Mark Henryson

I will try this and let you know.

I am using Windows Vista Home Basic with Norton Internet Security 2009.
My Windows firewall has been turned off by norton, as it provides its own firewall.
I have installed mysql and I am trying to configure my mysql 5.1.
While configuring at the last step "Applying Security setting" mysql throws an error saying that to "open the port 3306 TCP and retry".
As my windows firewall has been turned off my norton, I have gone to the norton internet setting and in program control I have seen for mysql the firewall option is already "Auto" with "Allow" option for port 53.
I have added the port 3306 (local port) with TCP. Then I have tried to configure, but still getting the same error message.
I have also added the port to exclude from firewall in windows firewall also. But the result is the same.
Please suggest what needs to be done for it.
Configuring the MySQL in Windows Vista with Norton Internet Security 2009.

Yes, I have already included the "SecurityCheck" as below.
I have restarted the JBoss Server in debug mode in MyEclispe and plasced the breakpoint insdie the SecurityCheck, but it's not going here.
I have put sysout in SecurityCheck and that's also not printing.

<application-policy name="testDB"> <authentication> <!--login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag="required"--> <login-module code="com.example.security.SecurityCheck" flag="required"> <module-option name="hashAlgorithm">MD5</module-option> <module-option name="hashEncoding">base64</module-option> <module-option name="hashUserPassword">true</module-option> <module-option name="hashStorePassword">true</module-option> <module-option name="dsJndiName">java:/MySqlDS</module-option> <module-option name="principalsQuery"> select passwd from Users username where username=?</module-option> <module-option name="rolesQuery"> select userRoles, 'Roles' from UserRoles where username=?</module-option> </login-module> </authentication> </application-policy>

public class SecurityCheck extends DatabaseServerLoginModule { public SecurityCheck(){ System.out.println("INSIDE SecurityCheck ::::::::::"); } @Override protected boolean validatePassword(String inputPassword,String expectedPassword) { byte[] defaultBytes = inputPassword.getBytes(); System.out.println("defaultBytes ::"+defaultBytes); try{ MessageDigest algorithm = MessageDigest.getInstance("MD5"); algorithm.reset(); algorithm.update(defaultBytes); byte messageDigest[] = algorithm.digest(); StringBuffer hexString = new StringBuffer(); for (int i=0;i<messageDigest.length;i++) { hexString.append(Integer.toHexString(0xFF & messageDigest[i])); } String foo = messageDigest.toString(); System.out.println("sessionid "+inputPassword+" md5 version is "+hexString.toString()); System.out.println("foo "+foo); inputPassword=hexString+""; }catch(Exception e){ e.printStackTrace(); } return super.validatePassword(inputPassword, expectedPassword); } } >

As suggessted by you, I have decided to subclass the DatabaseServerLoginModule.
But I am facing some issues. In the below implementation of DatabaseServerLoginModule, they are getting the password from the DB.
So the password will be MD5 encrypted value "5f4dcc3b5aa765d61d8327deb882cf99"
After getting the password, I am sending it to convertRawPassword(password) mehtod. The issue I am facing is I couldn't able to decrypt the encrypted value.
For example the clear password is "password" and encrypted one stored in DB is "5f4dcc3b5aa765d61d8327deb882cf99".
I have googled on decrypting the MD5 encrypted password, but everyone is telling it's one way encrytpion and can't decrypt the MD5.
In that case overriding the convertRawPassword(password) mehtod won't be useful.
So I have decided to do it in other way, instead of getting the decrypted value from DB and encrypt it(which is not possible with MD5) to match the clear password,
I decided to encrypt the user entered clear test password, so that it will matches the DB value.

So I have overridden the validatePassword(String inputPassword,String expectedPassword) method from UsernamePasswordLoginModule class.
But It's not invoking this method itself.
Anything I am missing?

public class SecurityCheck extends DatabaseServerLoginModule { String hashCharset = null; @Override protected boolean validatePassword(String inputPassword,String expectedPassword) { byte[] defaultBytes = inputPassword.getBytes(); System.out.println("defaultBytes ::"+defaultBytes); try{ MessageDigest algorithm = MessageDigest.getInstance("MD5"); algorithm.reset(); algorithm.update(defaultBytes); byte messageDigest[] = algorithm.digest(); StringBuffer hexString = new StringBuffer(); for (int i=0;i<messageDigest.length;i++) { hexString.append(Integer.toHexString(0xFF & messageDigest[i])); } String foo = messageDigest.toString(); System.out.println("sessionid "+inputPassword+" md5 version is "+hexString.toString()); System.out.println("foo "+foo); inputPassword=hexString+""; }catch(Exception e){ e.printStackTrace(); } return super.validatePassword(inputPassword, expectedPassword); } } >

Thanks for the reply.
Is there any demo/links/resource available on how to use together the Display Tag and AjaxTag with Struts?

