I have an embedded implementation of Jetty 7 running as a service and want to add basic authentication with no web.xml file for a servlet.
I created my credentials using the steps described here
I thought that I could create the server, create a security handler with basic authentication and attach a HashLoginService to the security manager. But I am clearly missing several things because I am never getting prompt for credentials.
Below is the code. Any help would be greatly appreciated.
server = new Server(port);
server.addConnector(getSslChannelConnector(securePort));
server.setGracefulShutdown(1000);
server.setStopAtShutdown(true);
// create the context handler for the server
ServletContextHandler sch = new ServletContextHandler(server, WEBAPP_CONTEXT);
// attach the security handler to it that has basic authentication
sch.setSecurityHandler(getSecurityHandler());
// define the processing servlet.
sch.addServlet(new ServletHolder(new ProcessingServlet()), "/process");
.
.
private SecurityHandler getSecurityHandler() {
// add authentication
Constraint constraint = new Constraint(Constraint.__BASIC_AUTH,"user");
constraint.setAuthenticate(true);
constraint.setRoles(new String[]{"user","admin"});
// map the security constraint to the root path.
ConstraintMapping cm = new ConstraintMapping();
cm.setConstraint(constraint);
cm.setPathSpec("/*");
// create the security handler, set the authentication to Basic
// and assign the realm.
ConstraintSecurityHandler csh = new ConstraintSecurityHandler();
csh.setAuthenticator(new BasicAuthenticator());
csh.setRealmName(REALM);
csh.addConstraintMapping(cm);
// set the login service
csh.setLoginService(getHashLoginService());
return csh;
}
private HashLoginService getHashLoginService() {
// create the login service, assign the realm and read the user credentials
// from the file /tmp/realm.properties.
HashLoginService hls = new HashLoginService();
hls.setName(REALM);
hls.setConfig("/tmp/realm.properties");
hls.setRefreshInterval(0);
return hls;
}
I got this working and posted a sample webapp here
The code looks broadly ok.
My interface is slightly different for adding the ConstraintMapping as the single CM add seems have gone in my version of jetty 7.
securityHandler.setConstraintMappings(new ConstraintMapping[] {cm});
Bar that my code is basically identical and does work for me.
Note that once authenticated your browser will not prompt you again unless you restart your browser or follow the instructions here
Related
Apple released their New Generation WSDL on the 15 of August this year (2015) and the big change was that every call to the WSDL had to be validated with a certificate file.
I've done the process to get the certificate from Apple, and I've whitelisted our server IP, and I've even verified that I can get access to the service endpoint from our server by coding a simple interface using HttpWebRequest where I easily can attach the certificate using webRequest.ClientCertificates.Add(), so I know everything is ready for it to work.
But, my problem arises when I download the WSDL from https://gsxwsut.apple.com/apidocs/prod/html/WSArtifacts.html?user=asp
I import the WSDL into Visual Studio and when I try to make an instance of the client class, the only one I find is GsxWSEmeaAspPortClient, which seems to be correct as it has all the functions for authenticate and various tools, but it does not have ClientCertificates. It does have ClientCredentials which have ClientCertificate, but when I try to set the cert there, it's as tho it's never set.
I'm guessing the service code transmits the data via either HttpWebRequest or WebRequest, so if I just can get to the request code from my instance of the class (GsxWSEmeaAspPortClient) I can probably fix it, but I can't seem to get there.
I've looked at this question: How can I connect with Apple's GSX NewGeneration webservices with WCF? which suggests it really should be that easy, but I don't have the GsxWSEmeaAspService, only the GsxWSEmeaAspPortClient from my Visual Studio's generation of the WSDL.
If anyone has any ideas which can point me in any direction towards victory I'd be eternally grateful.
I'm using Visual Studio 2013 and the solution is .Net v4.5.1 if that makes any difference.
