Vertx Form Login Handler with Postgresql Failure - postgresql

I am trying to authenticate user using FormLoginHandler and Postgresql Database with SqlAuthentication.
But I get the following error:
Jun 15, 2022 1:14:34 PM io.vertx.ext.web.RoutingContext
SEVERE: Unhandled exception in router
io.vertx.ext.web.handler.HttpException: Unauthorized
Caused by: io.vertx.core.impl.NoStackTraceThrowable: Invalid username/password
I am providing the right credentials.
The code snippet is:
SqlAuthenticationOptions sauthopts = new SqlAuthenticationOptions();
sauthopts.setAuthenticationQuery(AUTHENTICATE_QUERY);
SqlAuthentication authenticationProvider = SqlAuthentication.create(sqlClient, sauthopts);
router.route("/secure/*").handler(RedirectAuthHandler.create(authenticationProvider, "/login.html"));
FormLoginHandler formLoginHandler = FormLoginHandler.create(authenticationProvider);
router.route("/loginhandler").handler(formLoginHandler);
Please let me know if I am missing something here; or point me to a sample example.
Thanks in Advance.

Your setup doesn't show anything abnormal at first sight. For security reasons, we cannot "just" log the authentication data, as it would be a critical OWASP bug and security vulnerability.
My best guess is that probably is something not totally correct with the query, so this means you have now 2 options:
debug the application and see the query that is being sent + the arguments
prepare a small complete example that shows the bug and open an issue in vert.x so we can debug it further.
If you're upgrading from an older version, be aware that in vert.x 4.2.0 some changes were made to the base64 encoding to keep it consistent across modules. This could be a reason why authentication could fail as the encoded hashes may be slightly different. If you're just doing 4.3.0 from the start, then this would not be a problem.

Related

Jenkins CORS Filter plugin not adding Access-Control-Allow-Origins header

I am trying to add CORS support to my Jenkins server so I could access the REST API from the browser. From looking around, the recommended approach is to use the CORS Filter plugin.
I have installed it, enable it, and add http://localhost to the Access-Control-Allow-Origins field, as well as GET to Access-Control-Allow-Methods field. However, these headers are not showing up in my requests.
This plugin has not been updated in a few years, so I'm not sure if it's compatible with the latest version of Jenkins. I'm running version 2.172.
In the Jenkins system log, I see these errors, not sure if it's related/ relevant
Caught exception evaluating: descriptor.getPropertyType(instance,field).itemTypeDescriptorOrDie in /configure. Reason: java.lang.reflect.InvocationTargetException
java.lang.AssertionError: class hudson.ivy.IvyBuildTrigger$IvyConfiguration is missing its descriptor in public hudson.ivy.IvyBuildTrigger$IvyConfiguration[] hudson.ivy.IvyBuildTrigger$DescriptorImpl.getConfigurations(). See https://jenkins.io/redirect/developer/class-is-missing-descriptor
Caught exception evaluating: h.filterDescriptors(it,attrs.descriptors) in /configure. Reason: java.lang.NullPointerException: Descriptor list is null for context 'class hudson.model.Hudson' in thread 'Handling GET /configure from 100.71.26.18 : qtp589873731-14 Jenkins/configure.jelly GlobalLibraries/config.jelly LibraryConfiguration/config.jelly SCMRetriever/DescriptorImpl/config.jelly MultiSCM/DescriptorImpl/config.jelly'
java.lang.NullPointerException: Descriptor list is null for context 'class hudson.model.Hudson' in thread 'Handling GET /configure from 100.71.26.18 : qtp589873731-14 Jenkins/configure.jelly GlobalLibraries/config.jelly LibraryConfiguration/config.jelly SCMRetriever/DescriptorImpl/config.jelly MultiSCM/DescriptorImpl/config.jelly'
These errors have at org.jenkinsci.plugins.corsfilter.AccessControlsFilter.doFilter(AccessControlsFilter.java:79) in their stack trace.
Does anyone know of a good way to enable CORS support for Jenkins REST API?
Jenkins version 2.303 and I struggle with the same issue. I would recommend to add the port number on the localhost URI you defined in the plugin settings, even though I'm pretty sure that won't change anything.
It actually seems the plugin is having no effect at all.
Probably the best solution is to set up your own proxy which would take care of CORS. Here is a good and well document example Build a Node.js Proxy Server in Under 10 minutes!

