GlassFish + PostgreSQL server bundles

I'm pretty curious about the Take-Up Rate of GlassFish with PostgreSQL database bundle. Download here.

It has been a long while since I last worked on PostgreSQL database. Ever since I grabbed a copy MySQL, I have never turned back. Ha!



.

Pain upgrading to Oracle iPlanet Web Server 7.0.10

As part of the security/hardening measures of my current project, we are required to update every software component to the latest with patches. 

It's time to say bye-bye to Sun Java System Web Server branding. 

However, the upgrade experience wasn't pleasant... *Sigh*

Very strange - "Cannot upgrade the product from version 7.0U8 to 7.0.10" 


How can it be? This is not how Sun product works ... Every release should have a proper upgrade path. It has always been so.


What's the hack then?

Step 1: Go to /appl/opt/webserver7/setup
Step 2: Edit WebServer.inf

Step 3: Remove 8 from PRODUCT_SP_VERSION

Step 4: Remove U8 from PRODUCT_FULL_VERSION

Step 5: Done

Welcome to Oracle iPlanet Web Server 7.0.10!

.

ESSO product from PasswordBank

I have been involved with numerous SSO (Single Sign-On) projects - some of which are complemented by ESSO (Enterprise Single Sign-On) product.

Passlogix v-GO SSO was pretty popular. So popular that it's now being bought over by Oracle. So far, I have participated in 2 projects using Passlogix v-GO SSO. Pretty easy to configure if the user source is Microsoft Active Directory. A lot harder if Sun Directory Server is used as the user source. It's basically a Microsoft-centric product (my personal opinion).

Today, I came across a ESSO product from PasswordBank. Started in 2008, still a pretty young company.

This product differentiates itself by being able to support Desktop Platforms like Windows, Linux and Mac OS. This is something great! ESSO product has always been very Windows driven.

OpenSSO - Agents and Policies Entries in OpenDS

For this on-going project which I have been in-charge of since last August, I have been playing around with Agents and Policies more often than my previous projects.

Ever wonder where the configuration for the Agents is in OpenDS?

Answer is ou=AgentService, ou=services, ... :

How about the Policies? Where are they stored?

 Answer is ou=iPlanetAMPolicyService, ou=services, ... :

I find the latter most useful for me. Instead of creating policies via the OpenSSO Admin Console (which to me is pretty tedious), I'll go direct to OpenDS and edit the sunKeyValue for the xmlpolicy.

I'm lazy, maybe. :)

.

Active Directory Authentication Error via OpenSSO

We have configured OpenSSO Authentication Service to perform authentication via Microsoft Active
Directory.

We know that Microsoft Active Directory is able to detect first-time-login, password expired, account locked, account disabled etc ...

However, by using the in-built Active Directory Authentication module in OpenSSO, it keeps displaying the same error "Invalid credentials" whenever any of the errors is encountered. This confuses the users a lot. It also gives administrator wrong impression of what exactly is the error.


If a manual search is performed, the following is what we get:

bash-3.00# ldapsearch -h 192.168.131.50 -p 389 -D "cn=cclow,cn=users,dc=central,dc=sg,dc=sun" -b "dc=central,dc=sg,dc=sun" -s sub "objectclass=*"
Enter bind password:
ldap_simple_bind: Invalid credentials
ldap_simple_bind: additional info: 80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 773, v1771


bash-3.00# ldapsearch -h 192.168.131.50 -p 389 -D "cn=cclow,cn=users,dc=central,dc=sg,dc=sun" -b "dc=central,dc=sg,dc=sun" -s sub "objectclass=*"
Enter bind password:
ldap_simple_bind: Invalid credentials
ldap_simple_bind: additional info: 80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 533, v1771


Microsoft Active Directory has this habit of sending back error messages in 2 lines. The 1st contains what I call it General Error Message. The 2nd will contain the Actual Error Message ("additional info").

In this 2nd line, you need to tokenizes the message to grab the part that contains ", data xxx,". This will give you the Exact Error Message.

ldap_simple_bind: additional info: 80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 533, v1771

So we went ahead to develop our own custom Active Directory Authentication module, and we have the following mapping:

public static final String ERROR_FIRSTTIME = "773";
public static final String ERROR_PASSWORDEXPIRED = "532";
public static final String ERROR_ACCOUNTLOCKED = "775";
public static final String ERROR_ACCOUNTDISABLED = "533";
public static final String ERROR_ACCOUNTEXPIRED = "701";


.

