Pacific AppServer and j_spring_security_check

Posted by Samuel ETTERLEN on 10-Jan-2017 09:45

Hi,

I'm trying to test a REST web service with SoapUI NG.
My web service is served by a PASOE, which is with oerealm parametrized.

Before calling the web service I need to generate a sessionid-cookie with the /static/auth/j_spring_security_check method.

I'm giving the two needed parameters (j_username and j_password) but I'm receiving a 403-Error:

An error occurred while executing your request!

403 - Forbidden: the server refuses to fullfill the client's request - POST /

Error details
Remote user: null
User principal: null
Scheme: http
Remote address: 192.168.17.53
Server name: myservername.com
PASOE product type: dev
HTTP status: 403
Error detail: Access is denied

I've found in oeablSecurity-form-oerealm.xml this directive:

<intercept-url pattern="/static/auth/*"
access="permitAll()" />

So I don't understand why the access is forbidden...

Did somebody know how to solve this ?

Best Regards

Sam

OpenEdge General - Forum

All Replies

Posted by gdb390 on 10-Jan-2017 09:51

Did you implement a OERealm class ?

Posted by Irfan on 10-Jan-2017 09:53

Hi Sam,

Were you successfully authenticated in the OERealm ABL class ?

Posted by Samuel ETTERLEN on 10-Jan-2017 10:01

yes, I deed.

Posted by Samuel ETTERLEN on 10-Jan-2017 10:01

When I call my web service from a web browser, I need first login (i'm redirected to the login.jsp page which is calling on submit the /j_spring_security_check method) and then my web service give me a result.

Posted by Irfan on 10-Jan-2017 10:03

Do you see anything in the session manager log file ?

Posted by Samuel ETTERLEN on 11-Jan-2017 01:00

Hi Irfan,

Here my PASOE-Agent logfile, when I'm loging from SoapUI:

[17/01/11@07:54:10.925+0100] P-021072 T-020040 1 AS-9 -- (Procedure: 'ValidateUser Security.HybridRealm' Line:960) validateUser: axadmin 7

[17/01/11@07:54:10.925+0100] P-021072 T-020040 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:757) ValidateClient

[17/01/11@07:54:10.925+0100] P-021072 T-020040 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:780) CP validation failed. allowing grace connect

[17/01/11@07:54:10.925+0100] P-021072 T-020040 1 AS-9 -- (Procedure: 'ValidateUser Security.HybridRealm' Line:980) userNum: 1136

[17/01/11@07:54:10.927+0100] P-021072 T-022344 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:757) ValidateClient

[17/01/11@07:54:10.927+0100] P-021072 T-022344 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:780) CP validation failed. allowing grace connect

[17/01/11@07:54:10.927+0100] P-021072 T-022344 1 AS-9 -- (Procedure: 'GetAttribute Security.HybridRealm' Line:112) Attr requested: ATTR_ROLES

[17/01/11@07:54:10.928+0100] P-021072 T-017868 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:757) ValidateClient

[17/01/11@07:54:10.928+0100] P-021072 T-017868 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:780) CP validation failed. allowing grace connect

[17/01/11@07:54:10.928+0100] P-021072 T-017868 1 AS-9 -- (Procedure: 'GetAttribute Security.HybridRealm' Line:112) Attr requested: ATTR_ENABLED

[17/01/11@07:54:10.930+0100] P-021072 T-023416 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:757) ValidateClient

[17/01/11@07:54:10.930+0100] P-021072 T-023416 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:780) CP validation failed. allowing grace connect

[17/01/11@07:54:10.930+0100] P-021072 T-023416 1 AS-9 -- (Procedure: 'GetAttribute Security.HybridRealm' Line:112) Attr requested: ATTR_LOCKED

[17/01/11@07:54:10.931+0100] P-021072 T-024540 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:757) ValidateClient

[17/01/11@07:54:10.931+0100] P-021072 T-024540 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:780) CP validation failed. allowing grace connect

[17/01/11@07:54:10.931+0100] P-021072 T-024540 1 AS-9 -- (Procedure: 'GetAttribute Security.HybridRealm' Line:112) Attr requested: ATTR_EXPIRED

And here is my logfile, when I'm loging from Chrome:

[17/01/11@07:55:29.124+0100] P-021072 T-022344 1 AS-9 -- (Procedure: 'ValidateUser Security.HybridRealm' Line:960) validateUser: axadmin 7

[17/01/11@07:55:29.124+0100] P-021072 T-022344 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:757) ValidateClient

[17/01/11@07:55:29.124+0100] P-021072 T-022344 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:780) CP validation failed. allowing grace connect