WSO2IS NullPointerException when using step authenticator

Occasionally (?) the WSO2 IS user is unable to authenticate with following exception. When retrying, the user will be authenticated. Any ideas what could be reason / resolution? We set up the session caching.
Using WSO2 Identity Server 5.0.0.SP1 / SAML authentication with the authenticator set to advanced (single step, multiple options). I cannot find the correct source code commit to check out (to match the line number in the exception)
Thank you all in advance
Gabriel
TID: [0] [IS] [2016-02-15 13:07:22,914] ERROR
{org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator}
- Exception in Authentication Framework {org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator}
java.lang.NullPointerException at
org.wso2.carbon.identity.application.authentication.framework.handler.sequence.impl.DefaultStepBasedSequenceHandler.handle(DefaultStepBasedSequenceHandler.java:83)
at
org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultAuthenticationRequestHandler.handle(DefaultAuthenticationRequestHandler.java:121)
at
org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator.handle(DefaultRequestCoordinator.java:94)
at
org.wso2.carbon.identity.application.authentication.framework.servlet.CommonAuthenticationServlet.doPost(CommonAuthenticationServlet.java:54)
at
org.wso2.carbon.identity.application.authentication.framework.servlet.CommonAuthenticationServlet.doGet(CommonAuthenticationServlet.java:44)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:735) at
javax.servlet.http.HttpServlet.service(HttpServlet.java:848)
Edit:
This exception occurs on the WSO2 IS 5.1.0 too
see the Source code line 105
StepConfig stepConfig = context.getSequenceConfig().getStepMap().get(currentStep);
// if the current step is completed
if (stepConfig.isCompleted()) {
stepConfig.setCompleted(false);
ERROR org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator} - Exception in Authentication Framework
java.lang.NullPointerException
at org.wso2.carbon.identity.application.authentication.framework.handler.sequence.impl.DefaultStepBasedSequenceHandler.handle(DefaultStepBasedSequenceHandler.java:105)
at org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultAuthenticationRequestHandler.handle(DefaultAuthenticationRequestHandler.java:115)
it looks like the stepConfig 'dissapeared' from the authentication config. The setup is done on a single node with session persistence into a database.
Apparently it looks like a problem with concurrency.
When multiple concurrent requests are sent to the SSO endpoint while the user is already authenticated, all threads are attempting to process the request modifying the same authentication context object (currentStep counter) so the cached authentication context comes to an invalid state.
Valid use case is that the client should send only a single request to the SSO endpoint, so the team dealing with the UI have to fix it. But - that's only the a quick fix not preventing the issue in long term. We have to really pick it up with WSO2 (and fix the code ourselves maybe) :)
g.

Atmosphere Jersey - Server messages

Is it possible to let the server send messages to all connected clients without waiting for any action from them? Let me explain it :-) I've been reading the docs/examples and I have found nothing that satifies my needs: the flow is always the same; a client connects (e.g: a GET call to a Rest API), the connection is suspendend and until a new API call is received (e.g.: a POST call) the server simply waits (or at least this is what I have understood). My use case is pretty different: I want the server to send some "notifications" once new data become available. This would be my use case (pretty simplifed):
Client A connects to server
Connection is suspended since no new data is available at the moment
The server gets notified new data is available from an external
source and broadcasts it to client A
Go to step 2
What I have achieved so far is getting the connection successfully established. The next step is to solve this server issue. I must say this technology is completely new to me so it is possible I misunderstood how something works. If that's the case, let me know!
This is my stack:
Spring 3.2.0 RELEASE
Jersey 1.8
Atmosphere Jersey 1.0.13
Tomcat 7.0.40
Thank you all in advance!
UPDATE: After following this I get this warning, which I have no idea how to get rid of:
2013-06-04 09:40:36,284 WARN [org.atmosphere.cpr.AtmosphereFramework] - Failed using comet support: org.atmosphere.container.Tomcat7AsyncSupportWithWebSocket, error: Tomcat failed to detect this is a Comet application because context.xml is missing or the Http11NioProtocol Connector is not enabled.
If that's not the case, you can also remove META-INF/context.xml and WEB-INF/lib/atmosphere-compat-tomcat.jar Is the Nio or Apr Connector enabled?
2013-06-04 09:40:36,285 WARN [org.atmosphere.cpr.AtmosphereFramework] - Using org.atmosphere.container.Tomcat7BIOSupportWithWebSocket
I followed the app structure commented here, so this should not be a problem. I have noticed that by changing the transport to "websocket" instead of "long-polling" shows no errors. The server finally sends data tough :)
I followed your link and modified the code a little.
When you are in the step 3 "The server gets notified new data is available from an external source and broadcasts it to client A", you have to write a line like this:
BroadcasterFactory.getDefault().lookup("/*").broadcast(response);
At first I used the TextMessage received from my ActiveMQ Queue but I get this error, so I used a Jackson class as an object response and everything worked fine.
SEVERE: A message body writer for Java class org.apache.activemq.command.ActiveMQTextMessage, and Java type class org.apache.activemq.command.ActiveMQTextMessage, and MIME media type application/json was not found
jun 03, 2014 11:32:21 AM com.sun.jersey.spi.container.ContainerResponse write
SEVERE: The registered message body writers compatible with the MIME media type are:
application/json (JSONJAXBElementProvider, JSONArrayProvider, JSONObjectProvider, JSONRootElementProvider, JSONListElementProvider, ...)