To Configure the OpenSSO Enterprise Deployment Against Cookie Hijacking

The OpenSSO Infrastructure which I had setup has just been configured to prevent Cookie Hijacking.

With this change, all my Policy Agents have to be re-configured. There's again this standard document from Sun. And once again, it disappoints me.

If your Policy Agents are deployed behind a load-balancer, then the above steps are not sufficient enough.

 You'll get the following errors:

ERROR: Invalid Agent: Could not get agent for the realm

What's the complete steps to configure for Cookie Hijacking Prevention?

Step a and b:

Step c:

Change Agent Root URL for CDSSO from host-based FQDN to load-balancer FQDN.

.

Yahoo Mail Filter is back!

I mentioned in my blog in February that I'm saying Goodbye to Yahoo Mail.

It has been a long while since I went into Yahoo Mail. I did that just. 

The Filter feature is available now!  Cool!

.

Backup OpenSSO Configuration Data in Embedded OpenDS

OpenSSO 8.0 U2 comes bundled with a super old embedded OpenDS. (Version 1.0.2)

The current version of OpenDS is 2.2.

Anyway, that aside, the embedded OpenDS comes with a number of sub-folders left empty.

E.g. bin, classes, lib

Without the executables in bin directory, there is no way to backup the configuration data which are all stored in the OpenDS.

What's the workaround?

1. Go to the j2ee-modules in GlassFish application deployment directory 

   .../j2ee-modules/opensso/WEB-INF/lib

2. Copy OpenDS.jar and je.jar to lib directory in OpenDS

3. Go to OpenDS 1.0 website

4. Download the zip file (Note: Do not download the latest OpenDS 2.2 zip file. It will bomb.)

5. Upload _mixed-script.sh, _server-script.sh, _client-script.sh and _script-util.sh to lib directory in OpenDS

6. Upload to executables to bin directory in OpenDS

For me, I'm only interested in backup, export-ldif and status since my environment is going LIVE soon.


.

Load Balancer in Front of the Web Agent

I continue to play with OpenSSO Policy Agent 3. This time round, I have 2 x Policy Agents deployed behind a load balancer. The Sun Web Server 7 acts as a Reverse Proxy to the backend GlassFish Application Server 2.1 running Sun Identity Manager.

Naturally, I'll follow the steps from Sun OpenSSO Enterprise Policy Agent 3.0 User's Guide for Web Agents. (Read here)


Oh mine!


The instruction was wrong and I spent a long time debugging the configuration steps. In the end, I had to read the source code for the Policy Agent for Sun Web Server 7.

The source was in C and C++. I'm never a C person. :) Another struggle.




The instruction to configure FQDN is OK.

Problems come when you start to read further down ...

If you map the above instruction to the UI in OpenSSO console (see below), you will never be able to find a way to configure the last property.

 In fact, the instruction should simply be Enabled or Not enabled.

The last property is supposed to be "Enabled". 


That's not all. There is another place where you need to make slight change:

The Agent Deployment URI Prefix should change from "Host-url/amagent" to "LB-url/amagent".


.

Confusing Oracle/Sun Solaris OS Versioning

I'm always confused when I want to find out the exact release of the Solaris OS which I am working on.
If you do a "$ more /etc/release", you get something like below:

It's still very hard to relate 9/10 belongs to which release. I can relate more to U1, U2, etc... It's easier to track, at least for me.

Luckily, Wikipedia tracks it here.

• Solaris 10 1/06 ("U1")
• Solaris 10 6/06 ("U2")
• Solaris 10 11/06 ("U3")
• Solaris 10 8/07 ("U4")
• Solaris 10 5/08 ("U5")
• Solaris 10 10/08 ("U6")
• Solaris 10 5/09 ("U7")
• Solaris 10 10/09 ("U8")
• Solaris 10 9/10 ("U9")

.

OpenSSO - Installing Policy Agent on Oracle/Sun Web Server 7

I'm deploying a large-scale Single Sign-On infrastructure using OpenSSO for the local education ministry. 

There is a Sun Web Server 7 performing a Reverse Proxy to a backend application, and we intend to deploy the OpenSSO Policy Agent on the web server.

