AM Client SDK

Hi AAron,

I'm tying to do Auth/SSOToken verification: one of the code I'm using is the code sample from de SDK (which isn't installed on the client) with AuthContext and Callback to send amadmin login and password

but i got some exception whereas the login seems successfull cause AM give the iPlanetDirectoryPro cookie:

05/22/2007 11:36:31:421 AM CEST: Thread[main,5,main]

LoginStatus : success

05/22/2007 11:36:31:421 AM CEST: Thread[main,5,main]

WebtopNaming : SecondarySites for 12 is null

05/22/2007 11:36:31:421 AM CEST: Thread[main,5,main]

sending cookies: iPlanetDirectoryPro=AQIC5...Y4Mg==#;amlbcookie=12

But I got these exception (I suppose these one is normal because before the auth success):

AdminTokenAction::getSSOToken Not found AdminDN and AdminPassword.

java.lang.NoClassDefFoundError: com/sun/identity/security/ServerInstanceAction

at com.iplanet.am.util.AdminUtils.<clinit>(AdminUtils.java:82)

at com.sun.identity.security.AdminTokenAction.getSSOToken(AdminTokenAction.java:263)

at com.sun.identity.security.AdminTokenAction.run(AdminTokenAction.java:174)

at java.security.AccessController.doPrivileged(Native Method)

at com.sun.identity.authentication.AuthContext.runLogin(AuthContext.java:561)

at com.sun.identity.authentication.AuthContext.login(AuthContext.java:498)

at com.sun.identity.authentication.AuthContext.login(AuthContext.java:356)

at MaClasse.main(MaClasse.java:77)

and then

AMCommonUtils:Initial: Caught exception in static block

java.lang.NoClassDefFoundError

at com.sun.identity.sm.SMSEntry.<clinit>(SMSEntry.java:169)

at com.sun.identity.sm.ServiceManager.<clinit>(ServiceManager.java:74)

at com.sun.identity.sm.ServiceConfigManager.<init>(ServiceConfigManager.java:94)

at com.iplanet.am.sdk.AMCommonUtils.populateManagedObjects(AMCommonUtils.java:503)

at com.iplanet.am.sdk.AMCommonUtils.<clinit>(AMCommonUtils.java:113)

at com.iplanet.am.sdk.AMStoreConnection.<clinit>(AMStoreConnection.java:143)

at MaClasse.main(MaClasse.java:106)

java.lang.NoClassDefFoundError

at com.iplanet.am.sdk.AMStoreConnection.<clinit>(AMStoreConnection.java:148)

at MaClasse.main(MaClasse.java:106)

Exception in thread "main"

The program is a command line program (simple main() function, no HttpServlet)

I have included AMconfig.properties in the jar and configured the variable com.iplanet.services.configpath to the path of "serverconfig.xml"

The thing I don't understand is what's the requirements on the client host? Do we need to install JES? it wouldn't be logic

Thanks for the assistance

sheepsa at 2007-7-12 10:14:10 >

This code worked fine for me, only servlet.jar and amclientsdk.jar in the classpath

package amauthtest;

import com.iplanet.am.util.SystemProperties;

import com.sun.identity.authentication.AuthContext;

import com.sun.identity.authentication.spi.AuthLoginException;

import java.util.Properties;

import javax.security.auth.callback.Callback;

import javax.security.auth.callback.NameCallback;

import javax.security.auth.callback.PasswordCallback;

public class AMLogin {

public static void main(String[] args) {

try {

Properties amEnv=new Properties();

//from AM server's AMConfig.properties

amEnv.setProperty("com.iplanet.am.naming.url","http://amserver.com:80/amserver/namingservice");

amEnv.setProperty("com.iplanet.am.naming.failover.url","");

amEnv.setProperty("com.iplanet.services.debug.level","error");

amEnv.setProperty("com.iplanet.services.debug.directory","D:\\temp\\amDebug");

//amEnv.setProperty("com.iplanet.am.notification.url","");

amEnv.setProperty("com.sun.identity.agents.notification.enabled","false");

//amEnv.setProperty("com.sun.identity.agents.notification.url","");

//amEnv.setProperty("com.sun.identity.agents.app.username","UrlAccessAgent"); //Any Agent

//amEnv.setProperty("com.iplanet.am.service.password","amldapuser");

//from AM server's AMConfig.properties

//amEnv.setProperty("am.encryption.pwd","apassword");

SystemProperties.initializeProperties(amEnv);

String uid="loginid";

String pwd="password";

AuthContext ctx = new AuthContext("/SubRealm");

ctx.login(AuthContext.IndexType.MODULE_INSTANCE, "AD");

Callback callbacks[] = ctx.getRequirements();

for(int i = 0; i < callbacks.length; i++){

if(callbacks[i] instanceof NameCallback) {

NameCallback namecallback = (NameCallback)callbacks[i];

namecallback.setName(uid);

} else

if(callbacks[i] instanceof PasswordCallback) {

PasswordCallback pwdCallback = (PasswordCallback)callbacks[i];

char chars[] = pwd.toCharArray();

pwdCallback.setPassword(chars);

