I was reviewing on how to implement the SSO through the following URL:
http://www-01.ibm.com/support/knowledgecenter/#!/SSZH4A_6.2.0/com.ibm.worklight.dev.doc/devref/t_configuring_device_SSO.html
Matching with our code, the authenticationConfig.xml is implemented to be the following:
<customSecurityTest name="BankingTestMobile">
<test realm="wl_antiXSRFRealm" step="2"/>
<test realm="wl_authenticityRealm" step="2"/>
<test realm="wl_remoteDisableRealm" step="2"/>
<test realm="wl_directUpdateRealm" mode="perSession" step="1"/>
<test realm="wl_anonymousUserRealm" isInternalUserID="true" step="2"/>
<test realm="wl_deviceNoProvisioningRealm" isInternalDeviceID="true" step="2"/>
<test realm="MySSO" isInternalUserID="true" step="3"/>
</customSecurityTest>
Realm:
<realm loginModule="BankingLoginModule" name="BankingRealm">
<className>com.worklight.integration.auth.AdapterAuthenticator</className>
<parameter name="login-function" value="MBCAuthenticationAdapter.onAuthRequired" />
<parameter name="logout-function" value="MBCAuthenticationAdapter.onLogout" />
</realm>
Login Module:
<loginModule name="BankingLoginModule" ssoDeviceLoginModule="WLDeviceNoProvisioningLoginModule">
<className>com.worklight.core.auth.ext.NonValidatingLoginModule</className>
</loginModule>
My question is in the <customSecurityTest>. From where the SSO realm is getting picked up? What the realm name should be for SSO?
Do I need to define a realm for it?
I'm not sure how the configuration actually should be done on the <customSecurityTest> where in the <mobileSecurityTest> it is clear.
Thank you.
I believe you should change the <test realm="MySSO" ... to "BankingRealm" (or the vice versa).
Also see here: App will throw exception at when I first login when device SSO is enabled
Related
Direct Update For Windows phone 8 devices is not working while it is working fine with iOS any idea ?
Enviornment : Mobile First 7.1.0
Windows phone 8 Nokia
Application Descriptor Editor->WIndows phone 8 -> Security Test: Default
while App Authenticity Config is set up Basic.Below is authenticationConfig.xml
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<tns:loginConfiguration xmlns:tns="http://www.worklight.com/auth/config" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<staticResources>
<resource id="receiveSMS" securityTest="SubscribeServlet">
<urlPatterns>/receiveSMS*</urlPatterns>
</resource>
</staticResources>
<securityTests>
<customSecurityTest name="SubscribeServlet">
<test realm="wl_directUpdateRealm" step="1"/>
<test isInternalUserID="true" realm="SubscribeServlet"/>
</customSecurityTest>
<customSecurityTest name="LDAPSecurityTest">
<test isInternalUserID="true" realm="LDAPRealm"/>
</customSecurityTest>
<customSecurityTest name="winfoneSecurityTest">
<test realm="wl_remoteDisableRealm" step="1"/>
<test mode="perSession" realm="wl_directUpdateRealm" step="1"/>
<test isInternalUserID="true" realm="wl_anonymousUserRealm" step="1"/>
<test isInternalDeviceID="true" realm="wl_deviceNoProvisioningRealm" step="2"/>
</customSecurityTest>
</securityTests>
<realms>
<realm loginModule="rejectAll" name="SubscribeServlet">
<className>com.worklight.core.auth.ext.HeaderAuthenticator</className>
</realm>
</realms>
<loginModules><!-- cannot share confidential info --></loginModules>
</tns:loginConfiguration>
One of my team member came to me and shown that he has used two security tests with the exactly same names and the Studio is not giving any exception.
MobileFirst v7.0
Eclipse Luna R2 (4.4.2)
Windows 8
Here is the extract.
