Websphere 6.1 ejb3 authenticating user and mapping to role - security

I'm upgrading an application from an old ejb2 setup to use ejb3's using the ejb3 feature pack on websphere 6.1
I've got a ServletContextListener which does some initialisation when the servlet context starts, part of this initialisation involves calling ejb's.
The server is set up to use FileRegistrySample for its custom user registry, and on the old ejb2 setup it succesfully authenticates the system as the admin console user, and maps it to the Internal role I've set up for it.
Now that I've moved to ejb3 however, the user is being recognised, but it's telling me the user does not have any of the required roles...
I suppose my question is whether websphere or the spec has changed anything in that space that may be causing this, or whether it's more likely that something I've changed as part of the upgrade has caused it.

There is an ibm-application-bnd.xmi file that maps users and groups to role's, this file must be in my_app.ear/META-INF. Nothing appears to have changed with respect to that with the ejb3 feature pack, I had incorrectly removed it.

Related

Credentials for the Xcode Server xcs.couch database

Xcode 9 introduces a new version of the Xcode Server (no longer bundled with with Server.app). The backing couchdb instance for Xcode Server can be accessed through
http://localhost:10355/_utils
In previous versions you were able to examine the documents and even modify if needed. (For instance, I previously did this to artificially inflate an integration number when setting up a bot on a different server. I use the $(XCS_INTEGRATION_NUMBER) variable for my build numbers.)
Now, the database requires credentials. I know you can find the password in
/Library/Developer/XcodeServer/SharedSecrets/XCSDCouchDBSecret
But does anyone know the username?
After more investigation I found my answer...
/Library/Developer/XcodeServer/Configuration/xcscouch.ini
This file contains the basic CouchDB configuration for the Xcode Server. Under the [admins] section is a username=password list.
The default username for the Xcode Server CouchDB instance is xcscouchadmin

Liferay Webservices not starting

I'm trying to use Liferays webservices (viewable at /api/jsonws), but my Liferay installation is not starting any of this services. I'm running Liferay 6.1.3 on JBoss 7.2. This problem occures on three different servers. Same Liferay & JBoss setup on all 3. Only difference is that one of those servers had Liferay 6.2 running briefly. 6.2 allowed access to all webservices from /api/jsonws. Sadly I cannot switch back to 6.2 for several reasons.
Got a log entry stating that no service is configured.
16:36:03,291 DEBUG [ServerService Thread Pool -- 268][JSONWebServiceConfigurator:221] Configure JSON web service actions
16:36:03,299 DEBUG [ServerService Thread Pool -- 268][JSONWebServiceConfigurator:236] Configured 0 actions in 7 ms
Same liferay on a local tomcat works pretty fine and starts all webservices. So my question is if there is any kind of global on/off switch or if I have to set any special settings? I'm running out of ideas right now ...
Thanks in advance and regards, Sebastian
It may be worth checking portal-ext.properties file in your server.
There is a setting to turn JSON web services on/off. I guess it may be set as "false" in your case.
#
# Set this property to true to enable JSON web services. Note that setting
# this to false will cause portlets that make JSON web service calls from
# working.
#
json.web.service.enabled=true

Liferay not working on WebLogic Server

Very general question here:
I have Liferay 6.1.1 ga2 set up on my Oracle WebLogic 12c.
It works fine on my local, but when I deploy it onto our development server, I lose all write permissions.
E.g., changing the theme/color scheme, creating web content, pages, and saving changes to most things
I try to import LARs however it is saying it is not permitted
I'm not seeing any errors in the logs, and the control panel messages are even telling me my content was created or change successfully (besides the LARs0, but everything stays the same.
Any reason(s) why my changes aren't showing up? I'll surely give a bounty if I can get pointed in the right direction here
Given your description, I'd recommend checking OS issues, like write access to various folders, like temporary folders etc.. I guess that Liferay has proper permissions to the whole database (it's rare to have incomplete access) and can write to all tables. And you're operating on a portal-wide admin account, right?
Unrelated to LAR import, changes will not show up if you have workflow enabled - then you'd find the changes in the list of tasks that need approval.
As staging has quite an obvious UI in 6.1, I assume you don't have staging activated, otherwise you just need to publish. In order to see new portlets, make sure that the "Edit Controls" checkbox in your dockbar is checked. This has bitten me more than once.
if you're running a cluster, make sure that you have set it up correctly, e.g. that you don't see cached content on your node.
Can you confirm that you can see the options to change on the UI, just that your changes aren't persisted?
Also, please note that Weblogic 12c is not on the "supported Appservers" list for Liferay 6.1, it's there for Liferay 6.2 only (probably due to release date). This doesn't mean that it shouldn't run, just that it's not tested for your version. Further, there's a GA3 release for 6.3 already, so you might want to check if it's a problem that's fixed in GA3.

