Authentication failing with Worklight-Liberty profile configured to LDAP (SSO) - authentication

Question

When I try to login from WL hybird application in the emulator I get the below exceptions.
Environment:
1) Worklight Server (505 version) installed using the default Liberty profile and Derby database.
2) Userregistry is configured to LDAP. LDAP is up and running.
3) I have followed "Module 20.1 Form-based Authentication"
Server.xml is correctly configured :
ldapRegistry id="IBMDirectoryServerLDAP" realm="defaultWIMFileBasedRealm"
host="testserver.com" port="4389" ignoreCase="true"
baseDN="dc=ibm,dc=com"
bindDN="cn=xyz"
bindPassword="xyz123"
ldapType="IBM Tivoli Directory Server" reuseConnection="true"
idsFilters
userFilter="(&(uid=%v)(objectclass=ePerson))"
groupFilter="(&(cn=%v)(|(objectclass=groupOfNames)(objectclass=groupOfUniqueNames)(objectclass=groupOfURLs)))"
userIdMap="*:uid"
groupIdMap="*:cn"
groupMemberIdMap="ibm-allGroups:member;ibm-allGroups:uniqueMember;groupOfNames:member;groupOfUniqueNames:uniqueMember"
ldapRegistry
Login module is : com.worklight.core.auth.ext.WebSphereLoginModule
Authenticator is : com.worklight.core.auth.ext.WebSphereFormBasedAuthenticator
Exception:
[RandomNumberGenerationServlet]: Initialization successful.
[2/13/13 15:37:21:349 IST] 00000049 com.worklight.core.auth.ext.WebSphereFormBasedAuthenticator I FWLSE0055I: Not recognized.
[2/13/13 15:38:27:288 IST] 0000004b ication.internal.jaas.modules.UsernameAndPasswordLoginModule A CWWKS1100A: Authentication did not succeed for user ID wpsbind. An invalid user ID or password was specified.
[2/13/13 15:38:27:742 IST] 0000004f com.worklight.core.auth.ext.WebSphereFormBasedAuthenticator I FWLSE0055I: Not recognized.
[2/13/13 15:38:27:746 IST] 0000004f com.worklight.core.auth.ext.WebSphereFormBasedAuthenticator I FWLSE0055I: Not recognized.
[2/13/13 15:38:27:747 IST] 0000004f com.worklight.core.auth.impl.AuthenticationFilter E FWLSE0048E: Unhandled exception caught: realm WASLTPARealm is not allowed to ignore request to a protected resouce in a non-success state
java.lang.IllegalStateException: realm WASLTPARealm is not allowed to ignore request to a protected resouce in a non-success state
at com.worklight.core.auth.impl.AuthenticationContext.checkAuthentication(AuthenticationContext.java:515)
at com.worklight.core.auth.impl.AuthenticationContext.processRealms(AuthenticationContext.java:396)
at com.worklight.core.auth.impl.AuthenticationContext.pushCurrentResource(AuthenticationContext.java:373)
at com.worklight.core.auth.impl.AuthenticationServiceBean.accessResource(AuthenticationServiceBean.java:63)
at com.worklight.core.auth.impl.AuthenticationFilter.doFilter(AuthenticationFilter.java:162)
at com.ibm.ws.webcontainer.filter.FilterInstanceWrapper.doFilter(FilterInstanceWrapper.java:188)
at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:85)
at com.ibm.ws.webcontainer.filter.WebAppFilterManager.doFilter(WebAppFilterManager.java:940)
at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:1037)
at com.ibm.ws.webcontainer.servlet.CacheServletWrapper.handleRequest(CacheServletWrapper.java:81)
at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:930)
at com.ibm.ws.webcontainer.osgi.DynamicVirtualHost$2.run(DynamicVirtualHost.java:274)
at com.ibm.ws.http.dispatcher.internal.channel.HttpDispatcherLink$TaskWrapper.run(HttpDispatcherLink.java:529)
at com.ibm.ws.threading.internal.Worker.executeWork(Worker.java:398)
at com.ibm.ws.threading.internal.Worker.run(Worker.java:380)

Answer 1

The authentication takes place in Liberty, and in order for Worklight to recognize the logged-in user, it needs to know of it.
Form-based authentication will not help here. What you can and should do is implement a Custom-based Authenticator that will retrieve from the response from Liberty the custom HTTP header containing the user information.
You can read more about Custom-based Authentication in the following Getting Started training module, to first familiarize yourself with the concept:
ftp://public.dhe.ibm.com/software/mobile-solutions/worklight/docs/v505/Module_23_-_Custom_Authenticator_and_Login_Module.pdf
For a clearer "image" of the authentication flow, you can see the diagram as depicted here: http://pic.dhe.ibm.com/infocenter/wrklight/v5r0m5/topic/com.ibm.worklight.help.doc/integ/r_authentication_at_the_gateway.html