single sign on - authenticate user on server side for Swing clients using kerberos/spnego -


i using kerberos protocol authenticate users java swing applications. able authenticate @ client side, having problems when getting user credentials , roles on server side, have got ejbs require roles create ejbs.

jboss-app.xml looks like

 <jboss-app>     <security-domain>java:/jaas/spnego-server</security-domain>            <loader-repository>paymenttracker:loader=paymenttracker.ear</loader-repository>  </jboss-app>

the client class calling subject.doas(s, lv); lv class extends privilegedexceptionaction.

on server side login-config.xml in jboss server got following setting

     <application-policy name="spnego-server"><authentication>      <login-module code="com.sun.security.auth.module.krb5loginmodule" flag="required" > <module-option name="storekey">true</module-option>  <module-option name="debug">true</module-option>  <module-option name="usekeytab">true</module-option>  <module-option name="keytab">file://c:/ker/tem.keytab</module-option>  <module-option name="principal">http/ws6421.ebrd.com</module-option>  <module-option name="donotprompt">true</module-option>  <module-option name="isinitiator">false</module-option>  </login-module></authentication> </application-policy>

getting following error :

16:09:28,990 info  [stdout] debug  true storekey true useticketcache false usekeytab true donotprompt true ticketcache null isinitiator false keytab file://c:/kerberos/ws6421.keytab refreshkrb5config false pr incipal http/ws6421.my.com tryfirstpass false usefirstpass false storepass false clearpass fa lse 16:09:29,087 info  [stdout] principal's key obtained keytab 16:09:29,087 info  [stdout] principal http/ws6421.my.com@my.com 16:09:29,088 info  [stdout] encryptionkey: keytype=23 keybytes (hex dump)=0000: a9 dd 6c ab c5 d3 a0 9d   c8 4 4 18 52 78 3e ab 82  ..l......d.rx>.. 16:09:29,094 info  [stdout] added server's keykerberos principal http/ws6421.ebrd.com@my.comkey version 0key  encryptionkey: keytype=23 keybytes (hex dump)= 0000: a9 dd 6c ab c5 d3 a0 9d   c8 44 18 52 78 3e ab 82  ..l......d.rx>.. 16:09:29,095 info  [stdout]             [krb5loginmodule] added krb5principal  http/ws6421.my.com@my.com t o subject 16:09:29,098 info  [stdout] commit succeeded 16:09:29,135 error [securityinterceptor] error in security interceptor java.lang.securityexception: denied: caller subject=subject:         principal: http/ws6421.my.com@my.com         private credential: kerberos principal http/ws6421.my.com@my.comkey version 0key encryptionkey: ke ytype=23 keybytes (hex dump)= 0000: a9 dd 6c ab c5 d3 a0 9d   c8 44 18 52 78 3e ab 82  ..l......d.rx>..    , security context post-mapping roles=null: ejbmethod=public abstract services.ejb.login.sblogin services.e jb.login.sbloginhome.create() throws javax.ejb.createexception,java.rmi.remoteexception         @ org.jboss.ejb.plugins.securityinterceptor.checksecuritycontext(securityinterceptor.java:368)         @ org.jboss.ejb.plugins.securityinterceptor.process(securityinterceptor.java:243)


Comments

Post a Comment

Popular posts from this blog

html - How to style widget with post count different than without post count -

i have border below li elements in wordpress widget types appropriate. element inside set block gives them nice easy click full width. the problem, when choose option "show post count" when adding widget such categories or archives displays post count plain text after tag , because tag block pushes post number text line below. whether choose show post count or not show post count still gives exact same element identifyer example "widget_categories". how style post count not on next line still keep links non post count list items full width? here's example on sidebar www.bbmthemes.com/themes/modular/blog-standard/ in order solve problem need remove display:block; for ul.widgets ul a , add in it's place line-height: 33px; what going achieve have same visual effect. what going lose doing links going work on text , not on "box". the other way out of find post count coming , make changes this. example change text count i...
Read more

How to remove text and logo OR add Overflow on Android ActionBar using AppCompat on API 8? -

have researched death , cannot find answer. i have actionbar using appcompat. supporting api v7 (api v8 do). actionbar works api v11. api < v11 has problem of removing icon (and feature) actionbar without supplying overflow. big picture have app logo, app title, , 3 icons squidging same actionbar on low end phone. trying make room! i happy 1 of 2 solutions. either: a method of getting overflow functionality can retrieved pull down. (preferred) method of removing icon , text actionbar below current xml api 11+: <resources> <!-- base application theme api 11+. theme replaces appbasetheme res/values/styles.xml on api 11+ devices. --> <style name="appbasetheme" parent="theme.appcompat.light.darkactionbar"> <item name="android:actionbarstyle">@style/liteactionbarstyle</item> <item name="actionbarstyle">@style/liteactionbarstyle</item> </st...
Read more

IIS->Tomcat Redirect: multiple worker with default -

i trying configure multiple instances of tomcat (7) behind single domain in iis. tomcat instances both run on separate ports. have installed tomcat isapi_rediect.dll , configured iis. everything works redirector, except (you knew coming) being told "all other traffic must mapped 1 of 2 instances (they different applications). more accurate requests except specific pattern need mapped 1 worker , specific pattern (/rpt) needs go other worker. i have 2 workers defined in workers.properties: worker.list=ajp13_1,ajp13_2 worker.ajp13_1.port=8009 worker.ajp13_2.port=8010 and following in uriworkermap.properties: /wxx|/*=ajp13_1 /rpt|/*=ajp13_2 with this, seems fine. except (considerable) number of request not include wxx scope. need map rpt , sub content ajp3_2 , other requests ajp3_1. if add /|*=ajp13_1 then ajp3_2 becomes unreachable , wildchar match maps /rpt/* uri ajp3_1. is there way trying do? appreciate help- have spent time reading same references ...
Read more