Joan Pujol

I have been investigating a little more an thats what I have:

DEBUG (MyLoginModule.java.java:98) - login() INFO (MyLoginModule.java.java:151) - User XXX ok with role YYY TRACE (org.jboss.security.ClientLoginModule.ClientLoginModule.java:103) - Security domain: MyDomain TRACE (org.jboss.security.ClientLoginModule.ClientLoginModule.java:121) - Enabling restore-login-identity mode TRACE (org.jboss.security.ClientLoginModule.ClientLoginModule.java:130) - Enabling useFirstPass mode TRACE (org.jboss.security.ClientLoginModule.ClientLoginModule.java:139) - Begin login TRACE (org.jboss.security.ClientLoginModule.ClientLoginModule.java:223) - commit, subject=Asunto: Principal: ajalife Principal: Roles(members:YYY) TRACE (org.jboss.security.SecurityAssociation.SecurityAssociation.java:460) - pushSubjectContext, subject=Asunto: Principal: XXX Principal: Roles(members:YYY)

This is the debug code I get just after lc.login in my servlet.

try { UsernamePasswordHandler handler = new UsernamePasswordHandler("XXX", "XXX"); LoginContext lc = new LoginContext("MyDomain", handler); lc.login(); }catch(Exception e ) { e.printStackTrace(); }

The problem is that then when the servlet ends I had this stacktrace:

ApplicationFilterChain.internalDoFilter(ServletRequest, ServletResponse) line: 252 ApplicationFilterChain.doFilter(ServletRequest, ServletResponse) line: 173 ReplyHeaderFilter.doFilter(ServletRequest, ServletResponse, FilterChain) line: 96 ApplicationFilterChain.internalDoFilter(ServletRequest, ServletResponse) line: 202 ApplicationFilterChain.doFilter(ServletRequest, ServletResponse) line: 173 StandardWrapperValve.invoke(Request, Response) line: 213 StandardContextValve.invoke(Request, Response) line: 178 SecurityAssociationValve.invoke(Request, Response) line: 175 BasicAuthenticator(AuthenticatorBase).invoke(Request, Response) line: 432 JaccContextValve.invoke(Request, Response) line: 74 StandardHostValve.invoke(Request, Response) line: 126 ErrorReportValve.invoke(Request, Response) line: 105 CachedConnectionValve.invoke(Request, Response) line: 156 SingleSignOn.invoke(Request, Response) line: 392 StandardEngineValve.invoke(Request, Response) line: 107 CoyoteAdapter.service(Request, Response) line: 148 Http11Processor.process(InputStream, OutputStream) line: 869 Http11Protocol$JmxHttp11ConnectionHandler(Http11BaseProtocol$Http11ConnectionHandler).processConnection(TcpConnection, Object[]) line: 664 PoolTcpEndpoint.processSocket(Socket, TcpConnection, Object[]) line: 527 MasterSlaveWorkerThread.run() line: 112 ThreadWithAttributes(Thread).run() line: 595

And when the arrives at BasicAuthenticator I get:

popRunAsIdentity, runAs=null and then: 2007-02-28 17:43:17,688 TRACE (org.jboss.security.SecurityAssociation.SecurityAssociation.java:555) - clear, server=true

It looks as if the credential are deleted, aren't they?

The login-config.xml has:

<application-policy name="MyDomain"> <authentication> <login-module code="MyModule" flag = "required"> <module-option name="password-stacking">useFirstPass</module-option> </login-module> <login-module code="org.jboss.security.ClientLoginModule" flag="required"> <module-option name="password-stacking">useFirstPass</module-option> <module-option name="restore-login-identity">false</module-option> </login-module> </authentication> </application-policy>

Someone can help in this nigthmare?�

Originally posted by Jaikiran Pai:


You mean, once you have logged in programatically, you want to pass the credentials forward? That can be done by adding the ClientLoginModule to your application policy that you configured in the login-config.xml. This might not make much sense unless you are able to you get the configurations right, first. Have you been able to add your application policy the the config file and use it in the servlet? If not, then i would start with this as a first step.