I've pasted new code here:
public void Authenticate() {
// Use custom binding with certificate authentication
BasicHttpBinding binding = new BasicHttpBinding(BasicHttpSecurityMode.Transport);
binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Certificate;
// Create service endpoint
// Use proper endpoint address - eg. gsxapi.apple.com for production
EndpointAddress endpoint = new EndpointAddress("https://gsxapiit.apple.com/gsx-ws/services/emea/asp");
// Create new service
Apple.GsxWSEmeaAspPortClient service = new Apple.GsxWSEmeaAspPortClient(binding, endpoint);
// Set loaded certificate
service.ClientCredentials.ClientCertificate.Certificate = new X509Certificate2(
"[PathToContainerFromStep7].p12",
"[YourPasswordFromStep8]");
// Create authenticate request object
Apple.authenticateRequestType auth = new Apple.authenticateRequestType()
{
languageCode = "en",
userId = "[YourAppleServiceAccountNumber]",
userTimeZone = "[YourTimeZone]",
serviceAccountNo = "[YourSoldToNumber]"
};
// Authenticate to Apple GSX
Apple.authenticateResponseType session = service.Authenticate(auth);
// Assign your new session id object
userSessionId = new Apple.gsxUserSessionType() { userSessionId = session.userSessionId };
}
How to assign to workers a proxy that requires user name - password and a custom user agent using Selenium, PhantomJS driver with Python bindings.
I've had good success with creating many workers traversing my test website. I can also assign a user agent or a proxy that does not require authorization. But I haven’t figured out how to do both to the same worker at the same time yet.
However the real issue at the moment is assigning a proxy to the workers that require authorization by a user name and password.
The Players:
Selenium 2.33.0 / PhantomJS 1.9.1 / Python 2.7.3 / Ubuntu 12.04
Me:
Nube. Python weeks, Linux days, Selenium hours, PhantomJS -= , SO first post
Searches Yielded:
How do I set a proxy for phantomjs/ghostdriver in python webdriver?
The answers may in fact be there and many other places I have read and re-read, but I can’t connect the dots at my present level.
User Agent solved with this method.
dcap = dict(DesiredCapabilities.PHANTOMJS)
dcap["phantomjs.page.settings.userAgent"] = (
"Any User Agent string here”)
driver = webdriver.PhantomJS(desired_capabilities=dcap)
Proxy without authorization works with this:
service_args = [
'--proxy=127.0.0.1:9999',
'--proxy-type=http,
]
driver = webdriver.PhantomJS('/usr/local/bin/phantomjs,service_args=service_args)
If both above methods are used I’m unsure how to pass both proxy and UA to the PhantomJS driver. ATM I’m only able to do one or the other and not at all with a proxy that requires authorization.
Goal for this SO thread:
Learn how to assign a proxy that requires user name / password
Assign a custom user agent to the same worker.
Using Selenium, PhantomJS driver with Python bindings.
The end game goal is to assign each worker a unique ip and pull from a pool of user agents. Creating the logic for this I remain optimistic but the proxy with authorization is kicking me at the moment.
As you can tell I’m very new to all of this and would appreciate any help and examples to this particular problem.
Thanks!
EDIT: Below accepted answer is incorrect. Unable to reproduce below solution. Only the proxy with authorization is assigned to the driver. Still unable to assign both proxy and a user agent to the same driver.
Any help or direction would be greatly appreciated.
EDIT.02: Issue resolved. It was never a coding issue. A new proxy provider at the server level assigned a default UA that overrode the above script. Once this was removed all was good.
Assign User Agent by Desired Capabilities
dcap = dict(DesiredCapabilities.PHANTOMJS)
dcap["phantomjs.page.settings.userAgent"] = (
"Your User Agent String here . . .")
Found API Reference here for the proxy authorization.
Add "--proxy-auth=username:password" to server_args. Like . . .
service_args = [
'--proxy=xxx.xxx.xx.xxx:xxxx',
'--proxy-auth=username:password',
'--proxy-type=http',
]
Then use both when starting the webdriver
driver = webdriver.PhantomJS(desired_capabilities=dcap,service_args=service_args)
This took care of all my issues.
EDIT: Unable to reproduce solution. Only proxy is changed with above method.
EDIT.02: Issue resolved. It was never a coding issue. A new proxy provider at the server level assigned a default UA that overrode the above script. Once this was removed all was good.
We are developing a barcode application to run on our mobile computers running Windows Mobile 5.0 Pocket PC and it needs to get it's data from our Oracle database.
Apex is already set up but how can I create a secure Web Service using Apex's native Authentication? How to set "HTTPS only"?
Update
I can call the ...?wsdl link in the browser now, looks fine. It's also registered in the project as a WebReferance.