I am developing a web application in Struts 1.3.10 and decided to use Ajax, since I will be having more input fields & drop downs in the form.
I want to know how to use AjaxTags with Struts. I have googled and didn't get any useful resources, as each one implementing the AjaxTags in their own way.
Is there any standardized way to use AjaxTags with Struts. I have also decided to use display tags. I have got a nice demo in the display tag site.
But I want to use Display Tag with Ajax Tag in Struts.
If anyone has any good resources/links/sample demo/example will be helpful in developing my application.

Peter,

Yes, you are correct. If I am login with '5f4dcc3b5aa765d61d8327deb882cf99', then I can able to successfully login.
So you mean to say that we need to write our own class which will extends the DatabaseServerLoginModule and override the convertRawPassword(String rawPassword) method.

I have few dobuts in it.
In the login-config.xml I have included the following configuration related to hashing the password which will be taken care by JBoss server.
<application-policy name="testDB"> <authentication> <!--login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag="required"--> <login-module code="com.example.security.MySecurityCheck" flag="required"> <b><module-option name="hashAlgorithm">MD5</module-option> <module-option name="hashEncoding">base64</module-option> <module-option name="hashUserPassword">true</module-option> <module-option name="hashStorePassword">true</module-option></b> <module-option name="dsJndiName">java:/MySqlDS</module-option> <module-option name="principalsQuery"> select passwd from Users username where username=?</module-option> <module-option name="rolesQuery"> select userRoles, 'Roles' from UserRoles where username=?</module-option> </login-module> </authentication> </application-policy>
I have noticed that the DatabaseServerLoginModule extends UsernamePasswordLoginModule.
The main purpose of configuration related to hasing password in login-config is, so that the UsernamePasswordLoginModule will use it hash the password (I am not sure. If not what is the purpose of above configuration related to hashing).
In that case, why I need to again encrypt/decrypt the password.

And If you look at the code in UsernamePasswordLoginModule, they are handling some hashing realted thing. But I am not sure what they are doing?

What I thought is if we done the configuration as like above, the JBoss will get the clear text password which user enters and if the hash related configration is enabled, it will encrypt the clear text password and then it will compare it against with DB encrypted password and authenticate.

public void initialize(Subject subject, CallbackHandler callbackHandler, Map sharedState, Map options) { super.initialize(subject, callbackHandler, sharedState, options); // Check for unauthenticatedIdentity option. String name = (String) options.get("unauthenticatedIdentity"); if (name != null) { unauthenticatedIdentity = new SimplePrincipal(name); super.log.trace("Saw unauthenticatedIdentity=" + name); } // Check to see if password hashing has been enabled. // If an algorithm is set, check for a format and charset. hashAlgorithm = (String) options.get("hashAlgorithm"); if (hashAlgorithm != null) { hashEncoding = (String) options.get("hashEncoding"); if (hashEncoding == null) hashEncoding = Util.BASE64_ENCODING; hashCharset = (String) options.get("hashCharset"); if (log.isTraceEnabled()) { log.trace("Passworg hashing activated: algorithm = " + hashAlgorithm + ", encoding = " + hashEncoding + (hashCharset == null ? "" : "charset = " + hashCharset)); } } String flag = (String) options.get("ignorePasswordCase"); ignorePasswordCase = Boolea


I am using the below program to encrypt the password and I have read in one article that we can't able to decrypt the encrypted value using MD5 Message Digest.
String sessionid = "password"; byte[] defaultBytes = sessionid.getBytes(); System.out.println("defaultBytes ::"+defaultBytes); try{ MessageDigest algorithm = MessageDigest.getInstance("MD5"); algorithm.reset(); algorithm.update(defaultBytes); byte messageDigest[] = algorithm.digest(); StringBuffer hexString = new StringBuffer(); for (int i=0;i<messageDigest.length;i++) { hexString.append(Integer.toHexString(0xFF & messageDigest[i])); } String foo = messageDigest.toString(); System.out.println("sessionid "+sessionid+" md5 version is "+hexString.toString()); System.out.println("foo "+foo); sessionid=hexString+""; }catch(NoSuchAlgorithmException nsae){ }

for example:
I have encrypted the password "password" as "5f4dcc3b5aa765d61d8327deb882cf99" using MD5.
Is it possible to convert the "5f4dcc3b5aa765d61d8327deb882cf99" to "password"?

