EJB logout with CSIV2 authentification

zako...@gmail.com

unread,

Apr 9, 2008, 10:58:34 AM4/9/08

to

Hi 
 
Im using secured EJB's over CSIV2 authentification, for that I setup my client application that reads sas.client.props and ssl.client.props and connect's correctly with EJB's, now the problem is when I try to log-in on that EJB's with another user on the same client program and thread, for that I change the com.ibm.CORBA.loginUserid and com.ibm.CORBA.loginPassword properties with the new username, but when EJB's try to get the username with "getCallerPrincipal().getName()" still appears the old username that was logged before. 
 
The EJB are SessionBean stateless. 
 
I tried to create a new home and lookup of the EJB but still remains the old user on context. 
 
¿There is any command to logout using this kind of authentification?

Paul Ilechko

unread,

Apr 9, 2008, 1:59:57 PM4/9/08

to

subject.doAs changes the identity on a thread.

zako...@gmail.com

unread,

Apr 10, 2008, 3:27:19 AM4/10/08

to

Hi

Thanks for your answer, but I still have some questions. Seems that when I log-in for first time on WAS it validates client JVM, because I get some traces of SAS such as: 

10-abr-2008 9:24:06 SASRas 
AUDIT: security.GettingConfig 
10-abr-2008 9:24:07 SASRas 
AUDIT: security.Protocol 
10-abr-2008 9:24:07 SASRas 
AUDIT: security.AuthTarget 
10-abr-2008 9:24:07 SASRas 
AUDIT: security.RegisterCurrent 
10-abr-2008 9:24:08 SASRas 
AUDIT: security.LoadSCI 
10-abr-2008 9:24:08 SASRas 
AUDIT: security.ClientCSI 
 
With WSSubject.doAs() can I run that validation again? Also remember that im not using JAAS so on client I don't have any instance of LoginContext or Subject 
 
Any idea? thanks in advance.

Paul Ilechko

unread,

Apr 10, 2008, 8:45:57 AM4/10/08

to

There is no way to login without using JAAS, so I don't understand what
you mean.

zako...@gmail.com

unread,

Apr 10, 2008, 11:06:28 AM4/10/08

to

Ok, I will try to explain what I did with a little example application. 
 
First of all I did a small session ejb without state called PruebaService.java with only this method: 
 
/** 
* An example business method 
* 
* @ejb.interface-method view-type = "remote" 
* 
* @throws EJBException 
* Thrown if method fails due to system-level error. 
*/ 
public void imprimeUser() 
{ 
System.out.println("PruebaService.imprimeUser()"); 
System.out.println("USUARIO"); 
System.out.println(ctx.getCallerPrincipal().getName()); 
System.out.println("FIN"); 
} 
 
For calling that EJB I create a simple java client (PruebaWebSphere.java) 
 
public class PruebaWebSphere 
{ 
 
public static void main(String[] args) 
{ 
 
/* PRUEBA WEBSPHERE */ 
try 
{ 
System.out.println("PruebaWebSphere.main()"); 
Properties env = new Properties(); 
env.setProperty(Context.INITIAL_CONTEXT_FACTORY, "com.ibm.websphere.naming.WsnInitialContextFactory"); 
env.setProperty(Context.PROVIDER_URL, "iiop://localhost:2809"); 
env.setProperty(Context.URL_PKG_PREFIXES, "com.ibm.ws.naming"); 
 
URL sasFileURL = PruebaWebSphere.class.getResource("sas.client.props"); 
InputStream is = new BufferedInputStream(sasFileURL.openStream()); 
System.getProperties().load(is); 
 
URL sslFileURL = PruebaWebSphere.class.getResource("ssl.client.props"); 
InputStream ssl = new BufferedInputStream(sslFileURL.openStream()); 
System.getProperties().load(ssl); 
 
String keystoreURI = PruebaWebSphere.class.getResource("key.p12").toExternalForm(); 
System.setProperty("com.ibm.ssl.keyStore", keystoreURI); 
String trustStoreURI = PruebaWebSphere.class.getResource("trust.p12").toExternalForm(); 
System.setProperty("com.ibm.ssl.trustStore", trustStoreURI); 
 