}

}

ctx.submitRequirements(callbacks);

if(ctx.getStatus() == AuthContext.Status.SUCCESS){

System.out.println("Logged in" + ctx.getSSOToken().getTokenID());

}else{

System.out.println("Login failed");

}

} catch (Exception ex) {

ex.printStackTrace();

}

}

}

Aaron_Andersona at 2007-7-12 10:14:10 >

If you have Access Manager 7 in realm mode you will need to use the IDM api instead of the deprecated AM 6.x API's

http://docs.sun.com/source/819-2141/com/sun/identity/idm/package-frame.html

...

amEnv.setProperty("com.iplanet.services.debug.directory","D:\\temp\\amDebug");

amEnv.setProperty("com.iplanet.security.encryptor","com.iplanet.services.util.JCEEncryption");

//amEnv.setProperty("com.iplanet.am.notification.url","");...

...

if(ctx.getStatus() == AuthContext.Status.SUCCESS){

System.out.println("Logged in" + ctx.getSSOToken().getTokenID());

AMIdentity identity = IdUtils.getIdentity(ctx.getSSOToken());

System.out.println(identity.getName());

}else{

...

Aaron_Andersona at 2007-7-12 10:14:10 >

Here is code to get a user identity with both the user's token and using an admin token. Again, only the amclientsdk.jar and servlet.jar are in the classpath.

package amauthtest;

import com.iplanet.am.util.SystemProperties;

import com.iplanet.sso.SSOToken;

import com.sun.identity.authentication.AuthContext;

import com.sun.identity.idm.AMIdentity;

import com.sun.identity.idm.AMIdentityRepository;

import com.sun.identity.idm.IdSearchControl;

import com.sun.identity.idm.IdSearchResults;

import com.sun.identity.idm.IdType;

import com.sun.identity.idm.IdUtils;

import com.sun.identity.security.AdminTokenAction;

import java.security.AccessController;

import java.util.Iterator;

import java.util.Map;

import java.util.Properties;

import javax.security.auth.callback.Callback;

import javax.security.auth.callback.NameCallback;

import javax.security.auth.callback.PasswordCallback;

public class AMLogin {

static{

setEnv();

}

static String REALM="/EnterpriseSample";

public static void main(String[] args) {

try {

String uid="auser";

SSOToken userToken=authenticate(uid,"apassword",REALM,"LDAP");

if (userToken!=null){

System.out.println("With user token");

printUserAttributes(IdUtils.getIdentity(userToken));

}

SSOToken adminToken=(SSOToken)AccessController.doPrivileged(AdminTokenAction.getInstance());

AMIdentityRepository repo= new AMIdentityRepository(adminToken, REALM);

IdSearchControl controls=new IdSearchControl();

controls.setRecursive(true);

IdSearchResults res=repo.searchIdentities(IdType.USER,uid,controls);

System.out.println("With admin token");

for (Iterator i=res.getSearchResults().iterator();i.hasNext();){

printUserAttributes((AMIdentity)i.next());

}

} catch (Exception ex) {

ex.printStackTrace();

}

}

static void setEnv(){

Properties amEnv=new Properties();

//from AM server's AMConfig.properties

amEnv.setProperty("com.iplanet.am.naming.url","http://amserver.com:80/amserver/namingservice");

amEnv.setProperty("com.iplanet.am.naming.failover.url","");

amEnv.setProperty("com.iplanet.services.debug.level","error");

amEnv.setProperty("com.iplanet.services.debug.directory","D:\\temp\\amDebug");

amEnv.setProperty("com.iplanet.security.encryptor","com.iplanet.services.util.JCEEncryption");

//amEnv.setProperty("com.iplanet.am.notification.url","");

amEnv.setProperty("com.sun.identity.agents.notification.enabled","false");

//amEnv.setProperty("com.sun.identity.agents.notification.url","");

amEnv.setProperty("com.sun.identity.agents.app.username","amadmin"); //Any Agent

amEnv.setProperty("com.iplanet.am.service.password","amadminpassword");

//from AM server's AMConfig.properties

amEnv.setProperty("am.encryption.pwd","encpwd");

SystemProperties.initializeProperties(amEnv);

}

static SSOToken authenticate(String uid,String pwd,String realm,String module) throws Exception{

AuthContext ctx = new AuthContext(realm);

ctx.login(AuthContext.IndexType.MODULE_INSTANCE, module);

Callback callbacks[] = ctx.getRequirements();

for(int i = 0; i < callbacks.length; i++){

if(callbacks[i] instanceof NameCallback) {

NameCallback namecallback = (NameCallback)callbacks[i];

namecallback.setName(uid);

} else

if(callbacks[i] instanceof PasswordCallback) {

PasswordCallback pwdCallback = (PasswordCallback)callbacks[i];

char chars[] = pwd.toCharArray();

pwdCallback.setPassword(chars);

}

}

ctx.submitRequirements(callbacks);

if(ctx.getStatus() == AuthContext.Status.SUCCESS){

System.out.println("Logged in " + ctx.getSSOToken().getTokenID());

return ctx.getSSOToken();