To trace the log I have modified the jboss-log4j.xml but I couldn't able to see any log details in either CONSOLE/FILE. Below is my jboss-lo4j.xml.

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE log4j:configuration SYSTEM "log4j.dtd"> <log4j:configuration xmlns:log4j="http://jakarta.apache.org/log4j/" debug="false"> <!-- A time/date based rolling appender --> <appender name="FILE" class="org.jboss.logging.appender.DailyRollingFileAppender"> <errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> <param name="File" value="${jboss.server.log.dir}/server.log"/> <param name="Append" value="false"/> <!-- Rollover at midnight each day --> <param name="DatePattern" value="'.'yyyy-MM-dd"/> <!-- Rollover at the top of each hour <param name="DatePattern" value="'.'yyyy-MM-dd-HH"/> --> <layout class="org.apache.log4j.PatternLayout"> <!-- The default pattern: Date Priority [Category] Message\n --> <param name="ConversionPattern" value="%d %-5p [%c] %m%n"/> <!-- The full pattern: Date MS Priority [Category] (Thread:NDC) Message\n <param name="ConversionPattern" value="%d %-5r %-5p [%c] (%t:%x) %m%n"/> --> </layout> </appender> <!-- ============================== --> <!-- Append messages to the console --> <!-- ============================== --> <appender name="CONSOLE" class="org.apache.log4j.ConsoleAppender"> <errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> <param name="Target" value="System.out"/> <!-- Changed by Mike for logging Databaseloginmodule -JBoss --> <!--param name="Threshold" value="INFO"/--> <param name="Threshold" value="TRACE"/> <layout class="org.apache.log4j.PatternLayout"> <!-- The default pattern: Date Priority [Category] Message\n --> <param name="ConversionPattern" value="%d{ABSOLUTE} %-5p [%c{1}] %m%n"/> </layout> </appender> <!-- ================ --> <!-- Limit categories --> <!-- ================ --> <!-- Added by Micheal John ---> <category name="org.jboss.security"> <priority value="TRACE"/> <appender-ref ref="CONSOLE"/> </category> <category name="org.jboss.ejb.plugins.cmp"> <priority value="DEBUG"/> </category> <category name="org.jboss.ejb.plugins.cmp"> <priority value="TRACE" class="org.jboss.logging.XLevel"/> </category> <!-- Limit the org.apache category to INFO as its DEBUG is verbose --> <category name="org.apache"> <priority value="INFO"/> </category> <!-- Limit the jacorb category to WARN as its INFO is verbose --> <category name="jacorb"> <priority value="WARN"/> </category> <!-- Limit the org.jgroups category to WARN as its INFO is verbose --> <category name="org.jgroups"> <priority value="WARN"/> </category> <!-- Limit the org.quartz category to INFO as its DEBUG is verbose --> <category name="org.quartz"> <priority value="INFO"/> </category> <!-- Limit JBoss categories <category name="org.jboss"> <priority value="INFO"/> </category> --> <!-- Limit the JSR77 categories --> <category name="org.jboss.management"> <priority value="INFO"/> </category> <!-- Limit the org.jboss.serial (jboss-serialization) to INFO as its DEBUG is verbose --> <category name="org.jboss.serial"> <priority value="INFO"/> </category> <!-- ======================= --> <!-- Setup the Root category --> <!-- ======================= --> <root> <appender-ref ref="CONSOLE"/> <appender-ref ref="FILE"/> </root> </log4j:configuration>

Please advice.>

I am using JBoss 4.2.2GA application server with Struts and EJB.
I am trying to encrypt the password using the message digest - MD5(given below) and store it in the mysql DB.
Using DatabaseServerLoginModule, I am trying to authenticate, but it's failing. Please help on this.
Please help whether any configuration setting needs to be done.

I want to know how to turn on the log for the DataBaseLogin module to see the log trace. Please help how to do it and what needs to added in jboss-log4j.xml.

