snippets from the log file, that i think illustrate the problem)

   
2009-01-19 18:30:08,088 TRACE [org.jboss.security.auth.spi.DatabaseServerLoginModule] User 'admin' authenticated, loginOk=true
2009-01-19 18:30:08,088 TRACE [org.jboss.security.auth.spi.DatabaseServerLoginModule] commit, loginOk=true
2009-01-19 18:30:08,104 TRACE [org.jboss.security.auth.spi.DatabaseServerLoginModule] Assign user to role 0

....
2009-01-19 18:30:08,119 TRACE [org.jboss.security.SecurityAssociation] pushSubjectContext, subject=Subject:
	Principal: admin
	Principal: 0(members:0)
, sc=org.jboss.security.SecurityAssociation$SubjectContext@742397{principal=admin,subject=13420065}
2009-01-19 18:30:08,119 TRACE [org.jboss.security.plugins.JaasSecurityManager.supporttool] getPrincipal, cache info: org.jboss.security.plugins.JaasSecurityManager$DomainInfo@a36771[Subject(6299455).principals=org.jboss.security.SimplePrincipal@22874704(admin)org.jboss.security.SimpleGroup@32017535(0(members:0)),credential.class=java.lang.String@8175078,expirationTime=1232391607589]
2009-01-19 18:30:08,119 TRACE [org.jboss.web.tomcat.security.JBossSecurityMgrRealm] Mapped from input principal: adminto: admin
2009-01-19 18:30:08,119 TRACE [org.jboss.security.SecurityAssociation] getSubject, sc=org.jboss.security.SecurityAssociation$SubjectContext@742397{principal=admin,subject=13420065}
2009-01-19 18:30:08,119 TRACE [org.jboss.security.plugins.JaasSecurityManager.supporttool] getUserRoles, subject: Subject:
	Principal: admin
	Principal: 0(members:0)
...
2009-01-19 18:30:08,119 TRACE [org.jboss.web.tomcat.security.JBossSecurityMgrRealm] End authenticate, principal=GenericPrincipal[admin()]
2009-01-19 18:30:08,119 DEBUG [org.apache.catalina.authenticator.FormAuthenticator] Authentication of 'admin' was successful
2009-01-19 18:30:08,119 DEBUG [org.apache.catalina.authenticator.FormAuthenticator] Redirecting to original '/stool/portal/index.jsp'
2009-01-19 18:30:08,119 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase]  Failed authenticate() test ??/stool/portal/j_security_check
2009-01-19 18:30:08,119 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase] Security checking request GET /stool/portal/index.jsp
2009-01-19 18:30:08,119 DEBUG [org.apache.catalina.realm.RealmBase]   Checking constraint 'SecurityConstraint[Secure Resources]' against GET /portal/index.jsp --> true
2009-01-19 18:30:08,119 DEBUG [org.apache.catalina.realm.RealmBase]   Checking constraint 'SecurityConstraint[Secure Resources]' against GET /portal/index.jsp --> true
2009-01-19 18:30:08,119 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase]  Calling hasUserDataPermission()
2009-01-19 18:30:08,119 DEBUG [org.apache.catalina.realm.RealmBase]   User data constraint has no restrictions
2009-01-19 18:30:08,119 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase]  Calling authenticate()
2009-01-19 18:30:08,119 DEBUG [org.apache.catalina.authenticator.FormAuthenticator] Restore request from session '36353D9E1711615104035C61AA128890'
2009-01-19 18:30:08,119 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase] Authenticated 'admin' with type 'FORM'
2009-01-19 18:30:08,119 DEBUG [org.apache.catalina.authenticator.FormAuthenticator] Proceed to restored request
2009-01-19 18:30:08,119 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase]  Calling accessControl()
2009-01-19 18:30:08,119 DEBUG [org.apache.catalina.realm.RealmBase]   Checking roles GenericPrincipal[admin()]
2009-01-19 18:30:08,119 DEBUG [org.apache.catalina.realm.RealmBase] Username admin does NOT have role 0
2009-01-19 18:30:08,119 DEBUG [org.apache.catalina.realm.RealmBase] No role found:  0
2009-01-19 18:30:08,119 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase]  Failed accessControl() test

 

It mentions that username admin does NOT have role, although it does have that in the database. Could there be a problem with the datatype of the field in the table? I dont see the problem?

[Jaikiran Pai]

DEBUG [org.apache.catalina.realm.RealmBase] No role found: 0

What does the following query return when you fire it from a SQL client?

select role, role_group from s_users where username=?