JSF project form authentication using Tomcat DataSourceRealm

I have a JSF 2 project and am using Eclipse Inigo as IDE, and deploying to Tomcat 6 (which is running in a a virtual machine in VirtualBox to mimic the target environment). I am not using Eclipse to deploy. Right now I'm simply exporting a .war file and deploying it from the Tomcat manager screen. I am using HSQLDB to store users, passwords, and user roles. One project requirement that is causing me confusion is that my web app must be fully self-contained. That is to say, I deliver a .war file and they plug it in without additional configuration to Tomcat.
I've read a ton on configuring my project for form authentication, including: SO question 1, SO question 2, SO question 3, Tomcat Realm config, Java EE 6 security, and more. Those sources really helped understand how to configure my project. I thought I was almost there. However, when I deploy the web app and try to access a restricted page I always get the login error page. I attempt login with one of various users in the DB with the role required, and I think the DB is set up according to the Tomcat Documentation.
All the tutorials I've read differ from my situation in one way or another:
Uses Glassfish instead of Tomcat
Uses BASIC authentication instead of FORM
Stores users, passwords, and roles in tomcat-users.xml instead of relational DB tables
Declares roles in server.xml instead of somewhere within the .war file.
Point 4 especially is preventing me from getting a full understanding of what is and is not possible (out of the box).
I will edit this question later to post code (web.xml, etc.), but first I wanted to ask a question similar to the one in the 'SO question 2' (above), in which the OP asks whether it's possible to do form authentication without defining something in the application server. In one of the answers it sort of sounds like it is not possible, but it's not quite definitive.
So, is it possible to implement form authentication without modifying files in the server (specifically server.xml and tomcat-users.xml as so many tutorials show)? Can form authentication with a DataSourceRealm be done with the requirement of the .war being fully self contained? If so, how? Can I include additional .xml files in my .war that would do the trick? Can I include everthing I need in web.xml and context.xml?
I've tried including everything in web.xml and context.xml, but it is not working. I thought I had things configured properly except for not having anything in the server.xml file.
I'll leave it at that for now. If what I need is possible, I'll edit with code to try to figure out what I'm doing wrong, otherwise, I'll save the trouble. Also, if what I need is not possible using form authentication, can anyone recommend a good alternative to achieve the same in a self-contained .war? (I'm throwing around the term 'self-contained .war' for lack of a better way to describe it...if there's a better or more precise term, let me know.)
Unfortunately, you can not do it.
Realms are configured in the server.xml file so if you want to authenticate a user against database you have to configure it in the server.xml file.
If you want to authenticate a user against database and ensure all your configuration will be within your WAR file please consider to use the Spring Security framework: http://static.springsource.org/spring-security/site/docs/3.1.x/reference/springsecurity-single.html
It is the great and simple framework that solves a lot of authentication / authorization problems.

Upgrading Liferay 5.2 to 6.0 checklist

I need to make an upgrade of Liferay, as mentioned above(5.2->6.0) So far, as my research (1,2,3) shows I need to:
Make backups of the Database and file system of plugins (especially portal*.properties).
Overwrite dependency jars
Deploy new .war
Set permission algorithm to 5 in the properties (as L-5.2 uses it, however L-6.0 uses 6)
Start application,
see if the DB updates correctly
see if the portal is working correctly
Clean up user-specific permissions
Convert legacy permission algorithm to 6 in the control Panel
Migrate a custom theme.
Upgrade EXT to EXT Plugin(p. 398)
It's fairly understandable, but I stumbled upon this thread(Missing FileEntryForm class). Are there any more changes of this kind?
Also, is there something else I'm missing?
Thanks :)

Resources