Showing posts with label security. Show all posts
Showing posts with label security. Show all posts

Tuesday, November 8, 2011

JSP charset usage for security fixing

JSP encoding usage:

===============================================
Посмотрел JSP login.jsp и т.д. страницы. И вот в чем заключается проблема невозможности залогинится в паролем/именем заданым не в латинской кодировке.

1. Очень хорошая привычка начинать любую JSP станицу примено так:
<%@ page contentType="text/html; charset=UTF-8" language="java"%>
В проекте так начинается только одна страница error.jsp, а та страница для которой это критично такой строки не имеет!
Тогда строка становится не нужной (она почему-то тоже есть только в одной из JSP страниц).

2. Из-за особенностей передачи данных в HTML форме нужно правильно настроить аутентикация в tomcat.
В контекстном файле приложения, в случае c site.war/META-INF/context.xml нужно указать такое:


Если выполнить эти пункта то аутентикация будет работать правильно для любых символов в пароле или имени.
===============================================
Posted by Alexey Zavizionov at 3:02 PM 0 comments
Labels: , ,

Monday, February 28, 2011

Axis 403 Forbidden

PROBLEM:
axis thread got an exception: (403)Forbidden


[ERROR] WSRPStarter -  --- WSRP1: axis thread got an exception: (403)Forbidden
AxisFault
 faultCode: {http://xml.apache.org/axis/}HTTP
 faultSubcode: 
 faultString: (403)Forbidden
 faultActor: 
 faultNode: 
 faultDetail: 
 {}:return code:  403
<html><head><title>Apache Tomcat/6.0.26 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 403 - Access to the requested resource has been denied</h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u>Access to the requested resource has been denied</u></p><p><b>description</b> <u>Access to the specified resource (Access to the requested resource has been denied) has been forbidden.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/6.0.26</h3></body></html>
 {http://xml.apache.org/axis/}HttpErrorCode:403

(403)Forbidden
 at org.apache.axis.transport.http.HTTPSender.readFromSocket(HTTPSender.java:755)
 at org.apache.axis.transport.http.HTTPSender.invoke(HTTPSender.java:144)
 at org.apache.axis.strategies.InvocationStrategy.visit(InvocationStrategy.java:32)
 at org.apache.axis.SimpleChain.doVisiting(SimpleChain.java:118)
 at org.apache.axis.SimpleChain.invoke(SimpleChain.java:83)
 at org.apache.axis.client.AxisClient.invokeTransport(AxisClient.java:150)
 at org.apache.axis.client.AxisClient.invoke(AxisClient.java:289)
 at org.apache.axis.client.Call.invokeEngine(Call.java:2838)
 at org.apache.axis.client.Call.invoke(Call.java:2824)
 at org.apache.axis.client.Call.invoke(Call.java:1815)
 at org.exoplatform.services.wsrp.AdminClient.process(AdminClient.java:252)
 at org.exoplatform.services.wsrp.producer.impl.WSRPStarter$AxisThread.run(WSRPStarter.java:166)




SOLUTION:
Provide correct role-name "admin"


  
    
      user authentication
      /services/*
      /services2/*
      POST
      GET
    
    
      admin 
    
    
      NONE
    
  

  
    BASIC
    exo-domain
  

  
    a simple user role
    admin
Posted by Alexey Zavizionov at 7:36 PM 0 comments
Labels: , ,

Monday, March 17, 2008

Print login module info

private void print() {

System.out.println(">>> -------------------------------------------------- = ");
System.out.println(">>> EXOMAN MyLoginModule.print() subject = " + subject);
System.out.println(">>> EXOMAN MyLoginModule.print() callbackHandler = " + callbackHandler);
System.out.println(">>> EXOMAN MyLoginModule.print() sharedState = " + sharedState);
System.out.println(">>> EXOMAN MyLoginModule.print() options = " + options);

if (subject != null) {
System.out.println(">>> EXOMAN MyLoginModule.print() subject.getClass() = " + subject.getClass());