<securityTests>
<customSecurityTest name="MySecurityTest">
<test realm="wl_antiXSRFRealm" />
<test realm="wl_remoteDisableRealm" />
<test realm="wl_directUpdateRealm" mode="perSession" step="1"/>
<test realm="wl_deviceNoProvisioningRealm" isInternalDeviceID="true" step="1" />
<test realm="AdapterAuthRealmDuplicate" isInternalUserID="true" step="2" />
</customSecurityTest>
<customSecurityTest name="MySecurityTest">
<test realm="wl_antiXSRFRealm" />
<test realm="wl_remoteDisableRealm" />
<test realm="wl_directUpdateRealm" mode="perSession" step="1"/>
<test realm="AdapterAuthRealm" isInternalUserID="true" step="2" />
</customSecurityTest>
</securityTests>
<realms>
<realm loginModule="AdapterAuthLoginModule" name="AdapterAuthRealm">
<className>com.worklight.integration.auth.AdapterAuthenticator</className>
<parameter name="login-function" value="Mydapter.onAuthRequired"/>
<parameter name="logout-function" value="Mydapter.onLogout"/>
</realm>
<realm loginModule="AdapterAuthLoginModule" name="AdapterAuthRealmDuplicate">
<className>com.worklight.integration.auth.AdapterAuthenticator</className>
<parameter name="login-function" value="Mydapter.onAuthRequired"/>
<parameter name="logout-function" value="Mydapter.onLogout"/>
</realm>
</realms>
My question is:
Is this okay? keeping in mind the future compatibilities ?
If multiples are allowed, then how they work i.e. how the challenge handlers
execution flow (steps) goes.
Does it combine both together ?
I think it should not allow two security tests with same names.
Please help me understand this, otherwise I would change it or keep it.
Note:- I had asked one question and this is different question.
Worklight: multiple security realms
This is not the same as realms. It should not be allowed.
I will open a defect to handle this.
Do not create two custom security checks with the same name value.
I made changes in the MobileFirst application and deployed on to the mobile device it is asking for "update for the application is available in android" How to disable it.
This is my authenticationConfig.xml file:
<?xml version="1.0" encoding="UTF-8"?>
<tns:loginConfiguration xmlns:tns="http://www.worklight.com/auth/config" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<staticResources>
<!--
<resource id="logUploadServlet" securityTest="LogUploadServlet">
<urlPatterns>/apps/services/loguploader*</urlPatterns>
</resource>
-->
<resource id="subscribeServlet" securityTest="SubscribeServlet">
<urlPatterns>/subscribeSMS*;/receiveSMS*;/ussd*</urlPatterns>
</resource>
</staticResources>
<securityTests>
<!--
<mobileSecurityTest name="mobileTests">
<testAppAuthenticity/>
<testDeviceId provisioningType="none" />
<testUser realm="myMobileLoginForm" />
<testDirectUpdate mode="disabled" />
</mobileSecurityTest>
<webSecurityTest name="webTests">
<testUser realm="myWebLoginForm"/>
</webSecurityTest>
<customSecurityTest name="customTests">
<test realm="wl_antiXSRFRealm" step="1"/>
<test realm="wl_authenticityRealm" step="1"/>
<test realm="wl_remoteDisableRealm" step="1"/>
<test realm="wl_directUpdateRealm" mode="perSession" step="1"/>
<test realm="wl_anonymousUserRealm" isInternalUserID="true" step="1"/>
<test realm="wl_deviceNoProvisioningRealm" isInternalDeviceID="true" step="2"/>
</customSecurityTest>
<customSecurityTest name="LogUploadServlet">
<test realm="wl_anonymousUserRealm" step="1"/>
<test realm="LogUploadServlet" isInternalUserID="true"/>
</customSecurityTest>
-->
<customSecurityTest name="SubscribeServlet">
<test realm="SubscribeServlet" isInternalUserID="true"/>
</customSecurityTest>
</securityTests>
<realms>
<realm name="SampleAppRealm" loginModule="StrongDummy">
<className>com.worklight.core.auth.ext.FormBasedAuthenticator</className>
</realm>
<realm name="SubscribeServlet" loginModule="rejectAll">
<className>com.worklight.core.auth.ext.HeaderAuthenticator</className>
</realm>
<!-- For client logger -->
<!-- <realm name="LogUploadServlet" loginModule="StrongDummy">
