Hi java people,I am facing a peculiar problem. I need to get package and class name, of parent, who is using my object. This package and class name should be extracted inside my object. I can't do 2 things because of flow of my project.1)Can't take reference of parent into my object, hence ...

Hello,What I intend to do - generate new server key pair, then generate client key pair. Export client pair to IE (newest) for mutual auth.Command I use:Server pair:1. keytool -genkey -keyalg rsa -keystore keystore.jks -storepass pass -alias server -dname ...

We have a few java applications(stand-alone). How can I prevent somebody executing them? At OS level, I can do chmod. Is there any way I can use some kind of ACLs? I am using security manager and I have a policy file also. Can I add a few lines to policy files to get this done? Thanks ...

hellowhen i am trying to connect a server with socket programming using SSL i am getting this errorPlease Help MeThanks in Advance,Raju Thakurjavax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: No trusted certificate found ...

I'm using a client which signs data via the ActiveXObject("CAPICOM.SignedData") facility.I'm looking for some examples of java which uses the java security package or org.mozilla.jss.pkcs7 libraries to validate the signed data on the backend.I've yet to find any documentation (except API) ...

Hi, i need some help.I am signing a document using package java.securitySomething like thisSignature signatureAlgorithm = Signature.getInstance(DIGITAL_SIGNATURE_ALGORITHM_NAME);signatureAlgorithm.initSign(aPrivateKey);signatureAlgorithm.update(aDocument);String digitalSignature = ...

Hello All,Here is the problem I have. We have a J2EE application running on tomcat. It is an enterprise style application. The user information, role and access information will be in Oracle tables, not in the configuration files. I plan to use the JDBC relm for authentication. We do not want ...

Hi,Sun App Server 8.Is it possible to setup web app security with client-cert only (no user & pass) ?If so, please provide sample xml files.Thanks

Greeting,I am using SunSASL provider to do DIGEST-MD5 authentication. When the server evaluate the response,it calls the "PasswordCallback" to retrieve the clear text password. But according to the RFC, normallythe server stores the hash value of the password, H({ username-value, ":", ...

Hi,I am new to development and am using Ant to build my packages.I need to sign the jar files that I produce, and now the only way I know how is with jarsigner.I'd like to find a way to do the signing within Ant, but can't find one.Is that possible?George ...

I have the client and the server on the same machine and need to test the functioanlity. The server is a CAS service which is on a secured connection. when a new user enters the site he is redirected to the CAS server app for authentication over a secured connection. after authentication the ...

Greetings,In JAAS, both client and server must provide the LoginModule definitions for the application. The server would do it in its own configuration and the client would do it in the ${user.home}/.java.login.config or other specific file.MyApp ...

Hi I have developed a site using J2ee Technologies. The setup of the site is as follows......Due to security issues the site is running on Microsoft IIS server which is exposed to the internet. All the html stuff resides on this server.For all the jsp related stuff is lying on the other machine ...

Hi all,I am currently developing an application for a mobile phone that needs to check a signature received in an xml message. The problem is that I'm using bouncycastle to check that signature, but I am not using bouncycastle for signing the message (I'm just using the security packages that ...

Question 1:Assume that Subject was authenticated against two lodin modules and has two Principal instances associated.Subject.doAsPrivileged(subject, .., ..) will bind all the Principals inside the Subject onto the AccessControlContext-stack in the background.After that when ...

Greetings,I'm trying from a servlet (WAR) to access to an EJB with a few methods protected with permition roles. When I call the EJB from a remote client with JAAS authentication it works just fine. But, when I call it from a servler (WAR) application I got authentication error.I included in ...

I have a somewhat strange problem setting a .java.policy for an applet I'm developping.I created a .java.policy file with policytool, I need to save files in a specific directory from the applet and query the paths where saving is possible (entries in .java.policy where FilePermission have a ...

I am using the jazn api to create and manage user login on my web application. I can create new users and also can make the user login. What I don't know is how to logoff the user.I want that the user can choose LOGOFF and after that if he wants to work with the application again he must LOGIN ...

Hi,I wrote a client application that makes https connections with a weblogic server.To do this, I use HTTPClient and a keystore containing the SSL certificate on the client side.The problem is when the certificate is expired on the client. I try by code to insert the new SSL certificate to ...

This is how my policy-file looks like:grant codeBase "file:///Development/eclipse/workspace/Test.jar" {permission java.security.AllPermission;};This codebase is also used as URL inside another class to dynamically load the Jar via URLClassLoader - works perfectly, thus the URL should be ...

Hi all,I am currently looking at different Kerberos implementations in Java. Apart from Sun JDK support for Kerberos and GSS API, I have looked at Wedgetail JCSI...Can anyone please provide me some insight into other Kerberos implementations in JAVA...please. I am also looking for HTTP client ...

Hi,how could I use role based security with JAAS? JBoss attaches roles as Groups to the Subject. ( http://www.huihoo.com/jboss/online_manual/3.0/ch09s17.html)So I would write a LoginModule that would add all roles as Groups to the Subject and in the application I would check if the Subject's ...

Hi,I am using Tagish TypedPrincials( http://free.tagish.net/jaas/api/com/tagish/auth/TypedPrincipal.html) when I add the user name and role to the Subject.However, I want to store more user information on Subject such as user id, logon name and be able to differentiate them. I guess I can do ...

Can anyone tell me how to prevent flicker from this java script. Thanksimport java.awt.*;import java.awt.event.*;import javax.swing.*;import javax.swing.event.*;public class FrameTest002 extends JFrame implements MouseInputListener { JButton button01; public FrameTest002(String title) ...