There is a certain sequence to follow to ensure the Policy Agent works:

1. Install Sun Web Server 7

2. Install OpenSSO Policy Agent for Sun Web Server 7

3. Configure Reverse Policy to backend application

If you swap 2 with 3, the Policy Agent will not be able to intercept user access via the reverse proxy, thus render the Policy Agent useless.

Why?

Take a look at the object configuration file in the Web Server config directory.
(Note: Not obj.conf, but -obj.conf)

The /UpdateAgentCacheServlet and /dummypost/sunpostpreserve must precede reverse-proxy-/.

If you swap 2 with 3, you'll find that 

reverse-proxy-/ precedes /UpdateAgentCacheServlet and /dummypost/sunpostpreserve.

If you to manually swap the sequence to make Policy Agent to work.


.

OpenSSO - Weird Policy Agent Naming Convention

I have been playing around with OpenSSO Policy Agent for a few weeks - installing and uninstalling many times.

Policy Agent installer uses the convention Agent_nnn as the Agent instance name. The 1st instance will be named Agent_001; 2nd instance will be named Agent_002.

The weird behavior happens when you uninstall the 2nd instance and then you install again. Logically, one would want this re-installed instance to be named as Agent_002 again. (since this is really the 2nd instance on the same server) 

Logical, no?

Sadly enough, the Policy Agent installer will skip Agent_002. It will rename this new instance as Agent_003, which is not acceptable to me!

What's the trick then?

Look for this hidden file in /sjsws_agent/data/.amAgentLookup

Before uninstall,

# Product Instances Translation Lookup File
Product_Instance_Count= 2
/opt/webserver7/https-ams.sso.mo.sg-1/config|= Agent_001
/opt/webserver7/https-ams.sso.mo.sg-2/config|= Agent_002

After uninstall,

# Product Instances Translation Lookup File
Product_Instance_Count= 2
/opt/webserver7/https-ams.sso.mo.sg-1/config|= Agent_001


The Policy Agent installer program was able to remove the line ending with "Agent_002", but was just to lazy to decrement the Product_Instance_Count from 2 to 1. I feel like kicking the developer who wrote this piece of code.

Nevertheless, to resolve the issue, manually set the value to 1 prior to re-install again.

.

OpenAM from ForgeRock

I have been wanting to install OpenAM for a while, but didn't have the time to do so until now.

Nothing much have changed except the color scheme. It's now orange, instead of the blue which we are used to for a while. :)

A slight difference in one of the OpenAM Configurator steps - User Data Store Settings. 

There are now 6 types of supportable User Data Store Types to choose from. 

Once configuration is done, we are redirected to the Login Page as usual.

It's a nicer page! Welcome to OpenAM!

.

MySQL Latest Price List

Oracle is giving you more support options, thus they need to collect more $ from you.

It's for your own good, my friend. 

Oracle knows better than you.

.

Algorithm DES/ECB is not available from provider Cryptix

I was tasked to port a very old Web Services application to Sun Glassfish Enterprise Server 2.1.1. This application uses a cryptography library from Cryptix. (Cryptix has been dead since 2005.)

 

On my development environment on MacBook, everything runs fine on Glassfish with JDK 1.6.0_16. However, when I ported to the production environment on Solaris 10, I kept getting the following error:


java.security.NoSuchAlgorithmException: algorithm DES/ECB is not available from provider Cryptix
at xjava.security.IJCE.getClassCandidate(IJCE.java:457)
at xjava.security.IJCE.getImplementationClass(IJCE.java:410)
at xjava.security.IJCE.getImplementation(IJCE.java:367)
at xjava.security.Cipher.getInstance(Cipher.java:489)
at xjava.security.Cipher.getInstance(Cipher.java:452)
at com.sun.moe.security.DESEncryptor.decrypt(DESEncryptor.java:133)
at com.sun.moe.login.AppLogin.main(AppLogin.java:80)


Very strange! After a long debugging session, I found the issue was with the JDK 1.6.x version.

I downgraded the JDK to 1.5.0_20 that shipped default with Solaris 10. It works!


I believe there must be some "tightening" done in this file in JRE, but I just cannot figure how to resolve it.