I have added the below line in the jboss-log4j.xml, but no output is generated either at console or file.
Any help/advice/suggestion/input will be more helpful for me.

<!--category name="org.jboss.security"> <priority value="TRACE"/> </category-->
login.config.xml
==================
<application-policy name="testDB"> <authentication> <login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag="required"> <module-option name="hashAlgorithm">MD5</module-option> <module-option name="hashEncoding">base64</module-option> <module-option name="hashUserPassword">true</module-option> <module-option name="hashStorePassword">true</module-option> <module-option name="dsJndiName">java:/MySqlDS</module-option> <module-option name="principalsQuery"> select passwd from Users username where username=?</module-option> <module-option name="rolesQuery"> select userRoles, 'Roles' from UserRoles where username=?</module-option> </login-module> </authentication> </application-policy>

I am using the below program to encrypt the password using MD5 and storing the encrypted value "5f4dcc3b5aa765d61d8327deb882cf99" in mysql table
import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; public class MainClass { public static void main(String args[]) throws Exception { String sessionid = "password"; byte[] defaultBytes = sessionid.getBytes(); System.out.println("defaultBytes ::"+defaultBytes); try{ MessageDigest algorithm = MessageDigest.getInstance("MD5"); algorithm.reset(); algorithm.update(defaultBytes); byte messageDigest[] = algorithm.digest(); StringBuffer hexString = new StringBuffer(); for (int i=0;i<messageDigest.length;i++) { hexString.append(Integer.toHexString(0xFF & messageDigest )); } String foo = messageDigest.toString(); System.out.println("sessionid "+sessionid+" md5 version is "+hexString.toString()); System.out.println("foo "+foo); sessionid=hexString+""; }catch(NoSuchAlgorithmException nsae){ } } } output: ------- defaultBytes ::[B@192d342 sessionid password md5 version is 5f4dcc3b5aa765d61d8327deb882cf99 foo [B@167d940



my mysql tables
[code ]

mysql> select * from userroles;
+----------+-----------+
| username | userRoles |
+----------+-----------+
| ram | admin |
| sachin | guest |
| tiger | admin |
+----------+-----------+
3 rows in set (0.14 sec)

mysql> select * from users;
+----------+----------------------------------+
| username | passwd |
+----------+----------------------------------+
| ram | passwd |
| sachin | passwd |
| tiger | 5f4dcc3b5aa765d61d8327deb882cf99 |
+----------+----------------------------------+
3 rows in set (0.17 sec)

[/code]

Geting the error message:
19:51:29,212 DEBUG [DatabaseServerLoginModule] Bad password for username=tiger