<className>com.worklight.core.auth.ext.HeaderAuthenticator</className>
</realm -->
<!-- For websphere -->
<!-- realm name="WASLTPARealm" loginModule="WASLTPAModule">
<className>com.worklight.core.auth.ext.WebSphereFormBasedAuthenticator</className>
<parameter name="login-page" value="/login.html"/>
<parameter name="error-page" value="/loginError.html"/>
</realm -->
<!-- For User Certificate Authentication -->
<!-- realm name="wl_userCertificateAuthRealm" loginModule="WLUserCertificateLoginModule">
<className>com.worklight.core.auth.ext.UserCertificateAuthenticator</className>
<parameter name="dependent-user-auth-realm" value="WASLTPARealm" />
<parameter name="pki-bridge-class" value="com.worklight.core.auth.ext.UserCertificateEmbeddedPKI" />
<parameter name="embedded-pki-bridge-ca-p12-file-path" value="/opt/ssl_ca/ca.p12"/>
<parameter name="embedded-pki-bridge-ca-p12-password" value="capassword" />
</realm -->
<!-- For Trusteer Fraud Detection -->
<!-- Requires acquiring Trusteer SDK -->
<!-- realm name="wl_basicTrusteerFraudDetectionRealm" loginModule="trusteerFraudDetectionLogin">
<className>com.worklight.core.auth.ext.TrusteerAuthenticator</className>
<parameter name="rooted-device" value="block"/>
<parameter name="device-with-malware" value="block"/>
<parameter name="rooted-hiders" value="block"/>
<parameter name="unsecured-wifi" value="alert"/>
<parameter name="outdated-configuration" value="alert"/>
</realm -->
</realms>
<loginModules>
<loginModule name="StrongDummy">
<className>com.worklight.core.auth.ext.NonValidatingLoginModule</className>
</loginModule>
<loginModule name="requireLogin">
<className>com.worklight.core.auth.ext.SingleIdentityLoginModule</className>
</loginModule>
<loginModule name="rejectAll">
<className>com.worklight.core.auth.ext.RejectingLoginModule</className>
</loginModule>
<!-- Required for Trusteer - wl_basicTrusteerFraudDetectionRealm -->
<!-- loginModule name="trusteerFraudDetectionLogin">
<className>com.worklight.core.auth.ext.TrusteerLoginModule</className>
</loginModule-->
<!-- For websphere -->
<!-- loginModule name="WASLTPAModule">
<className>com.worklight.core.auth.ext.WebSphereLoginModule</className>
</loginModule -->
<!-- Login module for User Certificate Authentication -->
<!-- <loginModule name="WLUserCertificateLoginModule">
<className>com.worklight.core.auth.ext.UserCertificateLoginModule</className>
</loginModule> -->
<!-- For enabling SSO with no-provisioning device authentication -->
<!-- <loginModule name="MySSO" ssoDeviceLoginModule="WLDeviceNoProvisioningLoginModule">
<className>com.worklight.core.auth.ext.NonValidatingLoginModule</className>
</loginModule> -->
<!-- For enabling SSO with auto-provisioning device authentication -->
<!-- <loginModule name="MySSO" ssoDeviceLoginModule="WLDeviceAutoProvisioningLoginModule">
<className>com.worklight.core.auth.ext.NonValidatingLoginModule</className>
</loginModule> -->
</loginModules>
</tns:loginConfiguration>
Well, you can "disable auto-update" easily. try this way
Mobile security test
If a Direct Update test is not specified in a mobile security test, it is enabled with the default perSession mode. To change the direct update mode to perRequest in a mobile security test, add a direct update test with mode="perRequest" to a mobile security test: <testDirectUpdate mode="perRequest"/>. To disable direct update in a mobile security test, add a direct update test with mode="disabled" to the mobile security test: <testDirectUpdate mode="disabled"/>.
Custom security test
To add a Direct Update test to a custom security test, add the following test to the security test: <test realm="wl_directUpdateRealm"/>. The default mode is perSession. To change the mode, specify a value for the mode attribute: <test realm="wl_directUpdateRealm" mode="perRequest"/>. To disable automatic Direct Update in a custom security test, either set the mode to disabled or do not add a test with a Direct Update realm.
