No problem authenticating using Domino LDAP and global security.
The problem is with application security and groups. I have a secure web
application, specifying security constraints, resources, and roles in the
web deployment descriptor; and mapping logical roles to users/groups in the
application deployment descriptor.
In the WebSphere bindings of the application deployment descriptor, All
authenticated users works OK. When specifying Users/Groups, adding Users
works OK, which requires the distinguished name for matching, e.g. CN=Some
Body,o=someorg. The problem is when adding Groups. I’ve tried using the name
only, CN=GroupName, and cn=GroupName, but nothing works.
Does anyone know how to get group authorization to work? TIA
The WSAD console error is:
[4/25/04 18:01:00:500 EDT] c8b0948 LdapRegistryI E SECJ0361E: Authentication
failed for cn=LocalDomainAdmins because user is not found in the registry.
[4/25/04 18:01:00:547 EDT] c8b0948 LdapRegistryI E SECJ0341E: Could not get
the uniqueId for the group cn=LocalDomainAdmins because of the following
exception com.ibm.websphere.security.CustomRegistryException: No group
cn=LocalDomainAdmins found
When tracing is enabled:
[4/25/04 16:54:04:533 EDT] 6201947f WebCollaborat < setPrivateAttributes
[4/25/04 16:54:04:533 EDT] 6201947f WebAuthentica < handleCustomLogin
[4/25/04 16:54:04:533 EDT] 6201947f WSCredentialI d getSecurityName() →
nlaney
[4/25/04 16:54:04:533 EDT] 6201947f WebCollaborat > checkAuthorization
[4/25/04 16:54:04:533 EDT] 6201947f WSAccessManag > isGrantedAnyRole
[4/25/04 16:54:04:533 EDT] 6201947f WSAccessManag d Required Roles list
length: 1
[4/25/04 16:54:04:533 EDT] 6201947f WSAccessManag d Roles list length: 1
[4/25/04 16:54:04:533 EDT] 6201947f WSAccessManag d Required Roles are =
LocalDomainAdmins
[4/25/04 16:54:04:533 EDT] 6201947f WSAccessManag d application name =
WASSecurityEAR
[4/25/04 16:54:04:533 EDT] 6201947f WSAccessManag d application name =
WASSecurityEAR
[4/25/04 16:54:04:533 EDT] 6201947f WSAccessManag d A pluggable Table was
NOT found
[4/25/04 16:54:04:533 EDT] 6201947f WSAccessManag d granted Roles from
ALL_AUTHENTICATED_USERS:
[4/25/04 16:54:04:533 EDT] 6201947f WSAccessManag d Role<0>:
com.ibm.etools.j2ee.common.impl.SecurityRoleImpl(LocalDomainAdmins)
[4/25/04 16:54:04:533 EDT] 6201947f WSAccessManag d Getting the accessID
[4/25/04 16:54:04:533 EDT] 6201947f WSAccessManag > getAccessId
[4/25/04 16:54:04:533 EDT] 6201947f WSCredentialI d getAccessId() →
user:srv001:389/CN=Neill Laney,o=home
[4/25/04 16:54:04:533 EDT] 6201947f WSAccessManag < getAccessId returns ID:
user:srv001:389/CN=Neill Laney,o=home
[4/25/04 16:54:04:543 EDT] 6201947f WSAccessManag d accessID:
user:srv001:389/CN=Neill Laney,o=home
[4/25/04 16:54:04:543 EDT] 6201947f WSAccessManag d isServerId? false
[4/25/04 16:54:04:543 EDT] 6201947f WSAccessManag d The accessId is not a
ServerId
[4/25/04 16:54:04:543 EDT] 6201947f WSAccessManag d Calling
getRolesForSubject with:
com.ibm.ejs.models.base.bindings.applicationbnd.impl.UserImpl@82b5efa0
(name: user:srv001:389/CN=Neill Laney,o=home, accessId:
user:srv001:389/CN=Neill Laney,o=home)
[4/25/04 16:54:04:543 EDT] 6201947f WSAccessManag d grantedRoles: null
[4/25/04 16:54:04:543 EDT] 6201947f WSAccessManag d NULL grantedRoles for
userSub
[4/25/04 16:54:04:543 EDT] 6201947f WSAccessManag d Roles found for userSub:
com.ibm.ejs.models.base.bindings.applicationbnd.impl.UserImpl@82b5efa0
(name: user:srv001:389/CN=Neill Laney,o=home, accessId:
user:srv001:389/CN=Neill Laney,o=home)
[4/25/04 16:54:04:543 EDT] 6201947f WSAccessManag d Role<0>:
com.ibm.etools.j2ee.common.impl.SecurityRoleImpl(LocalDomainAdmins)
[4/25/04 16:54:04:543 EDT] 6201947f WSAccessManag > getGroupsIds
[4/25/04 16:54:04:543 EDT] 6201947f WSAccessManag < getGroupsIds
[4/25/04 16:54:04:543 EDT] 6201947f WSAccessManag d Length of groupIds is: 0
[4/25/04 16:54:04:543 EDT] 6201947f WSAccessManag < isGrantedAnyRole:No role
or group role found for accessId[user:srv001:389/CN=Neill Laney,o=home],
exit value:false
[4/25/04 16:54:04:543 EDT] 6201947f WebCollaborat < checkAuthorization:
throw AccessException
[4/25/04 16:54:04:583 EDT] 6201947f WebCollaborat d checkAuthorization()
failed, here is the message in the exception: Authorization failed, Not
granted any of the required roles: LocalDomainAdmins
[4/25/04 16:54:04:583 EDT] 6201947f WebCollaborat A SECJ0129E: Authorization
failed for nlaney while invoking GET on
default_host:/WASSecurityTest/Authorization, Authorization failed, Not
granted any of the required roles: LocalDomainAdmins
[4/25/04 16:54:04:593 EDT] 6201947f WebCollaborat < authorize
com.ibm.ws.security.web.DenyReply@781f546d
[4/25/04 16:54:04:593 EDT] 6201947f EJSWebCollabo > HandleException
[4/25/04 16:54:04:673 EDT] 6201947f EJSWebCollabo < HandleException