Grouper Users - Open Discussion List

["GW Brown, Information Systems and Computing" <>]

Good to hear it is working.

I'll probably change the default to not check for a specific role, but 
allow roles to be configured and to enforce configured roles. I'll also 
take a look and see if it is possible to catch the actual error and give a 
better error message.

Gary

--On 20 March 2009 14:13 +0100 Loris Bennett <> 
wrote:

> It is now working.
>
> I think the problem was that I had tried and failed to extend the
> security constraint beyond login.do and left the web.xml in a
> semi-broken state.
>
> My local tomcat expert has now sorted me out.
>
> Sorry for causing unnecessary activity at your end(s).
>
> Cheers
>
> Loris
>
> On Fri, 2009-03-20 at 08:36 -0400, Chris Hyzer wrote:
> > Do you have tomcat pre 5.5.15?
> >
> > http://threebit.net/mail-archive/tomcat-users/msg00081.html
> >
> > There should be more to google on this issue since it seems like a
> > tomcat problem, right?
> >
> > Let us know
> > Chris
> >
> > > -----Original Message-----
> > > From: Loris Bennett 
> > [mailto:]
> > > Sent: Friday, March 20, 2009 5:57 AM
> > > To: GW Brown, Information Systems and Computing
> > > Cc: Grouper Users Mailing List
> > > Subject: Re: [grouper-users] Error 403, but logged in anyway
> > >
> > > On Thu, 2009-03-19 at 16:17 +0100, Loris Bennett wrote:
> > > > Hi Gary,
> > > >
> > > > On Thu, 2009-03-19 at 13:50 +0000, GW Brown, Information Systems and
> > > > Computing wrote:
> > > > > Hi Loris,
> > > > >
> > > > > when you attempt to access /grouper-dev/ do you see the Grouper
> > > splash
> > > > > screen with a login link or are you prompted for credentials
> > > immediately?
> > > >
> > > > I get the Grouper splash screen.
> > > >
> > > > > Do you map users to the grouper_user role?
> > > >
> > > > No.
> > > >
> > > > > What might be happening is that you successfully authenticate
> > > against LDAP
> > > > > but are not assigned the grouper_user role required by the security
> > > > > constraint in the web.xml. The security constraint only applies to
> > > > > login.do. After that we depend on a session variable. So
> > > authentication
> > > > > works, the role check fails, on going to /grouper-dev/ again the
> > > grouper ui
> > > > > sees a 'remoteUser' and creates a session.
> > > > >
> > > > > You could try replacing the auth-constraint role-name with *
> > > > > <auth-constraint>
> > > > >   <role-name>*</role-name>
> > > > > </auth-constraint>
> > > > >
> > > > > otherwise you can have multiple role-name elements to match
> > > appropriate
> > > > > roles in LDAP.
> > > >
> > > > OK, I'll try this.
> > >
> > > This didn't make any difference - I still get 403.
> > >
> > > Maybe I shouldn't worry about this too much, as tomcat will be behind
> > > an
> > > apache at some point. Still it would be nice to know why the problem
> > > occurs for some users but not for others.
> > >
> > > Cheers
> > >
> > > Loris
> > >
> > > >
> > > > Thanks,
> > > >
> > > > Loris
> > > >
> > > > > Gary
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > --On 19 March 2009 14:17 +0100 Loris Bennett 
> > <loris.bennett@fu-
> > > berlin.de>
> > > > > wrote:
> > > > >
> > > > > > Hi Gary,
> > > > > >
> > > > > > Authentication is done via META-INF/context.xml:
> > > > > >
> > > > > >         <Context path="/grouper"
> > > > > >                  docBase="grouper"
> > > > > >                  debug="0"
> > > > > >                  privileged="false"
> > > > > >                  reloadable="false"
> > > > > >                  swallowOutput="true">
> > > > > >           <Realm  className="org.apache.catalina.realm.JNDIRealm"
> > > > > >                   debug="99"
> > > > > >                   connectionURL="ldaps://host1.dept.fu-
> > > berlin.de:1234"
> > > > > >                   alternateURL="ldaps://host2.dept.fu-