Replace the username appropriately. And what's the datatype of the "role" in the DB?

[Viv Singh]

If I execute the following query:

   
select role, role_group from s_users where username='admin'
 

I get the result:

ROLE 0
ROLE_GROUP 0

The datatype for role and role_group is:

ROLE VARCHAR2(40)
ROLE_GROUP VARCHAR2(40)

thanks

[Jaikiran Pai]

# 2009-01-19 18:30:08,088 TRACE [org.jboss.security.auth.spi.DatabaseServerLoginModule] User 'admin' authenticated, loginOk=true
# 2009-01-19 18:30:08,088 TRACE [org.jboss.security.auth.spi.DatabaseServerLoginModule] commit, loginOk=true
# 2009-01-19 18:30:08,104 TRACE [org.jboss.security.auth.spi.DatabaseServerLoginModule] Assign user to role 0

This shows that the "admin" was assigned the correct roles. However, later on it fails with admin not having roles.

Your web.xml shows that you are including the portal/index.jsp too in the list of resources which are secured. Do you really want to do that?

[Viv Singh]

Well, at the moment I have the following structure:

If the user enters this:

http://localhost:81/stool

he/she is automaticall redirected to http://localhost:81/stool/portal/index.jsp which is secured.

the content of the index.jsp in /stool is:

 
<%
	String redirectURL = "portal/index.jsp";
	response.sendRedirect(redirectURL);
%>

Basically, I would like the index.jsp in stool/portal/ to be secured. Or is that wrong?

[Jaikiran Pai]

Can you post the entire web.xml? I am interested in seeing what the login-config element looks like.

[Viv Singh]

web.xml

<web-app>
  <servlet>
	<servlet-name>toolserv</servlet-name>
    <servlet-class>com.mine.servlet.toolserv</servlet-class>
  </servlet>
 
  <servlet>
	  <servlet-name>dwr-invoker</servlet-name>
	  <display-name>DWR Servlet</display-name>
	  <servlet-class>org.directwebremoting.servlet.DwrServlet</servlet-class>
	  <init-param>
	     <param-name>debug</param-name>
	     <param-value>true</param-value>
	  </init-param>
  </servlet>

  
  <servlet-mapping>
    <servlet-name>toolserv</servlet-name>
    <url-pattern>/up</url-pattern>
  </servlet-mapping>
  
  <servlet-mapping>
	<servlet-name>dwr-invoker</servlet-name>
	<url-pattern>/dwr/*</url-pattern>
  </servlet-mapping>
  
	<security-constraint>
        <display-name>Security</display-name>
        
        <web-resource-collection>
            <web-resource-name>sec_res</web-resource-name>
            <description></description>
            <url-pattern>/portal/*</url-pattern>
            <http-method>POST</http-method>
            <http-method>GET</http-method>
        </web-resource-collection>
        
        <auth-constraint>
            <description>Role-Check</description>
			<role-name>0</role-name>
			<role-name>1</role-name>
			<role-name>2</role-name>
        </auth-constraint>
    </security-constraint>	
			
	<security-role>
		<role-name>0</role-name>
		<role-name>1</role-name>
		<role-name>2</role-name>
	</security-role>
      
	<login-config>
		<auth-method>FORM</auth-method>
		<form-login-config>
			<form-login-page>/login.jsp</form-login-page>
			<form-error-page>/error.jsp</form-error-page>
		</form-login-config>
	</login-config>
</web-app>

and i have the following in my login-config.xml in jboss:

 
<application-policy name="stool">
        <authentication>
            <login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule"
                          flag="required">
                <module-option name="dsJndiName">java:/Stool_db</module-option>
                <module-option name="principalsQuery">select password from s_users where username=?</module-option>
				<module-option name="rolesQuery">select role, role_group from s_users where username=?</module-option>
            </login-module>
        </authentication>
    </application-policy>

thanks

[Viv Singh]

Are there any hints? I do not understand why it authenticates successfully first and fails ultimately.

[Javid Jamae]

I think the problem is your role query.

Instead of:

select role, role_group from s_users where username=?

Try:

select role, 'Roles' from s_users where username=?


Also, why are you defining the roles in the s_users table? You should have a roles table and a users table. Otherwise you'll end up having a denormalized table with a lot of duplicate data, which will probably cause you trouble in the future.

[Viv Singh]

Thanks alot. This solved the problem. thank you very much