Dear Sir or Madam,Here is the programs : policy file :grant {//permission java.io.FilePermission "tempdir\\*", "read, write";};--Main program :Properties properties = System.getProperties(); properties.setProperty("java.security.policy", "security.policy"); System.setSecurityManager(new ...

Hi,I'm a little confused about the available methods for clients to authenticate themselves to a web application. In particular, all tutorials mention "basic HTTP authentication" , "form-based", and "digest". Which is clear enough.However, some of them mention "client certificate" while others ...

Hi all,I needed some information regarding passing of Kerberos tickets. In my setup, I have a client written in Java. This Java client makes use of Cadaver (www.webdav.org/cadaver) to access an Exchange server. Cadaver is run as a separate process through which interaction with the Exchange ...

Hi all, How can I retrieve the fingerprints of a java.security.cert.X509Certificate?Best regards.Fred

Hello!I'm getting unencrypted private key from .pfx file into PrivateKey,getFormat() says its in PKCS#8 format.How to create it in PEM format, acceptable for apache to start?After Base64.encodeBytes(pkey.getEncoded()) and adding header and footer, I'm getting result, similar to "openssl pkcs8 ...

Hi all! I recieved a method to read a pem file with bouncy castle and retrieve a X509 Certificate, but it doesnt working...here is the code:private X509Certificate readerPEM(byte[] cert) {//Transforma o array de bytes em StringByteArrayInputStream btCert = new ByteArrayInputStream(cert);String ...

i want to retrieve an individual information from the ldap without specifying the (ou) attribute, in other word i want to search all the (ou)s in one step. so how can i write the baseDN.I have tried the JNDI APIs and JDBCLDAP bridge sql.the shortest baseDN that succeeded was the ...

Hi,I am new to JAAS. I found a lot of material and samples on Authentication using JAAS. But I am unable to find any detailed material on Authorization using JAAS. I have a very basic requirement as follows.When a Subject is Authenticated successfully I want to show a JSP with a menu that is ...

Is there a way to use JAAS on top of Tomcat or some other web container ? I read somewhere that tomcat wil give you a Subject & Principal for each user, but I'd like to extend that functionality, probably using my own LoginModule etc. Has anyone any ideas how to go about it ...

Hi,I have some X.509 certificates stored in an OpenLDAP directory, and I'm trying to access them using the java.security.cert.CertStore class. Unfortunately, the getCertificates method always returns an empty Collection. Does anyone know what I'm doing wrong?This is the LDIF file used to ...

Hey AllI'm transferring a file using RMI as part of an enhancement. I want to restrict where the file can be transferred to and thus will use a security manager (On the destination object). However the object its being transferred to shares the same JVM with another quite complex application ...

Hi everybody, I was wondering if you could help me out.I've developed a custom login module with custom Subjects and Principals in JAAS.I've already deployed my login module with a custom weblogic Authentication Provider and it works fine. The thing is that I would like for Weblogic Server ...

Is it possible to use more than one Security Manager within a Java application where each one may be using a different policy file?

Hi,I do that :herve ..jars> jarsigner -keystore keystore ajar.jar apseudoEnter Passphrase for keystore: xxherve ..jars> jarsigner -verify ajar.jarjar verified. Note: This jar contains unsigned entries which are not integrity-checked. Re-run with -verbose to list unsigned entries. Why ...

Hi,I've had a hard time building a solution to use JAAS on a database maintained user credentials and policy configuration. I've found the documentation available scarse for this purpouses, and so after finishig the task I've felt moved to write a White Paper that could help others who want ...

how do I Accessing Microsoft Keystore using Bouncy Castle ?if u have some small example please provide it .Thanks. hasstar [SCJP] http://www.myjavaserver.com/~hasstar

Hi,I am developing a web application that requires client authentication via SSL. I can successfully retrieve the client certificate, but I do not know how to determine whether the client certificate was signed by my organization's root CA (or one of the intermediary CAs). How would I go about ...

Hi,I have to send a Certificate Signing Request (CSR) to an Certificate Authority(CA).To confirm it's me sending it they ask for an "fingerprint" by postal mail, so they can compare it with the fingerprint they generate from the CSR.The fingerprint I get from my generated X509-Certificate ...

Hi all,why does the java.security.cert.X509Certificate class have a bunch of getter methods but no setter methods? How can I create a new Certificate and populate the fields such as the SubjectDN and all that jazz? Am I missing some fundamental concept?Sean

Hii have an applet which prints an image file to printer. When i clicked on print i am getting the following exception ...i set grant all permissions also..but getting the same error .... can anybody suggest me java.security.AccessControlException: access denied (java.io.FilePermission ...

Dear sir / madami am very new in Java programming. i would like to know how to limit user authority in application by assigning difference level of user.For example, top level user can do this while lower level user can't do!!!Is there any suggestion for this?I am not asking for answer but i ...

Hai,Can we create a html page using java application without using applets, JSP etc. regards,namanc

I've set up a webapp using JAAS to authorize and authenticate on Tomcat 5. Security checks are performed by a servlet filter and, if the user is logged on, their subject object is attached to the thread. As far as I know, that means that any pages accessed through the filter are processed in ...

I'm getting a javax.crypto.BadPaddingException: pad block corrupted Exception while working on converting our existing java jdk 1.2 to java 1.4. Any suggestions would be great. Here are the specifics:We have a web application that been running for 3+ years under java jdk 1.2 & ...

don't want to use keytool to generate X509Certificate, I hope to write an Applet program to generate X509Certificate. So, which classes should we use? I can't find it from API-DOC. Who can help me?

Hello,I am a beginner in JAAS, I found some information from the web and started to use JAAS for web container security in Tomcat.It seems can login successfully. When I can call request.getRemoteUser() and request.getUserPrincipal() it can returned the correct user and principal.But when I ...