> > > berlin.de:1234"
> > > > > >                   userPattern="uid={0},ou=dept,o=fu-berlin,c=de"
> > > > > >                   roleBase="ou=grouper,o=fu-berlin,c=de"
> > > > > >                   roleSubtree="true"
> > > > > >                   roleSearch="(uniquemember={0})"
> > > > > >                   roleName="cn"
> > > > > >                   connectionName="cn=manager,o=fu-berlin,c=de"
> > > > > >                   connectionPassword="xxx"/>
> > > > > >         </Context>
> > > > > >
> > > > > > Cheers,
> > > > > >
> > > > > > Loris
> > > > > >
> > > > > >
> > > > > > On Thu, 2009-03-19 at 13:02 +0000, GW Brown, Information Systems
> > > and
> > > > > > Computing wrote:
> > > > > >> Hi Loris,
> > > > > >>
> > > > > >> How is the LDAP authentication achieved?
> > > > > >>
> > > > > >> Gary
> > > > > >>
> > > > > >> --On 19 March 2009 13:53 +0100 Loris Bennett
> > > > > >> 
> > <>
> >   wrote:
> > > > > >>
> > > > > >> > Hi Gary,
> > > > > >> >
> > > > > >> > I am not using Apache - just Tomcat on its own.
> > > > > >> >
> > > > > >> > Cheers
> > > > > >> >
> > > > > >> > Loris
> > > > > >> > On Thu, 2009-03-19 at 11:24 +0000, GW Brown, Information
> > > Systems and
> > > > > >> > Computing wrote:
> > > > > >> >> Hi Loris,
> > > > > >> >>
> > > > > >> >> Have you got Apache in front of Tomcat - and is it doing the
> > > > > >> >> authentication? If so does it blanket protect grouper-dev?
> > > Otherwise
> > > > > >> >> are you using a servlet filter?
> > > > > >> >>
> > > > > >> >> If you are using Apache can you isolate and post the relevant
> > > section
> > > > > >> >> of the access log?
> > > > > >> >>
> > > > > >> >> In the web.xml there is a security constraint:
> > > > > >> >> <security-constraint>
> > > > > >> >>     <web-resource-collection>
> > > > > >> >>       <web-resource-name>Tomcat login</web-resource-name>
> > > > > >> >>       <url-pattern>/login.do</url-pattern>
> > > > > >> >>     </web-resource-collection>
> > > > > >> >>     <auth-constraint>
> > > > > >> >>        <!-- NOTE:  This role is not present in the default
> > > users file
> > > > > >> >>        --> <role-name>grouper_user</role-name>
> > > > > >> >>     </auth-constraint>
> > > > > >> >>   </security-constraint>
> > > > > >> >>
> > > > > >> >> Which may not be necessary if the authentication is through
> > > Apache.
> > > > > >> >>
> > > > > >> >> Thanks,
> > > > > >> >>
> > > > > >> >> Gary
> > > > > >> >>
> > > > > >> >> --On 19 March 2009 11:34 +0100 Loris Bennett
> > > > > >> >> 
> > <>
> >   wrote:
> > > > > >> >>
> > > > > >> >> > Hi Gary,
> > > > > >> >> >
> > > > > >> >> > My webapp is actually "grouper-dev" - "grouper" just comes
> > > from me
> > > > > >> >> > having tweaked the logfile in a half-baked manner.
> > > > > >> >> >
> > > > > >> >> > I am authenticating against an LDAP server.
> > > > > >> >> >
> > > > > >> >> > Cheers,
> > > > > >> >> >
> > > > > >> >> > Loris
> > > > > >> >> >
> > > > > >> >> > On Thu, 2009-03-19 at 09:07 +0000, GW Brown, Information
> > > Systems and
> > > > > >> >> > Computing wrote:
> > > > > >> >> >> Hi Loris,
> > > > > >> >> >>
> > > > > >> >> >> Looking at the log I see:
> > > > > >> >> >>
> > > > > >> >> >>   Caught '403' for /grouper-dev/login.do
> > > > > >> >> >>
> > > > > >> >> >> but the urls you gave /grouper/login.do. Is there actually
> > > a
> > > > > >> >> >> difference? If  so doing a clean build may help.
> > > > > >> >> >>
> > > > > >> >> >> What authentication are you using?
> > > > > >> >> >>
> > > > > >> >> >> Gary
> > > > > >> >> >>
> > > > > >> >> >>
> > > > > >> >> >>
> > > > > >> >> >>
> > > > > >> >> >> --On 19 March 2009 09:37 +0100 Loris Bennett
> > > > > >> >> >> 
> > <>
> >   wrote:
> > > > > >> >> >>
> > > > > >> >> >> > Hi,
> > > > > >> >> >> >
> > > > > >> >> >> > Most, but not all, users get error 403 on logging into
> > > grouper.