Yes the login modules work OK, and my loginmodule succefully validates de user. But the credentials aren't propagated.
I tried to add the ClientLoginModule but it doesn't works for me. When I go to another app with the same realm there is no credential.

Originally posted by Jaikiran Pai:


You can then use this login module from the servlet through the code that you have already posted.

Yes I can use the login module code. But then the credentials aren't put on the session.
I need to get the LoginContext that Jboss uses when I put restrictions in the apps to leave the credentials in the session.

Cheers,

That's correct. A programatic login is ok for me. I can use a non protected server to to the task.

But the problem is that then I don't know how to put manually a credential in my jboss realm..... (That's a requirement for me).

I've been reading Jboss documentation but it's a little nigthmare.

Cheers,

Hello,

I have made a simply SSO solution for us using digital signature in a parameter of the request (We recive simple request from a third party that we trust).

My LoginModule takes the request and validates if it trust the digital signature of the request. If it trusts, the login is Ok.
The problem that I have is that in the web.xml <auth-method> I have to put FORM,BASIC,DIGEST or CLIENT-CERT. There is somthing like none? Because I don't want any interaction with the user, and I don't need any info (only the request).

What I have know is a "working" solution with the problem that the user gets a BASIC auth dialog asking the password, what it's entered doesn't matter because the Loginmodule only looks at the request.

My question is there is something like auth-method NONE, or any workarround to don't ask any info to the user?�

A workarround that I have in mind, is use a nonprotected servlet in the app that manually puts the credentials. But, is that possible?

I've been reading at the docs of Jboss but I dont know.
I have:
UsernamePasswordHandler handler = new UsernamePasswordHandler("none", "none"); LoginContext lc = new LoginContext("xclinicportal", handler); lc.login();

The problem is that this is a local LoginContext, isn't it? How can I get the LoginContext that Jboss uses for the webapp?

A lot, lot, lot of thanks in advance, because this is a little nigthmare

Originally posted by Syed Wajid:
CONGRATS Joan Pujol.

WHAT IS YOUR OPINION ABOUT THE JAVA 5.0 TIGER DEVELOPERS HANDBOOK FROM OREILLY. DOES IT HAVE THE DEPTH ON THE TOPICS ?

I don't known this book. But if it covers generics and enums depply it can be a good book to complement a SCJP for the 1.4.
I readed a little the

I AM DESPERATE TO GIVE THE EXAM BUT AM NOT ABLE TO GET HOLD OF A NEAT BOOK THAT CAN EXPLAIN THE CONCEPTS IN DEPTH.

I readed the chapter on generics and enums of the Java� Programming Language, The, 4th Edition. And I have to say that is a very complete book.


HOW MUCH TIME DID YOU SPEND ON THEORY AND PRACTICALS AVERAGE ON A DAY ?

I difficult to answer this question. But...
+o- 2 hours a day for 2 month and 4 hours a day the last week.
I had previous Java experience, but not a lot of experience with 1.5 features.

THANKS.[/qb]

[ November 02, 2005: Message edited by: Joan Pujol ]

I'm very happy with the score , I didn't hope to score so high.
A lot, lot, lot of thanks to all the people to help me in the forums.


What I recommend:

Complete Java 2 Certification Book by Philip Heller
I think that by now is the best book, the concepts are well explained. The problem is that is INCOMPLETE. Don't go to the exam reading only this book, if you do so you will test your luck and surely you will score low if you have the luck to pass the exam.
I don't say that it's a bad book, until K&B is realased I think that is a good option if you don't want to wait.

Whizlabs for SCJP5
Good questions, really adapted to the SCJP5 with a lot of drag and drop questions and questions about new features.
When K&B will be released I think that you possibly you won't need it. But until that I think that it's the perfect complement to the Philip Heller.
Studing the book and making all the tests from Whizlabs I think that you can be quite sure to pass.
About the test I have to say that is more difficult than the exam. And that I don't like the scoring system. I recommend you to ignore the scoring system and calculate yourself the score based on failed questions.