System.setProperty("com.ibm.CORBA.securityServerHost", "localhost"); 
System.setProperty("com.ibm.CORBA.securityServerPort", "2809"); 
 
System.setProperty("com.ibm.CORBA.loginUserid", "admin"); 
System.setProperty("com.ibm.CORBA.loginPassword", "admin"); 

Context ctx = new InitialContext(env); 
PruebaServiceHome home = (PruebaServiceHome) javax.rmi.PortableRemoteObject.narrow(ctx.lookup("ejb/PruebaService"), PruebaServiceHome.class); 
PruebaService serviceLocal = home.create(); 
 
System.out.println("Inicio. Imprimo el usuario con login"); 
serviceLocal.imprimeUser(); 
 
System.out.println("Fin llamada cliente"); 
} 
catch (Exception e) 
{ 
e.printStackTrace(); 
} 
 
}// End of main() 
} 
 
And finally this is my configuration of properties files 
 
sas.client.props 
 
com.ibm.CORBA.securityEnabled=true 
com.ibm.CORBA.authenticationTarget=BasicAuth 
com.ibm.CORBA.authenticationRetryEnabled=true 
com.ibm.CORBA.authenticationRetryCount=3 
com.ibm.CORBA.validateBasicAuth=true 
com.ibm.CORBA.securityServerHost= 
com.ibm.CORBA.securityServerPort= 
com.ibm.CORBA.loginTimeout=300 
com.ibm.CORBA.loginSource=properties 
 
<ol>
<li>RMI/IIOP user identity</li>
</ol>
com.ibm.CORBA.loginUserid= 
com.ibm.CORBA.loginPassword= 
 
com.ibm.CSI.performStateful=true 
 
com.ibm.CSI.performClientAuthenticationRequired=true 
com.ibm.CSI.performClientAuthenticationSupported=true 
 
com.ibm.CSI.performTLClientAuthenticationRequired=false 
com.ibm.CSI.performTLClientAuthenticationSupported=false 
 
com.ibm.CSI.performTransportAssocSSLTLSRequired=false 
com.ibm.CSI.performTransportAssocSSLTLSSupported=true 
 
com.ibm.CSI.performMessageIntegrityRequired=true 
com.ibm.CSI.performMessageIntegritySupported=true 
 
com.ibm.CSI.performMessageConfidentialityRequired=false 
com.ibm.CSI.performMessageConfidentialitySupported=true 
 
com.ibm.ssl.alias=DefaultSSLSettings 
 
com.ibm.CORBA.requestTimeout=180 
 
ssl.client.props 
 
com.ibm.ssl.keyStoreName=ClientDefaultKeyStore 
 
com.ibm.ssl.keyStorePassword={xor}CDo9Hgw= 
com.ibm.ssl.keyStoreType=PKCS12 
com.ibm.ssl.keyStoreProvider=IBMJCE 
com.ibm.ssl.keyStoreFileBased=true 
 
com.ibm.ssl.trustStoreName=ClientDefaultTrustStore 
com.ibm.ssl.trustStorePassword={xor}CDo9Hgw= 
com.ibm.ssl.trustStoreType=PKCS12 
com.ibm.ssl.trustStoreProvider=IBMJCE 
com.ibm.ssl.trustStoreFileBased=true 
 
With all that I obtain a correct authentification the first time I call that EJB, but if I chage de com.ibm.CORBA.loginUserid property and com.ibm.CORBA.loginUserPassword property does not revalidate that authentification, so for all that my question is: 
 
¿How I do the logout using CSIv2 system? 
 
Thanks for your answers I still hope you can help me out with this. 
 
best regards

Paul Ilechko

unread,

Apr 10, 2008, 12:48:42 PM4/10/08

to

zako...@gmail.com wrote:
> Ok, I will try to explain what I did with a little example application.