-bash-3.00$ cat /jdk/jdk1.6.0_16/jre/lib/security/sunpkcs11-solaris.cfg


#
# Configuration file to allow the SunPKCS11 provider to utilize
# the Solaris Cryptographic Framework, if it is available
#


name = Solaris


description = SunPKCS11 accessing Solaris Cryptographic Framework


library = /usr/lib/$ISA/libpkcs11.so


handleStartupErrors = ignoreAll


attributes = compatibility


disabledMechanisms = {
CKM_MD2
CKM_MD5
CKM_SHA_1
CKM_SHA256
CKM_SHA384
CKM_SHA512
CKM_DSA_KEY_PAIR_GEN
# KEY_AND_MAC_DERIVE disabled due to Solaris bug 6306708
CKM_SSL3_KEY_AND_MAC_DERIVE
CKM_TLS_KEY_AND_MAC_DERIVE
# the following mechanisms are disabled due to performance issues (Solaris bug 6337157)
CKM_DSA_SHA1
CKM_MD5_RSA_PKCS
CKM_SHA1_RSA_PKCS
CKM_SHA256_RSA_PKCS
CKM_SHA384_RSA_PKCS
CKM_SHA512_RSA_PKCS
# the following mechanisms are disabled to ensure backward compatibility (Solaris bug 6545046)
CKM_DES_CBC_PAD
CKM_DES3_CBC_PAD
CKM_AES_CBC_PAD
}


Anyone has an idea?

.

OpenSSO - High-Available Data Stores

In a highly available setup, the OpenSSO Enterprise Server should connect to at least a pair of Data Stores.

When a failover kicks in, the following will be captured in IdRepo log file:

IdCachedServicesImpl.getAttributes(): null found all attributes in Cache.
LDAPv3EventService:11/10/2010 02:50:10:642 PM SGT: Thread[LDAPv3EventService,5,main]
WARNING: LDAPv3EventService.run() LDAPException received: randomID=1490605490
com.sun.identity.shared.ldap.LDAPException: Server or network error (81)
at com.sun.identity.shared.ldap.LDAPConnThread.networkError(LDAPConnThread.java:782)
at com.sun.identity.shared.ldap.LDAPConnThread.run(LDAPConnThread.java:567)
at java.lang.Thread.run(Thread.java:619)


LDAPv3EventService:11/10/2010 02:50:10:651 PM SGT: Thread[LDAPv3EventService,5,main]
LDAPv3EventService.dispatchAllEntriesChangedEvent() psIdKey=ds2.sso.mo.sg:1389 ds1.sso.mo.sg:1389o=Edu,c=SGo=Edu,c=SG(objectclass=*)
LDAPv3Repo:11/10/2010 02:50:10:651 PM SGT: Thread[LDAPv3EventService,5,main]
LDAPv3Repo.objectChanged: dn=null; changeType4; psIdKey=ds2.sso.mo.sg:1389 ds1.sso.mo.sg:1389o=Edu,c=SGo=Edu,c=SG(objectclass=*); allObjChanged=true; clearCache=true
idrepoListener:11/10/2010 02:50:10:652 PM SGT: Thread[LDAPv3EventService,5,main]
**********************************************
idrepoListener:11/10/2010 02:50:10:652 PM SGT: Thread[LDAPv3EventService,5,main]
IdRepoListener: allObjectsChanged Called!
amIdmJAXRPCServer:11/10/2010 02:50:10:679 PM SGT: Thread[LDAPv3EventService,5,main]
**********************************************




The failover works! Cool!


However, when the primary Data Store is up again, the OpenSSO Enterprise Server does not switch back from the secondary Data Store.

.

OpenSSO - Policy Agent Issue with Time Sync

I was debugging a OpenSSO Policy Agent issue for a customer. He has deployed the Policy Agent for Sun Java Systems Web Server 7.

The application which resides on the Web Server 7 gets protected Policy Agent and redirected to the OpenSSO Login Page. However, when he keyed in valid username and password, the browser kept hanging on the OpenSSO Login Page.

From the Policy log in OpenSSO Enterprise Server, I noticed that there was lot of communications between the agent and the server (even though the browser looks "hang" on the Login Page). The following segment keeps repeating.

From the amAgent log, I noticed the following:

2010-11-09 14:41:47.618 Warning 25919:815c858 ServiceEngine: Service::getPolicyResult():Result size is 0,tree not present for http://ok.sso.mo.sg:8080/index.html

2010-11-09 14:41:47.618MaxDebug 25919:815c858 AM_POLICY_SERVICE: am_policy_compare_urls(): compare usePatterns=true returned 0
2010-11-09 14:41:47.618MaxDebug 25919:815c858 AM_POLICY_SERVICE: am_policy_compare_urls(): compare usePatterns=true returned 4
2010-11-09 14:41:47.618 Debug 25919:815c858 all: Policy time stamp for resource http://ok.sso.mo.sg:8080/* is (1289284876056000)2010-11-09 14:41:16.056.
2010-11-09 14:41:47.618 Info 25919:815c858 all: Policy node http://ok.sso.mo.sg:8080/* marked stale due to time out.