}else{

System.out.println("Login failed");

}

return null;

}

static void printUserAttributes(AMIdentity identity)throws Exception{

if (identity!=null){

System.out.println(identity.getName());

System.out.println(IdUtils.getUniversalId(identity));

for (Iterator i=identity.getAttributes().entrySet().iterator();i.hasNext();){

Map.Entry e=(Map.Entry)i.next();

System.out.println(e);

}

}

}

}

Note that the agent uid is amadmin. UrlAccessAgent, the default agent ID, should work if you are only using the user's token to retrieve the identity attributes. Another agent profile in the /EnterpriseSample realm should work just as well. It appears that if you use the repo search functionality you need an actual administrator account like amadmin.

Your test probably failed because ed was probably only a user and not an agent id.

Aaron_Andersona at 2007-7-12 10:14:10 >

If you have Access Manager installed in legacy mode than you will probably need to use the amclientsdk.jar for 6.3. Make sure you are using the amclientsdk.jar from /opt/SUNWam/lib and not the sdk from any of the 2.2 J2EE agents unless it is the etc/amclientsdk_63.jar

The com.sun.identity.agents.app.username should be an application ID, either the amadmin user or equivalent user with the top level admin role or the UrlAccessAgent built in agent account. I would use the amadmin account just to get it working.

Once you have set the app.username to amadmin try the following code

try {

SSOToken token = (SSOToken) AccessController.doPrivileged((AdminTokenAction.getInstance()));

AMStoreConnection con = new AMStoreConnection(token);

} catch (SSOException se) {

debug.error("unable to connect to store ", se);

}

The /opt/SUNWam/samples/sso sample should also offer you some guidance. Be sure to use the DN format for the authcontext too.

Aaron_Andersona at 2007-7-12 10:14:10 >

Yes, you can do this:

Properties amEnv=new Properties();

amEnv.setProperty("com.sun.identity.agents.app.username","amAdmin");

amEnv.setProperty("com.iplanet.am.service.password","amadminpass");

SystemProperties.initializeProperties(amEnv);

before your authcontext

for my part, I'm always stuck with the "NullPointerException at DCTreeServicesHelper.isRequired" when I use any code even the last of Aaron_Anderson:

try {

SSOToken token = (SSOToken) AccessController.doPrivileged((AdminTokenAction.getInstance()));

AMStoreConnection con = new AMStoreConnection(token);

} catch (SSOException se) {

debug.error("unable to connect to store ", se);

}

the code work but if I use the AM classes it fail:

try {

SSOToken token = (SSOToken) AccessController.doPrivileged((AdminTokenAction.getInstance()));

AMStoreConnection con = new AMStoreConnection(token);

AMUser user = con.getUser(token.getPrincipal().toString());

Set roles = user.getAllRoleDNs();

} catch (SSOException se) {

System.out.println("unable to connect to store "+ se);

}

the line con.getUser() produce an error (the same method fail if I use the token created with authcontext):

java.lang.NullPointerException

at com.iplanet.am.sdk.common.DCTreeServicesHelper.isRequired(DCTreeServicesHelper.java:108)

at com.iplanet.am.sdk.remote.CachedRemoteServicesImpl.getAttributes(CachedRemoteServicesImpl.java:803)

at com.iplanet.am.sdk.remote.CachedRemoteServicesImpl.getAttributes(CachedRemoteServicesImpl.java:628)

at com.iplanet.am.sdk.remote.RemoteServicesImpl.getAttributesFromDS(RemoteServicesImpl.java:363)

at com.iplanet.am.sdk.AMObjectImpl.getAttributesFromDataStore(AMObjectImpl.java:302)

at com.iplanet.am.sdk.AMUserImpl.getAllRoleDNs(AMUserImpl.java:197)

at amauthtest.AMLogin.main(AMLogin.java:71)

and i have no idea about this... if I replace the jar with old jar, it doesn't work, there is another exception

sheepsa at 2007-7-12 10:14:10 >

I am configuring AM policy agent to protect WAS console.

In Chapter 4 Post-Installation Tasks of Policy Agent 2.2 for IBM WebSphere Application Server 6.0

http://docs.sun.com/app/docs/doc/819-5956/6n80l91a5?a=view

Questions

1. Under the section "To Verify Access to the IBM WebSphere Application Server 6.0 Administration Console" Step 2 says "Run Agent for IBM WebSphere Application Server 6.0 in message mode." Does anyone know how to do that?

2. To grant users a role, the doc says I should run agentadmin and add manager role using something like "id=manager,ou=role,dc=iplanet,dc=com"

I have added webshere roles(administrator,operator,configurator,monitor) to AM, added users to the roles, but I kept getting the error

"Authorization failed for wasadmin while invoking GET on admin_host:/ibm/console/, Authorization failed, Not granted any of the required roles: administrator operator configurator monitor"

Does anyone have an idea whats going on ?

lrejua at 2007-7-12 10:14:10 >