// print private credentials
System.out.println(">>> EXOMAN MyLoginModule.print() subject.getPrivateCredentials() = " + subject.getPrivateCredentials());
Set priv = subject.getPrivateCredentials();
System.out.println(">>> EXOMAN MyLoginModule.print() priv = " + priv);
if (priv != null && !priv.isEmpty()) {
Iterator privIt = priv.iterator();
while (privIt.hasNext()) {
Object elem = privIt.next();
System.out.println(">>> EXOMAN MyLoginModule.print() elem.getClass() = " + elem.getClass());
}
}

// print public credentials
System.out.println(">>> EXOMAN MyLoginModule.print() subject.getPublicCredentials() = " + subject.getPublicCredentials());
Set pub = subject.getPublicCredentials();
System.out.println(">>> EXOMAN MyLoginModule.print() pub = " + pub);
if (pub != null && !pub.isEmpty()) {
Iterator pubIt = pub.iterator();
while (pubIt.hasNext()) {
Object elem = pubIt.next();
System.out.println(">>> EXOMAN MyLoginModule.print() elem.getClass() = " + elem.getClass());
}
}

// print principals
Set principals = subject.getPrincipals();
if (principals != null && !principals.isEmpty()) {
System.out.println(">>> EXOMAN MyLoginModule.print() principals = " + principals);
Iterator principalsIter = principals.iterator();
while (principalsIter.hasNext()) {
Principal elem = principalsIter.next();
System.out.println(">>> EXOMAN MyLoginModule.print() elem = " + elem);
System.out.println(">>> EXOMAN MyLoginModule.print() elem.getName() = " + elem.getName());
}
}
}

// print shared state
Iterator i = sharedState.keySet().iterator();
while (i.hasNext()) {
Object o = i.next();
System.out.println(">>> EXOMAN MyLoginModule.print() o = " + o);
System.out.println(">>> EXOMAN MyLoginModule.print() sharedState.get(o) = " + sharedState.get(o));
}

// print options
if (options != null && !options.isEmpty()) {
Iterator keyOpt = options.keySet().iterator();
while (keyOpt.hasNext()) {
Object opt = keyOpt.next();
System.out.println(">>> EXOMAN MyLoginModule.print() keyOpt = " + opt);
System.out.println(">>> EXOMAN MyLoginModule.print() options.get(keyOpt) = " + options.get(opt));
}
}

}
Posted by Alexey Zavizionov at 5:41 PM 2 comments
Labels: , ,

Sunday, February 24, 2008

J2EE security

J2EE security (JAAS)
en and ru resources

http://del.icio.us/search/?fr=del_icio_us&p=jaas&type=all

Реализация системы безопасности в Java
http://slonopotamus.org/java_security

Книга: Система безопасности Java. Руководство разработчика
JAAS. Как поместить remoteUser в сессию?
JAAS: секьюрити
Oracle: Declarative J2EE authentication and authorization with JAAS
http://java.sun.com/j2se/1.4.2/docs/guide/security/jaas/tutorials/SampleLoginModule.java

Security
JavaTM Authentication and Authorization Service (JAAS):
LoginModule Developer's Guide
Reference Guide

The J2EE 1.4 Tutorial
Understanding Login Authentication
J2EETutorial pdf

J2EE Form-based Authentication


Possible Solutions to Web Security Issues
IBM Cracks Web 2.0 Security Concerns with "SMash"

All that JAAS

D:\java\projects\projects\core\trunk\component\security\src\main\java\org\exoplatform\services\security\jaas\BasicLoginModule.java
package org.exoplatform.services.security.jaas;
public class BasicLoginModule implements LoginModule {

Possible Solutions to Web Security Issues

Tomcat JAAS. Фраза дня :)

логин конфиг в веб-хмл описывает реалм, для реалма прописан логин модуль, который обращается к нашему сервису, а в контексте описан класс приципала, который логин модуль поставит в сабджект
Posted by Alexey Zavizionov at 3:56 PM 2 comments
Labels: , ,
Subscribe to: Posts (Atom)