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE log4j:configuration SYSTEM "log4j.dtd"> <!-- ===================================================================== --> <!-- --> <!-- Log4j Configuration --> <!-- --> <!-- ===================================================================== --> <!-- $Id: jboss-log4j.xml 65459 2007-09-19 00:25:51Z dimitris@jboss.org $ --> <!-- | For more configuration infromation and examples see the Jakarta Log4j | owebsite: http://jakarta.apache.org/log4j --> <log4j:configuration xmlns:log4j="http://jakarta.apache.org/log4j/" debug="false"> <!-- ================================= --> <!-- Preserve messages in a local file --> <!-- ================================= --> <appender name="CONSOLE" class="org.apache.log4j.ConsoleAppender"> <errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> <param name="Target" value="System.out"/> <param name="Threshold" value="DEBUG" /> <layout class="org.apache.log4j.PatternLayout"> <!-- The default pattern: Date Priority [Category] Message\n --> <param name="ConversionPattern" value="%d{ABSOLUTE} %-5p [%c{1}] %m%n"/> </layout> </appender> <!-- A time/date based rolling appender --> <appender name="FILE" class="org.jboss.logging.appender.DailyRollingFileAppender"> <errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> <param name="File" value="${jboss.server.log.dir}/server.log"/> <param name="Append" value="false"/> <!-- Rollover at midnight each day --> <param name="DatePattern" value="'.'yyyy-MM-dd"/> <!-- Rollover at the top of each hour <param name="DatePattern" value="'.'yyyy-MM-dd-HH"/> --> <layout class="org.apache.log4j.PatternLayout"> <!-- The default pattern: Date Priority [Category] Message\n --> <param name="ConversionPattern" value="%d %-5p [%c] %m%n"/> <!-- The full pattern: Date MS Priority [Category] (Thread:NDC) Message\n <param name="ConversionPattern" value="%d %-5r %-5p [%c] (%t:%x) %m%n"/> --> </layout> </appender> <!-- A size based file rolling appender <appender name="FILE" class="org.jboss.logging.appender.RollingFileAppender"> <errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> <param name="File" value="${jboss.server.log.dir}/server.log"/> <param name="Append" value="false"/> <param name="MaxFileSize" value="500KB"/> <param name="MaxBackupIndex" value="1"/> <layout class="org.apache.log4j.PatternLayout"> <param name="ConversionPattern" value="%d %-5p [%c] %m%n"/> </layout> </appender> --> <!-- ============================== --> <!-- Append messages to the console --> <!-- ============================== --> <appender name="CONSOLE" class="org.apache.log4j.ConsoleAppender"> <errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> <param name="Target" value="System.out"/> <param name="Threshold" value="INFO"/> <layout class="org.apache.log4j.PatternLayout"> <!-- The default pattern: Date Priority [Category] Message\n --> <param name="ConversionPattern" value="%d{ABSOLUTE} %-5p [%c{1}] %m%n"/> </layout> </appender> <!-- ====================== --> <!-- More Appender examples --> <!-- ====================== --> <!-- Buffer events and log them asynchronously <appender name="ASYNC" class="org.apache.log4j.AsyncAppender"> <errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> <appender-ref ref="FILE"/> <appender-ref ref="CONSOLE"/> <appender-ref ref="SMTP"/> </appender> --> <!-- EMail events to an administrator <appender name="SMTP" class="org.apache.log4j.net.SMTPAppender"> <errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> <param name="Threshold" value="ERROR"/> <param name="To" value="admin@myhost.domain.com"/> <param name="From" value="nobody@myhost.domain.com"/> <param name="Subject" value="JBoss Sever Errors"/> <param name="SMTPHost" value="localhost"/> <param name="BufferSize" value="10"/> <layout class="org.apache.log4j.PatternLayout"> <param name="ConversionPattern" value="[%d{ABSOLUTE},%c{1}] %m%n"/> </layout> </appender> --> <!-- Syslog events <appender name="SYSLOG" class="org.apache.log4j.net.SyslogAppender"> <errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> <param name="Facility" value="LOCAL7"/> <param name="FacilityPrinting" value="true"/> <param name="SyslogHost" value="localhost"/> <layout class="org.apache.log4j.PatternLayout"> <param name="ConversionPattern" value="[%d{ABSOLUTE},%c{1}] %m%n"/> </layout> </appender> --> <!-- Log events to JMS (requires a topic to be created) <appender name="JMS" class="org.apache.log4j.net.JMSAppender"> <errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> <param name="Threshold" value="ERROR"/> <param name="TopicConnectionFactoryBindingName" value="java:/ConnectionFactory"/> <param name="TopicBindingName" value="topic/MyErrorsTopic"/> </appender> --> <!-- Log events through SNMP <appender name="TRAP_LOG" class="org.apache.log4j.ext.SNMPTrapAppender"> <errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> <param name="ImplementationClassName" value="org.apache.log4j.ext.JoeSNMPTrapSender"/> <param name="ManagementHost" value="127.0.0.1"/> <param name="ManagementHostTrapListenPort" value="162"/> <param name="EnterpriseOID" value="1.3.6.1.4.1.24.0"/> <param name="LocalIPAddress" value="127.0.0.1"/> <param name="LocalTrapSendPort" value="161"/> <param name="GenericTrapType" value="6"/> <param name="SpecificTrapType" value="12345678"/> <param name="CommunityString" value="public"/> <param name="ForwardStackTraceWithTrap" value="true"/> <param name="Threshold" value="DEBUG"/> <param name="ApplicationTrapOID" value="1.3.6.1.4.1.24.12.10.22.64"/> <layout class="org.apache.log4j.PatternLayout"> <param name="ConversionPattern" value="%d,%p,[%t],[%c],%m%n"/> </layout> </appender> --> <!