The 11 hard-medium questions from K&B
Very good questions. I think that they are more difficult than the exam. But it's important that after doing the questions you try to learn the concepts to answer well them.

14 questions about generics
http://www.javabeat.net/javabeat/scjp5/mocks/index.php?page=mock1
Very good questions about generics. Also more difficult than the exam.
But I think that is important that you learn the concepts to answer well the questions.

If you do the three tests remember that all of three are more difficult than the exam. But try to understand the concepts to do well all the tests.


For me the more tricky questions where the ones on Threads. The generics were not tricky if you understand well the concepts like that you can't add elements to a wilcard type, that List<Object> is not the parent of all lists,...

The time is OK. If you start your exam with threads don't worry, you will need a lot of time on this questions, but then you will be more fast questions.


And Good Luck,

Originally posted by Rupak Khurana:
Another proof that Complete Java 2 Certification Study Guide by Heller and Roberts for java 5.0 SUCKS !!!

After reading this book, I postponed my exam date. They just hurried to bring the books to the shelf.

sorry about your result, wait for K&B and then retry..

I don't agree with you. The book doesn't sucks. By now I think that is the best book for scjp5. The problem is that it doesn't cover all the topics, and you have to know that you have to improve a lot some areas (mainly generics). But until K&B is released, I think that this book don't sucks, it's incomplete leaving important topics but the things that it explain, are well explained. I have scored 92% using the book, and other resources. I will post what I have used in the results forum.

Yes, you are rigth, they execute concurrently

What I'm not sure if you can be sure that it will be ABAB or BABA. Because you can't get any guarantees on sleep, can you?. Then it's possible that while for example A is sleeping B never gets executed, and when A wakes up A gets executed. My question is about this.

I think that in the real world, in practically every implementation of the JVM the result will be ABAB or BABA but, what says the JLS? That is the bible here, isn't it?

Well, today I go for the exam I hope there is no a question like this.

What about this question of Whizlabs exam:

class Test implements Runnable { public void run() { String str= new String("hello"); synchronized(str) { try{ System.out.print(Thread.currentThread().getName()); Thread.sleep(5000); System.out.print(Thread.currentThread().getName()); }catch(InterruptedException e) {} } } public static void main(String[]args) { new Thread(new Test(),"A").start(); new Thread(new Test(),"B").start(); } }

Correct answer: Prints "ABAB" or "BABA"

I know that in practically every situation this will be true. But it isn't guaranted, is it?
It's correct this aswer?

PD: Observe that the synchronized code does nothing because each thread has locks on diferent objects (str is an instace one).

I have made some mocks that give multiple options in this way:

A) ... //A is correct
B) ... //FALSE
C) ... //FALSE
D) ... //FALSE
E) Only A is correct

What questions have to mark, A and E or only E.
Or no such question in the exam?

Hello,

If I override start method of a Thread without calling super.start().
All works like a normal Thread?
Or I need to call always the super to get normal behaivour?

And if override it, the Thread is put at the READY state when the start ends, it isn't?

Hello someone can confirm me that this topics are not part of SCJP5:

native
strictcp
deprecated Thread methods: stop(),suspend(),resume()

Hello,

Someone knows mock questions to test cohesion and coupling?

A lot of thanks in advance,

Originally posted by Akshay Kiran:
are you sure (List<? extends Integer> doesn't throw a warning?

anyway, the explanation is that, the cast is probably needed at runtime
but at runtime, all generic info is erased, so it makes no sense to cast
List<Integer>
whereas List<?> is the same as List, so it doesn't complain about that.
this is what I think.

It's very strange, but I'm sure. For example

Object o=(List<? extends Integer> new ArrayList(); //No warning
Object o=(List<Integer> new ArrayList(); //Warning