But when I run the following code:
CONTAR_USUARIOSService service = new CONTAR_USUARIOSService();
System.Net.NetworkCredential pocket = new System.Net.NetworkCredential("pocket", "000");
service.Credentials = pocket;
double resultado = service.CONTAR_USUARIOS();
I get this error:
System.Net.WebException was unhandled
Message="WebException"
StackTrace:
at System.Web.Services.Protocols.SoapHttpClientProtocol.doInvoke(String methodName, Object[] parameters, WebClientAsyncResult asyncResult)
at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
at Supernorte.Recebimento.ContarUsuariosWebReference.CONTAR_USUARIOSService.CONTAR_USUARIOS()
at Supernorte.Recebimento.Login..ctor()
at Supernorte.Recebimento.MainForm.mostrarLogin()
at Supernorte.Recebimento.MainForm..ctor()
at Supernorte.Recebimento.Program.Main()
I get an "Unauthorized" error.
If you get your Oracle inputs and outputs routed through your web service (which I am still personally struggling with), you might be able to access your information that way.
Add the web reference.
It will ask for the URL where your Web Service has been uploaded. I'm guessing this can be a website you own off site, but I use our internal server.
You can see I have a default web page where I load up the available services that I've stuck out there. 1Mainframe.svc` was going to be my "Big Service", but then I realized that I needed to do a lot more than make that once call, so I created the next one, "Erp Service".
Anyway, after I select the ErpService.svc, I'm given this, where I changed the default Web Reference Name to ErpService1. I've personally found that if I need to edit or modify the service, the XML config files get all messed up, so I just delete Service1 and add Service2.
I add a new class called ErpClass1.cs
Add a reference to my Web Service using the namespace for my project, and start coding!
using System;
using System.Linq;
using System.Collections.Generic;
using System.Text;
using AcpMobile5.ErpService1;
namespace AcpMobile5 {
class ErpClass1 {
private ErpService m_erpService;
public ErpClass1() {
m_erpService = new ErpService();
}
public void Query(string woNumber) {
m_erpService.Query(woNumber);
}
public string PartNumber() {
return m_erpService.CoilPartNo();
}
}
}
Obviously, this does not solve everything for you. The Web Service that you use to access your Oracle database still needs to be written, and that's no simple task.
However, I hope it helps point you along the right direction.
This is all done using Visual Studio 2008 for Mobile 5.0.
So, I didn't use Apex as I intended. Instead I enabled Oracle XML DB Native Web Services.
After some hard times with authentication [mostly caused by typing the wrong password ): ] I got this code working:
MyWebService service = new MyWebService();
service.Credentials = new MyWebService("MY_ORACLE_USER", "*******");
double result = service.MY_LOGIN_FUNCTION(this.userName);
Actually I am trying to add items in a share point List from a windows application. It all goes fine when I added the web reference and the able to get the all the offerings listed for Lists.asmx.
When I execute my program and try to call listServiceObj.GetListAndview("Customers","");
It gives me error "The request failed with HTTP status 401: Unauthorized" . Please note that at this time my credentials and url of the service reference were;
SpListService.Lists spListService = new SpListService.Lists();
spListService.Credentials = System.Net.CredentialCache.DefaultCredentials;
spListService.Url = "http://localhost/_vti_bin/Lists.asmx";
XmlNode customerListView = spListService.GetListAndView("Customers", "");
Then I Changed the above code to ;
SpListService.Lists spListService = new SpListService.Lists();
spListService.Credentials = System.Net.CredentialCache.DefaultCredentials;
spListService.Url = "http://<PC-Name>/sites/Home/_vti_bin/Lists.asmx";
XmlNode customerListView = spListService.GetListAndView("Customers", "");
then I recieved the following error;
"Exception of type 'Microsoft.SharePoint.SoapServer.SoapServerException' was thrown."
I have made the logged in user in the group of full controll. also the member of the Administrator group.. but same result....
Also please note that when try and access "http://localhost/" or "http:///" it gives me access denied page of SP2010.... instead I have to write "http:///sites/Home/SitePages/Home.aspx" to open my team site collection
I really stuck in to this .... would be really pleased to have some solution to this problem of mine...... Thanks in advance
MJay
I had a similar problem when I implemented my first SharePoint lists Web Service client. The reason was that the autogenerated client class actually introduced itself as a Mozilla web browser by default! The SharePoint server did not allow basic authentication for browsers so the client was actually redirected to firewall login page.
I suggest you to inherit another class from the Lists class and do the following:
Set another user agent value in constructor.
Set the "preauthenticate" property to true. This should force the client to send the credentials in the first request, not only after they have been asked for.
If necessary, try giving the credentials explicitly.