Now ,re-build the project and re-deploy the .war file (local server,production server) as well use an updated application
more information https://www-01.ibm.com/support/knowledgecenter/SSHS8R_7.1.0/com.ibm.worklight.dev.doc/admin/c_direct_update_as_security_realm.html?lang=en
Remove the Direct Update security test from your security tests in authenticationConfig.xml. If in a non-development (Studio/CLI) environment, make sure to also re-build the project and re-deploy the .war file as well use an updated application.
I get this error after deploying a new war through the server configuration tool. I tried to revert back to the original war error persist.
Tomcat 7.0.30
Worklight Server 6.1.0.2
javax.servlet.ServletException: Worklight Console initialization failed.Logged Exception: java.lang.RuntimeException: conf/authenticationConfig.xml contains duplicated realm named: wl_anonymousUserRealm
com.worklight.core.auth.impl.AuthenticationFilter.verifyServletInitialized(AuthenticationFilter.java:317)
com.worklight.core.auth.impl.AuthenticationFilter.doFilter(AuthenticationFilter.java:111)
The xml is built by default my realm is defined in the context.xml for server.
<!-- Licensed Materials - Property of IBM
5725-G92 (C) Copyright IBM Corp. 2006, 2013. All Rights Reserved.
US Government Users Restricted Rights - Use, duplication or
disclosure restricted by GSA ADP Schedule Contract with IBM Corp. -->
<!-- Uncomment the next element to protect the worklight console and the first section in securityTests below. -->
<staticResources>
<!-- <resource id="worklightConsole" securityTest="WorklightConsole">
<urlPatterns>/console*</urlPatterns>
</resource>
-->
<resource id="subscribeServlet" securityTest="SubscribeServlet">
<urlPatterns>/subscribeSMS*</urlPatterns>
</resource>
</staticResources>
test below , element must be added to application-descriptor.xml as well. -->
<securityTests>
<!--
<customSecurityTest name="WorklightConsole">
<test realm="WorklightConsole" isInternalUserID="true"/>
</customSecurityTest>
<mobileSecurityTest name="mobileTests">
<testAppAuthenticity/>
<testDeviceId provisioningType="none" />
<testUser realm="myMobileLoginForm" />
</mobileSecurityTest>
<webSecurityTest name="webTests">
<testUser realm="myWebLoginForm"/>
</webSecurityTest>
<customSecurityTest name="customTests">
<test realm="wl_antiXSRFRealm" step="1"/>
<test realm="wl_authenticityRealm" step="1"/>
<test realm="wl_remoteDisableRealm" step="1"/>
<test realm="wl_anonymousUserRealm" isInternalUserID="true" step="1"/>
<test realm="wl_deviceNoProvisioningRealm" isInternalDeviceID="true" step="2"/>
</customSecurityTest>
-->
<customSecurityTest name="SubscribeServlet">
<test isInternalUserID="true" realm="SubscribeServlet"/>
</customSecurityTest>
<customSecurityTest name="AgentSecurityTest">
<test isInternalUserID="true" realm="FbitnAgentRealm"/>
</customSecurityTest>
</securityTests>
<realms>
<!--realm name="ConsumerRealm" loginModule="AnonymousLoginModule" >
<className>com.worklight.integration.auth.AdapterAuthenticator</className>
<parameter name="login-function" value="ConsumerPolicy.onAuthRequired"/>
<parameter name="logout-function" value="ConsumerPolicy.onLogout"/>
</realm-->
<realm loginModule="StrongDummy" name="SampleAppRealm">
<className>com.worklight.core.auth.ext.FormBasedAuthenticator</className>
</realm>
<realm loginModule="requireLogin" name="WorklightConsole">
<className>com.worklight.core.auth.ext.FormBasedAuthenticator</className>
<onLoginUrl>/console</onLoginUrl>
</realm>
<realm loginModule="rejectAll" name="SubscribeServlet">
<className>com.worklight.core.auth.ext.HeaderAuthenticator</className>
</realm>
<!-- For websphere -->