-- Emit events as JMX notifications <appender name="JMX" class="org.jboss.monitor.services.JMXNotificationAppender"> <errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> <param name="Threshold" value="WARN"/> <param name="ObjectName" value="jboss.system:service=Logging,type=JMXNotificationAppender"/> <layout class="org.apache.log4j.PatternLayout"> <param name="ConversionPattern" value="%d %-5p [%c] %m"/> </layout> </appender> --> <!-- ================ --> <!-- Limit categories --> <!-- ================ --> <!-- Added by Micheal John ---> <!--category name="org.jboss.security"> <priority value="TRACE"/> </category--> <category name="org.jboss.ejb.plugins.cmp"> <priority value="DEBUG"/> </category> <category name="org.jboss.ejb.plugins.cmp"> <priority value="TRACE" class="org.jboss.logging.XLevel"/> </category> <!-- Limit the org.apache category to INFO as its DEBUG is verbose --> <category name="org.apache"> <priority value="INFO"/> </category> <!-- Limit the jacorb category to WARN as its INFO is verbose --> <category name="jacorb"> <priority value="WARN"/> </category> <!-- Limit the org.jgroups category to WARN as its INFO is verbose --> <category name="org.jgroups"> <priority value="WARN"/> </category> <!-- Limit the org.quartz category to INFO as its DEBUG is verbose --> <category name="org.quartz"> <priority value="INFO"/> </category> <!-- Limit JBoss categories <category name="org.jboss"> <priority value="INFO"/> </category> --> <!-- Limit the JSR77 categories --> <category name="org.jboss.management"> <priority value="INFO"/> </category> <!-- Show the evolution of the DataSource pool in the logs [inUse/Available/Max] <category name="org.jboss.resource.connectionmanager.JBossManagedConnectionPool"> <priority value="TRACE"/> </category> --> <!-- Limit the org.jboss.serial (jboss-serialization) to INFO as its DEBUG is verbose --> <category name="org.jboss.serial"> <priority value="INFO"/> </category> <!-- Decrease the priority threshold for the org.jboss.varia category <category name="org.jboss.varia"> <priority value="DEBUG"/> </category> --> <!-- Enable JBossWS message tracing <category name="org.jboss.ws.core.MessageTrace"> <priority value="TRACE"/> </category> --> <!-- | An example of enabling the custom TRACE level priority that is used | by the JBoss internals to diagnose low level details. This example | turns on TRACE level msgs for the org.jboss.ejb.plugins package and its | subpackages. This will produce A LOT of logging output. | | Note: since jboss AS 4.2.x, the trace level is supported natively by | log4j, so although the custom org.jboss.logging.XLevel priority will | still work, there is no need to use it. The two examples that follow | will both enable trace logging. <category name="org.jboss.system"> <priority value="TRACE" class="org.jboss.logging.XLevel"/> </category> <category name="org.jboss.ejb.plugins"> <priority value="TRACE"/> </category> --> <!-- | Logs these events to SNMP: - server starts/stops - cluster evolution (node death/startup) - When an EJB archive is deployed (and associated verified messages) - When an EAR archive is deployed <category name="org.jboss.system.server.Server"> <priority value="INFO" /> <appender-ref ref="TRAP_LOG"/> </category> <category name="org.jboss.ha.framework.interfaces.HAPartition.lifecycle"> <priority value="INFO" /> <appender-ref ref="TRAP_LOG"/> </category> <category name="org.jboss.deployment.MainDeployer"> <priority value="ERROR" /> <appender-ref ref="TRAP_LOG"/> </category> <category name="org.jboss.ejb.EJBDeployer"> <priority value="INFO" /> <appender-ref ref="TRAP_LOG"/> </category> <category name="org.jboss.deployment.EARDeployer"> <priority value="INFO" /> <appender-ref ref="TRAP_LOG"/> </category> --> <!-- Clustering logging --> <!-- Uncomment the following to redirect the org.jgroups and org.jboss.ha categories to a cluster.log file. <appender name="CLUSTER" class="org.jboss.logging.appender.RollingFileAppender"> <errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> <param name="File" value="${jboss.server.log.dir}/cluster.log"/> <param name="Append" value="false"/> <param name="MaxFileSize" value="500KB"/> <param name="MaxBackupIndex" value="1"/> <layout class="org.apache.log4j.PatternLayout"> <param name="ConversionPattern" value="%d %-5p [%c] %m%n"/> </layout> </appender> <category name="org.jgroups"> <priority value="DEBUG" /> <appender-ref ref="CLUSTER"/> </category> <category name="org.jboss.ha"> <priority value="DEBUG" /> <appender-ref ref="CLUSTER"/> </category> --> <!-- ======================= --> <!-- Setup the Root category --> <!-- ======================= --> <root> <appender-ref ref="CONSOLE"/> <appender-ref ref="FILE"/> </root> </log4j:configuration>