See the example below.
public class CustomizedLists : Lists
{
public CustomizedLists() : base()
{
this.UserAgent = "Some SharePoint client";
this.PreAuthenticate = true;
System.Net.ICredentials creds = new System.Net.NetworkCredential("user", "pwd");
this.Credentials = creds.GetCredential(uri, "Basic");
}
}
I created a very simple webservice in ASP.NET 2.0 to query a list in SharePoint 2007 like this:
namespace WebService1
{
/// <summary>
/// Summary description for Service1
/// </summary>
[WebService(Namespace = "http://tempuri.org/")]
[WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]
[System.ComponentModel.ToolboxItem(false)]
// To allow this Web Service to be called from script, using ASP.NET AJAX, uncomment the following line.
// [System.Web.Script.Services.ScriptService]
public class Service1 : System.Web.Services.WebService
{
[WebMethod]
public string HelloWorld()
{
return "Hello World";
}
[WebMethod]
public string ShowSPMyList()
{
string username = this.User.Identity.Name;
return GetList();
}
private string GetList()
{
string resutl = "";
SPSite siteCollection = new SPSite("http://localhost:89");
using (SPWeb web = siteCollection.OpenWeb())
{
SPList mylist = web.Lists["MySPList"];
SPQuery query = new SPQuery();
query.Query = "<Where><Eq><FieldRef Name=\"AssignedTo\"/><Value Type=\"Text\">Ramprasad</Value></Eq></Where>";
SPListItemCollection items = mylist.GetItems(query);
foreach (SPListItem item in items)
{
resutl = resutl + SPEncode.HtmlEncode(item["Title"].ToString());
}
}
return resutl;
}
}
}
This web service runs well when tested using the built-in server of Visual Studio 2008. The username indicates exactly my domain account (domain\myusername).
However when I create a virtual folder to host and launch this web service (still located in the same machine with SP2007), I got the following error when invoking ShowSPMyList() method, at the line to execute OpenWeb(). These are the details of the error:
System.Data.SqlClient.SqlException: Cannot open database "WSS_Content_8887ac57951146a290ca134778ddc3f8" requested by the login. The login failed.
Login failed for user 'NT AUTHORITY\NETWORK SERVICE'.
Does anyone have any idea why this error happens? Why does the web service run fine inside Visual Studio 2008, but not when running stand-alone? I checked and in both cases, the username variable has the same value (domain\myusername).
Thank you very much.
Thank you very much for the replies. I'll look into the documents to see how i can change the settings related to the application pool as suggested.
I want to make clear that i wanted to build a webservice to run outside of sharepoint (but can be deployed on the same server with sharepoint).
Is there any way i can programmatically pass the credentials (another domain account instead of 'NT AUTHORITY\NETWORK SERVICE' by default) to sharepoint when invoking OpenWeb method? I believe if i'm able to do that then i can walkaround the security issue above.
When you create your own custom virtual folder and set it inside the IIS, it's highly possible that the user account who run the application pool of that particular IIS virtual directory is currently set to NT authority\Network Service.
You can check carefully, by looking closely of what is the actual application pool that run that particular IIS virtual directory.
From there, you can go to the "Application Pool" folder and right click, choose Properties. Select the "Identity" tab, and it will show you who is the user account that currently running the application pool.
Alternatively, you can refer to the SharePoint SDK, something similar to ExtractCrmAuthenticationToken in dynamics CRM to extract the Authentication Token ticket.
Or alternatively you can use Network Credential to embed your own custom user id and password.
Hope this helps,
hadi teo
I fully agree with Hadi, if this is something you want to just quickly test, for a proof of concept, you can change the credentials under what the Application pool runs, to a user that has permissions. Or you could use Identity Impersonate setting in your config file.
However resist the temptiation to do this in a production enviroment, use the proper authentication. It will come back, to bite you.
If you need to set this up for production, there is a couple of areas that you want to look at, duplicate SPN's, and deligation probably the most common areas that is not configured correctly. Your error however points to impersanation not happening.
Also make sure you are deploying the web service to its own web site that does not already run SharePoint. If you want the web service to run on the same web site as SharePoint read Creating a Custom Web Service.
You can check what application pool identity SharePoint is using by following the same instructions that Hadi writes, but for an app pool running SharePoint. Make sure to only change the application pool used by your web service and not SharePoint or else other permission errors could occur within SP. (There should be no reason but if you are interested in changing the app pool identity used by SharePoint follow these instructions.)
On solution would be to "impersonate" as the SharePoint System account using the following code:
SPSecurity.RunWithElevatedPrivileges(delegate()
{
// also dispose SPSite
using (SPSite siteCollection = new SPSite("http://localhost:89"))
{
using (SPWeb web = siteCollection.OpenWeb())
{
// ...
}
}
});