> > > > > >> >> >> > The URL displayed is
> > > > > >> >> >> >
> > > > > >> >> >> >         https://host.fu-berlin.de:1234/grouper/login.do
> > > > > >> >> >> >
> > > > > >> >> >> > If they then delete the "login.do" bit of the URL, they
> > > get
> > > > > >> >> >> > redirected to
> > > > > >> >> >> >
> > > > > >> >> >> >         https://host.fu-berlin.de:1234/grouper/home.do
> > > > > >> >> >> >
> > > > > >> >> >> > and everything is fine. A log extract for the login is
> > > attached.
> > > > > >> >> >> >
> > > > > >> >> >> > Cheers
> > > > > >> >> >> >
> > > > > >> >> >> > Loris
> > > > > >> >> >> >
> > > > > >> >> >> >
> > > > > >> >> >> >
> > > > > >> >> >> >
> > > > > >> >> >> > --
> > > > > >> >> >> > Dr. Loris Bennett (Mr.)
> > > > > >> >> >> > Freie Universität Berlin
> > > > > >> >> >> > ZEDAT - Zentraleinrichtung für Datenverarbeitung /
> > > Computer
> > > > > >> >> >> > Center Compute & Media Service
> > > > > >> >> >> > Fabeckstr. 32, Room 221
> > > > > >> >> >> > D-14195 Berlin
> > > > > >> >> >> > Tel ++49 30 838 51024
> > > > > >> >> >> > Fax ++49 30 838 56721
> > > > > >> >> >> > Email 
> >
> > > > > >> >> >> > Web www.zedat.fu-berlin.de
> > > > > >> >> >>
> > > > > >> >> >>
> > > > > >> >> >>
> > > > > >> >> >> ----------------------
> > > > > >> >> >> GW Brown, Information Systems and Computing
> > > > > >> >> >> 
> >
> > > > > >> >> > --
> > > > > >> >> > Dr. Loris Bennett (Mr.)
> > > > > >> >> > Freie Universität Berlin
> > > > > >> >> > ZEDAT - Zentraleinrichtung für Datenverarbeitung /
> > > > > >> >> > Computer
> > > Center
> > > > > >> >> > Compute & Media Service
> > > > > >> >> > Fabeckstr. 32, Room 221
> > > > > >> >> > D-14195 Berlin
> > > > > >> >> > Tel ++49 30 838 51024
> > > > > >> >> > Fax ++49 30 838 56721
> > > > > >> >> > Email 
> >
> > > > > >> >> > Web www.zedat.fu-berlin.de
> > > > > >> >> >
> > > > > >> >>
> > > > > >> >>
> > > > > >> >>
> > > > > >> >> ----------------------
> > > > > >> >> GW Brown, Information Systems and Computing
> > > > > >> >> 
> >
> > > > > >> > --
> > > > > >> > Dr. Loris Bennett (Mr.)
> > > > > >> > Freie Universität Berlin
> > > > > >> > ZEDAT - Zentraleinrichtung für Datenverarbeitung / Computer
> > > Center
> > > > > >> > Compute & Media Service
> > > > > >> > Fabeckstr. 32, Room 221
> > > > > >> > D-14195 Berlin
> > > > > >> > Tel ++49 30 838 51024
> > > > > >> > Fax ++49 30 838 56721
> > > > > >> > Email 
> >
> > > > > >> > Web www.zedat.fu-berlin.de
> > > > > >> >
> > > > > >>
> > > > > >>
> > > > > >>
> > > > > >> ----------------------
> > > > > >> GW Brown, Information Systems and Computing
> > > > > >> 
> >
> > > > > > --
> > > > > > Dr. Loris Bennett (Mr.)
> > > > > > Freie Universität Berlin
> > > > > > ZEDAT - Zentraleinrichtung für Datenverarbeitung / Computer
> > > Center
> > > > > > Compute & Media Service
> > > > > > Fabeckstr. 32, Room 221
> > > > > > D-14195 Berlin
> > > > > > Tel ++49 30 838 51024
> > > > > > Fax ++49 30 838 56721
> > > > > > Email 
> >
> > > > > > Web www.zedat.fu-berlin.de
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > > ----------------------
> > > > > GW Brown, Information Systems and Computing
> > > > > 
> >
> > > --
> > > Dr. Loris Bennett (Mr.)
> > > Freie Universität Berlin
> > > ZEDAT - Zentraleinrichtung für Datenverarbeitung / Computer Center
> > > Compute & Media Service
> > > Fabeckstr. 32, Room 221
> > > D-14195 Berlin
> > > Tel ++49 30 838 51024
> > > Fax ++49 30 838 56721
> > > Email 
> >
> > > Web www.zedat.fu-berlin.de
> --
> Dr. Loris Bennett (Mr.)
> Freie Universität Berlin
> ZEDAT - Zentraleinrichtung für Datenverarbeitung / Computer Center
> Compute & Media Service
> Fabeckstr. 32, Room 221
> D-14195 Berlin
> Tel ++49 30 838 51024
> Fax ++49 30 838 56721
> Email 
>
> Web www.zedat.fu-berlin.de



----------------------
GW Brown, Information Systems and Computing