<!-- realm name="WASLTPARealm" loginModule="WASLTPAModule">
<className>com.worklight.core.auth.ext.WebSphereFormBasedAuthenticator</className>
<parameter name="login-page" value="/login.html"/>
<parameter name="error-page" value="/loginError.html"/>
</realm -->
<realm name="FbitnAgentRealm" loginModule="FbitnAgentLogin">
<className>com.fbitn.WorklightCustomAuthenticator</className>
</realm>
</realms>
<loginModules>
<loginModule name="FbitnAgentLogin">
<className>com.fbitn.WorklightCustomLogin</className>
</loginModule>
<!--loginModule name="AnonymousLoginModule">
<className>com.worklight.core.auth.ext.NonValidatingLoginModule</className>
</loginModule-->
<!--loginModule name="HeaderLoginModule" canBeResourceLogin="true" isIdentityAssociationKey="true" audit="true"-->
<loginModule name="StrongDummy">
<className>com.worklight.core.auth.ext.NonValidatingLoginModule</className>
</loginModule>
<loginModule name="requireLogin">
<className>com.worklight.core.auth.ext.SingleIdentityLoginModule</className>
</loginModule>
<loginModule name="rejectAll">
<className>com.worklight.core.auth.ext.RejectingLoginModule</className>
</loginModule>
<!-- For websphere -->
<!-- loginModule name="WASLTPAModule">
<className>com.worklight.core.auth.ext.WebSphereLoginModule</className>
</loginModule -->
<!-- For enabling SSO with no-provisioning device authentication -->
<!-- <loginModule name="MySSO" ssoDeviceLoginModule="WLDeviceNoProvisioningLoginModule">
<className>com.worklight.core.auth.ext.NonValidatingLoginModule</className>
</loginModule> -->
<!-- For enabling SSO with auto-provisioning device authentication -->
<!-- <loginModule name="MySSO" ssoDeviceLoginModule="WLDeviceAutoProvisioningLoginModule">
<className>com.worklight.core.auth.ext.NonValidatingLoginModule</className>
</loginModule> -->
</loginModules>
There was two versions on the server. Tomcat/Worklight/app and Tomcat/webapps/app. I'm not sure the the server config tool was used to deploy the first one, but was on the second deploy. I removed the app contents from the Worklight folder and left the original folder under webapps, the server.xml is configured to read both directories, only one is needed.
I found out this was because of the worklight-jee-library.jar was install under the tomcat/lib and in the tomcat/Worklight/app. I believe the one in the lib was placed there by the installation manager when Worklight 6.1 was installed.
I did a worklight app with worklight6.0.0, which has some http adapters that works fine with my liberty profile in eclipse.
now i want to transport this app to a websphere 8.0.0.6 environment, but when i did that i recieve this message in the catlog:
info: {"challenges":{"wl_antiXSRFRealm":{"WL-Instance-Id":"ajjqfhmo88gqmm955r2p22vq7j"}}}*/
error: defaultOptions:onFailure Procedure invocation error.
and this is another error:
[Http://190.246.205.5:9081/WorklightPocProj/apps/services/../../invoke] failure. state: 500, response: The server was unable to process the request from the application. Please try again later.
defaultOptions:onFailure The server was unable to process the request from the application. Please try again later.
I put a call on the wlinit to a dummy adapter and the response is correctly, this error that the app give to me happens just after i call this method:
handler.submitAdapterAuthentication(invocationData, {});
So I've change the worklight.properties and redeploy the .war, then, I've deploy that .war on the WAS and install the all.wlapp and all the .adapter files.
and i can see all the file deployed in my worklight console, and my android app connects to the worklight server correctly
In this .war, i have another app (a facebook app) which doesnt have any adapter and works fine.