Something is fishy. This has something to do with time sync.

I checked and confirmed that the 2 servers (OpenSSO Enterprise Server and the Web Server) were in different time zone. I tweaked with NTP and made them sync with the same clock.

Re-run and the policy agent works like a charm!

.

Sun Access Manager 7.1 - Password Retries Exceeded Issue

I have a customer in Thailand asking me for help with regard to a weird error message when he tries to login after his password retries have exceeded.


He was warned of account lockout prior to his max password retries count. This is what he expected. Good. 

However, "Authentication failed" error message is shown when he really exceeded his max password retries count. He was expecting "Password retry limit exceeded". No Good.

I did a search in amAuthLDAP.properties:

#ExceedRetryLimit=Exceed password retry limit. Please try later.
ExceedRetryLimit=Authentication failed.


That explains why. This is more for security/auditing purpose. These days, auditors advise customers not to reveal too much to end-users when they encounter login failure.

.

OpenSSO - WebtopNaming Error

I was trying to configure a Site for my 2 OpenSSO Enterprise Servers and I hit the famous WebtopNaming error as shown below:

Servlet /opensso threw load() exception
java.lang.StackOverflowError
:
at java.util.concurrent.locks.ReentrantReadWriteLock$ReadLock.lock(ReentrantReadWriteLock.java:594)
at com.iplanet.am.util.SystemProperties.get(SystemProperties.java:252)
at com.iplanet.am.util.SystemProperties.get(SystemProperties.java:329)
at com.iplanet.services.naming.WebtopNaming.getServerID(WebtopNaming.java:620)
at com.iplanet.services.naming.WebtopNaming.getServerID(WebtopNaming.java:594)
at com.iplanet.services.naming.WebtopNaming.updatePlatformServerIDs(WebtopNaming.java:1186)
at com.iplanet.services.naming.WebtopNaming.updateNamingTable(WebtopNaming.java:1111)
at com.iplanet.services.naming.WebtopNaming.getNamingProfile(WebtopNaming.java:995)
at com.iplanet.services.naming.WebtopNaming.getServerID(WebtopNaming.java:658)
at com.iplanet.services.naming.WebtopNaming.getServerID(WebtopNaming.java:594)

There could be many scenarios that can cause this problem. Mine is kind of stupid today.

I was careless in appending an additional "/" to "/opensso". Be careful! 

.

OpenSSO - Manual configuration

I was trying to configure OpenSSO Enterprise Server manually without using the GUI Configurator.

The following error was encountered:

-bash-3.00$ java -jar /dist/osso/tools/config/configurator.jar -f /dist/osso/tools/config/osso1-config

Not Found

Configuration failed!

What an unfriendly error message! What is "Not Found"?

It was only after a while then I realized I have forgotten to deploy the opensso.war into my Glassfish container. How careless I was!

So here we go again:

-bash-3.00$ opt/gf211/bin/asadmin deploy --user admin --port 7878 --secure /dist/osso/opensso.war
Command deploy executed successfully.


-bash-3.00$ java -jar /dist/osso/tools/config/configurator.jar -f /dist/osso/tools/config/osso1-config
Checking configuration directory /sso/var/opensso....Success.
Installing OpenSSO configuration store...Success RSA/ECB/OAEPWithSHA1AndMGF1Padding.
Installing OpenSSO configuration store in /sso/var/opensso/opends...Success.
Creating OpenSSO suffix...Success.
Tag swapping schema files....Success.
Loading Schema am_sm_ds_schema.ldif...Success.
Loading Schema am_remote_opends_schema.ldif...Success.
Loading Schema fam_sds_schema.ldif...Success.
Reinitializing system properties....Done
Registering service amEntrySpecific.xml...Success.
:
:
Configuring system....Done
Configuring server instance....Done
Creating Web Service Security Agents....Done
Setting up registration files....Done
Configuration complete!

Nevertheless, I still think that we can do better with a friendlier error message.

.