Please help on the below query.

I am trying to encrypt the password using the message digest - MD5(given below) and store it in the mysql DB.
Using DatabaseServerLoginModule, I am trying to authenticate, but it's failing. Please help on this.

<application-policy name="testDB"> <authentication> <login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag="required"> [b] <module-option name="hashAlgorithm">MD5</module-option> <module-option name="hashEncoding">base64</module-option> <module-option name="hashUserPassword">true</module-option> <module-option name="hashStorePassword">true</module-option> [/b] <module-option name="dsJndiName">java:/MySqlDS</module-option> <module-option name="principalsQuery"> select passwd from Users username where username=?</module-option> <module-option name="rolesQuery"> select userRoles, 'Roles' from UserRoles where username=?</module-option> </login-module> </authentication> </application-policy>

import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; public class MainClass { public static void main(String args[]) throws Exception { String sessionid = "password"; byte[] defaultBytes = sessionid.getBytes(); System.out.println("defaultBytes ::"+defaultBytes); try{ MessageDigest algorithm = MessageDigest.getInstance("MD5"); algorithm.reset(); algorithm.update(defaultBytes); byte messageDigest[] = algorithm.digest(); StringBuffer hexString = new StringBuffer(); for (int i=0;i<messageDigest.length;i++) { hexString.append(Integer.toHexString(0xFF & messageDigest[i])); } String foo = messageDigest.toString(); System.out.println("sessionid "+sessionid+" md5 version is "+hexString.toString()); System.out.println("foo "+foo); sessionid=hexString+""; }catch(NoSuchAlgorithmException nsae){ } } } output: ------- defaultBytes ::[B@192d342 sessionid password md5 version is 5f4dcc3b5aa765d61d8327deb882cf99 foo [B@167d940

mysql> select * from userroles; +----------+-----------+ | username | userRoles | +----------+-----------+ | ram | admin | | sachin | guest | | tiger | admin | +----------+-----------+ 3 rows in set (0.14 sec) mysql> select * from users; +----------+----------------------------------+ | username | passwd | +----------+----------------------------------+ | ram | passwd | | sachin | passwd | | tiger | 5f4dcc3b5aa765d61d8327deb882cf99 | +----------+----------------------------------+ 3 rows in set (0.17 sec)

Geting the error message:
19:51:29,212 DEBUG [DatabaseServerLoginModule] Bad password for username=tiger

But for the userid: ram and passwd, I am able to login. Whereas for the user "tiger" with the encrypted password, I couldn't able to login.
Please throw some light on it. Please help to check the configuration in login-config.xml

And I have an another doubt. If the user is attempting to enter invalid password for more than 5 times, we need to lock his account.
Whether JBoss' DatabaseServerLoginModule or any other loginmodule is providing this functionality? If not, how to achieve?

still having hope on this forum..any advice/help?

I think, I haven't explained properly. I have two scenarios to explain.

Scenario 1:

I am developing an web application with Struts 1.3.10 and EJB 2.1 with JBoss 4.2.2, which captures users loan/EMI/insurance details. For each user there will have some important events to be notified. for example the due date of the loan amount, it has to generate the mail to user reminding him the due. For this user no need to login into an application. For example: everday at 8 am, one program has to run and get the details of each user to be notified.

Scenario 2:
Using the web application user can able to add some reminders and it's stored in the DB. whenever the user is in the session (logged into the application) and if the reminders falls into it we need to show the pop up of the reminder. For this user needs to be logged into the application.

I thought of doing like Outlook rather than a pop up. Whenever we received a new mail, one sliding window comes up right..like that.

I just started to work on this. Don't where and how to start. Any java/third party (prefably open source) related API specifically for this.

I would like to know how to implement the reminders/task to do list/events in the web aplication (Struts).
For example: I want to set the reminders on the particular day/time, so that pop up should opened to notify the user about the event.
The events details will be stored in the DB. I don't want to check the DB now and then, as it will have the performance hit?
Each day, on particular time, need to notify the user about the events/reminders pending for the particular user?
I know the concept of servlet listeners, but how can we use it to achieve this?
any inputs/suggestions/links?

please help on this.

any inputs/suggestion/idea/advice/links on this???

Sorry.. I thouht posting this ajaz forum and posted here. help to move to ajax forum