This is my code realm:
<securityTests>
<!--
<customSecurityTest name="WorklightConsole">
<test realm="WorklightConsole" isInternalUserID="true"/>
</customSecurityTest>
<mobileSecurityTest name="mobileTests">
<testAppAuthenticity/>
<testDeviceId provisioningType="none" />
<testUser realm="myMobileLoginForm" />
</mobileSecurityTest>
<webSecurityTest name="webTests">
<testUser realm="myWebLoginForm"/>
</webSecurityTest>
<customSecurityTest name="customTests">
<test realm="wl_antiXSRFRealm" step="1"/>
<test realm="wl_authenticityRealm" step="1"/>
<test realm="wl_remoteDisableRealm" step="1"/>
<test realm="wl_anonymousUserRealm" isInternalUserID="true" step="1"/>
<test realm="wl_deviceNoProvisioningRealm" isInternalDeviceID="true" step="2"/>
</customSecurityTest>
-->
<customSecurityTest name="SubscribeServlet">
<test realm="SubscribeServlet" isInternalUserID="true"/>
</customSecurityTest>
<customSecurityTest name="SimpleAuthAdapterTest">
<test realm="SimpleAuthRealm" isInternalUserID="true" />
</customSecurityTest>
</securityTests>
<realms>
<realm name="SampleAppRealm" loginModule="StrongDummy">
<className>com.worklight.core.auth.ext.FormBasedAuthenticator</className>
</realm>
<realm name="WorklightConsole" loginModule="requireLogin">
<className>com.worklight.core.auth.ext.FormBasedAuthenticator</className>
<onLoginUrl>/console</onLoginUrl>
</realm>
<realm name="SimpleAuthRealm" loginModule="SimpleAuthLoginModule">
<className>com.worklight.integration.auth.AdapterAuthenticator</className>
<parameter name="login-function" value="SimpleAuthAdapter.onAuthRequired" />
<parameter name="logout-function" value="SimpleAuthAdapter.onLogout" />
</realm>
<realm name="SubscribeServlet" loginModule="rejectAll">
<className>com.worklight.core.auth.ext.HeaderAuthenticator</className>
</realm>
<!-- For websphere -->
<!-- realm name="WASLTPARealm" loginModule="WASLTPAModule">
<className>com.worklight.core.auth.ext.WebSphereFormBasedAuthenticator</className>
<parameter name="login-page" value="/login.html"/>
<parameter name="error-page" value="/loginError.html"/>
</realm -->
</realms>
<loginModules>
<loginModule name="SimpleAuthLoginModule">
<className>com.worklight.core.auth.ext.NonValidatingLoginModule</className>
</loginModule>
<loginModule name="StrongDummy">
<className>com.worklight.core.auth.ext.NonValidatingLoginModule</className>
</loginModule>
<loginModule name="requireLogin">
<className>com.worklight.core.auth.ext.SingleIdentityLoginModule</className>
</loginModule>
<loginModule name="rejectAll">
<className>com.worklight.core.auth.ext.RejectingLoginModule</className>
</loginModule>
<!-- For websphere -->
<!-- loginModule name="WASLTPAModule">
<className>com.worklight.core.auth.ext.WebSphereLoginModule</className>
</loginModule -->
<!-- For enabling SSO with no-provisioning device authentication -->
<!-- <loginModule name="MySSO" ssoDeviceLoginModule="WLDeviceNoProvisioningLoginModule">
<className>com.worklight.core.auth.ext.NonValidatingLoginModule</className>
</loginModule> -->
<!-- For enabling SSO with auto-provisioning device authentication -->
<!-- <loginModule name="MySSO" ssoDeviceLoginModule="WLDeviceAutoProvisioningLoginModule">
<className>com.worklight.core.auth.ext.NonValidatingLoginModule</className>
</loginModule> -->
</loginModules>
and this is my a part of my ChallengeHandler code:
var handler = WL.Client.createChallengeHandler("SimpleAuthRealm");
var busyInd;
function login() {
busyInd = new WL.BusyIndicator('content', {
text : 'Verificando credenciales...'
});
busyInd.show();
var username = $('#AuthUsername').val();
var password = $('#AuthPassword').val();
usuario1 = username;
password1 = password;
var invocationData = {
adapter : "SimpleAuthAdapter",
procedure : "submitAuthentication",
parameters : [ "Basic " + Base64.encode(username + ":" + password),
username ]
};
handler.submitAdapterAuthentication(invocationData, {});
};
Is there something that I'm missing or I'm doing wrong?
Solved: this error happens because the application security was enabled on the was server without setting any role on the web.xml file.