[17/01/11@07:55:29.124+0100] P-021072 T-022344 1 AS-9 -- (Procedure: 'ValidateUser Security.HybridRealm' Line:980) userNum: 1136

[17/01/11@07:55:29.125+0100] P-021072 T-017868 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:757) ValidateClient

[17/01/11@07:55:29.125+0100] P-021072 T-017868 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:780) CP validation failed. allowing grace connect

[17/01/11@07:55:29.125+0100] P-021072 T-017868 1 AS-9 -- (Procedure: 'GetAttribute Security.HybridRealm' Line:112) Attr requested: ATTR_ROLES

[17/01/11@07:55:29.126+0100] P-021072 T-023416 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:757) ValidateClient

[17/01/11@07:55:29.126+0100] P-021072 T-023416 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:780) CP validation failed. allowing grace connect

[17/01/11@07:55:29.126+0100] P-021072 T-023416 1 AS-9 -- (Procedure: 'GetAttribute Security.HybridRealm' Line:112) Attr requested: ATTR_ENABLED

[17/01/11@07:55:29.128+0100] P-021072 T-024540 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:757) ValidateClient

[17/01/11@07:55:29.128+0100] P-021072 T-024540 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:780) CP validation failed. allowing grace connect

[17/01/11@07:55:29.128+0100] P-021072 T-024540 1 AS-9 -- (Procedure: 'GetAttribute Security.HybridRealm' Line:112) Attr requested: ATTR_LOCKED

[17/01/11@07:55:29.129+0100] P-021072 T-020040 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:757) ValidateClient

[17/01/11@07:55:29.129+0100] P-021072 T-020040 1 AS-9 -- (Procedure: 'ValidateClient Security.HybridRealm' Line:780) CP validation failed. allowing grace connect

[17/01/11@07:55:29.129+0100] P-021072 T-020040 1 AS-9 -- (Procedure: 'GetAttribute Security.HybridRealm' Line:112) Attr requested: ATTR_EXPIRED

[17/01/11@07:55:29.139+0100] P-021072 T-017868 1 AS-9 -- (Procedure: 'ActivateServerSession Akioma.Swat.System.SwatServerSessionActivator' Line:678) no valid CP, calling SessionManager:Reset()

[17/01/11@07:55:29.161+0100] P-021072 T-017868 1 AS-9 -- (Procedure: 'GetRestServiceAddress Consultingwerk.OERA.JsdoGenericService.WebHandler.CatalogWebHandler' Line:484)

[17/01/11@07:55:29.161+0100] P-021072 T-017868 1 AS-9 -- (Procedure: 'GetRestServiceAddress Consultingwerk.OERA.JsdoGenericService.WebHandler.CatalogWebHandler' Line:484)

[17/01/11@07:55:29.161+0100] P-021072 T-017868 1 AS-9 -- (Procedure: 'GetRestServiceAddress Consultingwerk.OERA.JsdoGenericService.WebHandler.CatalogWebHandler' Line:484) restsettings: c:\OSIV3G\AkiomaNBF\swat-backend\.restapplicationsettings

[17/01/11@07:55:29.163+0100] P-021072 T-017868 1 AS-9 -- (Procedure: 'GetRestServiceAddress Consultingwerk.OERA.JsdoGenericService.WebHandler.CatalogWebHandler' Line:655) RestServiceName: ?

[17/01/11@07:55:29.163+0100] P-021072 T-017868 1 AS-9 -- (Procedure: 'GetRestServiceAddress Consultingwerk.OERA.JsdoGenericService.WebHandler.CatalogWebHandler' Line:655) RestServiceAddress: ?

It's fast the same trace, except the last lines where the Akioma classes are fired... But I see any error...

Best Regards

Sam

Posted by Samuel ETTERLEN on 11-Jan-2017 04:08

Hi,

I've found a solution to get a result from my WebService with SoapUI.

I need first call the WebService itself, then POST my credentials to j_spring_security_check and then RECALL the WebService.

I also added the same header-properties as the Chrome's TCP-Stream.

But I think that's not the best solution...

Posted by Irfan on 11-Jan-2017 09:22

Hi Samuel,

If I am running browser then I would do something as below

   1. Access localhost:8810/.../login.jsp

   2. enter credentials

   3. After login, I will access whichever URL I can as I am still having the session

From a client like POSTMAN,cURL,ABL HTTP Client I would do the following

  1. Send username and password over a POST operation for the URL localhost:8810/.../j_spring_security_check

  2. Copy the cookies from the response and send it in the subsequent request to access the API

The behavior you are talking looks like a browser based simulation. So I would suggest testing with other clients  

This thread is closed