>

> With all that I obtain a correct authentification the first time I call that EJB, but if I chage de com.ibm.CORBA.loginUserid property and com.ibm.CORBA.loginUserPassword property does not revalidate that authentification, so for all that my question is: 
> 
> ¿How I do the logout using CSIv2 system? 
> 
> Thanks for your answers I still hope you can help me out with this. 
> 
> best regards

I suggest you read the WAS infocenter article on client programming, so
that you can see how to do a JAAS login from your client. You should be
able to re-login with a different user and set the new context on the
thread with subject.doAs.

zako...@gmail.com

unread,

Apr 11, 2008, 2:46:19 AM4/11/08

to

Ok, I will try to change my login process to JAAS. 
 
For all that I was reading the IBM Websphere 6.1 Security Redbook.pdf and downloaded the example app using JAAS that is with the book and doesn't worked on my websphere installation, does anybody try it? 
 
You can find the book here; Link: <a class="jive-link-external" href="http://www.redbooks.ibm.com/abstracts/sg246316.html?Open">http://www.redbooks.ibm.com/abstracts/sg246316.html?Open</a> 
 
And the zip with the example application that uses JAAS 
<a class="jive-link-external" href="ftp://www.redbooks.ibm.com/redbooks/SG246316">ftp://www.redbooks.ibm.com/redbooks/SG246316</a> 
 
Thanks for all your help.

zako...@gmail.com

unread,

Apr 11, 2008, 2:50:10 AM4/11/08

to

Seems impossible to logout using CSIv2 authentification method, I must change to JAAS system.

saurabh narang

unread,

Apr 11, 2008, 8:37:09 AM4/11/08

to

Hi Zako, 
 
You would need to uncheck "Stateful sessions" in the CSIV2 inbound authentication settings. Once, the first contact between a client and server is fully authenticated, all subsequent contacts with valid sessions reuse the security information if this checkbox is checked. 
 
Hope this solves your problem. 
 
Regards

zako...@gmail.com

unread,

Apr 14, 2008, 4:08:41 AM4/14/08

to

Hi Saurabh

I tried what you said, uncheking that option on my administrative console, but it still not works as I want, there is any way to invalidate the client session? I mean, any command or something I can call to do that, and make WAS to re-validate my security.

I tried creating two home's and the resutls are still the same:

Client

System.setProperty("com.ibm.CORBA.loginUserid", "admin");

System.setProperty("com.ibm.CORBA.loginPassword", "admin");

Context ctx = new InitialContext(env);

PruebaServiceHome home = (PruebaServiceHome) javax.rmi.PortableRemoteObject.narrow(ctx.lookup("ejb/PruebaService"), PruebaServiceHome.class);

PruebaService serviceLocal = home.create();

System.out.println("Inicio. Imprimo el usuario con login");

serviceLocal.imprimeUser();

System.setProperty("com.ibm.CORBA.loginUserid", "ORION");

System.setProperty("com.ibm.CORBA.loginPassword", "ORION");

Context ctx2 = new InitialContext(env);

PruebaServiceHome home2 = (PruebaServiceHome) javax.rmi.PortableRemoteObject.narrow(ctx2.lookup("ejb/PruebaService"), PruebaServiceHome.class);

PruebaService serviceLocal2 = home2.create();

serviceLocal2.imprimeUser();

Server traces

14/04/08 10:06:52:234 CEST 00000025 SystemOut O PruebaService.imprimeUser()

14/04/08 10:06:52:234 CEST 00000025 SystemOut O USUARIO

14/04/08 10:06:52:234 CEST 00000025 SystemOut O admin

14/04/08 10:06:52:234 CEST 00000025 SystemOut O IP

14/04/08 10:06:52:234 CEST 00000025 SystemOut O FIN

14/04/08 10:06:52:250 CEST 00000025 SystemOut O PruebaService.imprimeUser()

14/04/08 10:06:52:250 CEST 00000025 SystemOut O USUARIO

14/04/08 10:06:52:250 CEST 00000025 SystemOut O admin

14/04/08 10:06:52:250 CEST 00000025 SystemOut O IP

14/04/08 10:06:52:250 CEST 00000025 SystemOut O FIN