Error when running a bpel process in ode

I'm trying to learn to work with bpel. I choose Eclipse Bpel Designer and apache ode (on a tomcat server) in order to experiment. The process I tried to model was a loan process. It has 3 services: a creditRate service (written in eclipse bpel designer and deployed befo-hand an tested that it works), a currency converter service, and the main orchestration process. While I had no errors on deployment when testing the web service from eclipse following errors occur:
ERROR [ExternalService] Error sending message to Axis2 for ODE mex
{PartnerRoleMex#hqejbhcnphr87mcnd0np43 [PID
{CreditBuletinNamespace}CreditBuletin-137] calling
org.apache.ode.bpel.epr.WSAEndpoint#a64453.getRating(...) Status
REQUEST} org.apache.ode.axis2.OdeFault: Binding operation not found:
service {http://www.webserviceX.NET/}CurrencyConvertor port
CurrencyConvertorSoap name getRating. at
org.apache.ode.axis2.util.SoapMessageConverter.createSoapRequest(SoapMessageConverter.java:154)
and
Failure during invoke: Error sending message to Axis2 for ODE mex
{PartnerRoleMex#hqejbhcnphr87mcnd0np43 [PID
{CreditBuletinNamespace}CreditBuletin-137] calling
org.apache.ode.bpel.epr.WSAEndpoint#a64453.getRating(...) Status
REQUEST} 21:09:14,421 INFO [BpelRuntimeContextImpl] ActivityRecovery:
Registering activity 19, failure reason: Error sending message to
Axis2 for ODE mex {PartnerRoleMex#hqejbhcnphr87mcnd0np43 [PID
{CreditBuletinNamespace}CreditBuletin-137] calling
org.apache.ode.bpel.epr.WSAEndpoint#a64453.getRating(...) Status
REQUEST} on channel 33
Can someone help me out with a solution? I have searched for some solution but have not found one that works. It may be that due to my poor knowledge I am not searching right or not doing something right. Because this description may be confusing I have attached my solution because I believe they will tell more of what I'm trying to do and how wrong I am doing it. http://www.mediafire.com/?9bjgt44spln1zwr
Thank-you in advance
EDIT: after doing an iterative approach (as sugested in the first answer) it seems that the external conversion service was not responding from ode. This is strange because the service worked from the browser and no error was reported when deplying. Again because of my poor knowledge I believe code speaks better than my phrasing. I have made an eclipse project just with the external currency convertor. Any help / guidance is heartly appreciated. Thank you in advance. http://www.mediafire.com/?56csca1qgt5ka9a
Your CreditRating process works fine, the error lies in the CreditBuletin process. When I test this one with soapUI, I get a selectionFailure. This error in BPEL tells you that something is wrong with a from or to in your process.
To outline the problem here is a very simplified version of the activities of your CreditBuletin process, reduced to just the initial receive, the final reply and one of your assign activities inbetween. You can paste this into the main sequence of your process to reproduce the problem.
<bpel:receive name="receiveInput" partnerLink="clientInput" operation="getLoan" portType="tns:CreditBuletinPT" variable="receiveInput" createInstance="yes"></bpel:receive>
<bpel:assign validate="no" name="AssignFinal">
<bpel:copy>
<bpel:from>
<bpel:literal>
<tns:SumaRON xmlns:tns="CreditBuletinNamespace" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<output>0</output>
</tns:SumaRON>
</bpel:literal>
</bpel:from>
<bpel:to variable="outputResult" part="parameters"></bpel:to>
</bpel:copy>
<bpel:copy>
<bpel:from>
<![CDATA[$loanWithInterest * bpel:getVariableData('CurrencyRateInputResponse','parameters','ConversionRateResult')]]>
</bpel:from>
<bpel:to part="parameters" variable="outputResult">
<bpel:query queryLanguage="urn:oasis:names:tc:wsbpel:2.0:sublang:xpath1.0">
<![CDATA[output]]>
</bpel:query>
</bpel:to>
</bpel:copy>
</bpel:assign>
<bpel:reply name="outputResult" partnerLink="clientInput" operation="getLoan" portType="tns:CreditBuletinPT" variable="outputResult"></bpel:reply>
You are trying to assign the same variable twice, first with a default initialization. This doesn't make much sense, but for some reason the BPEL editor generates these initializations on default. You get a correct reply, if you change the from statement in the second copy to something else, for instance
<![CDATA[bpel:getVariableData('receiveInput','parameters','suma')]]>
So, your problem(s) come(s) from your from statements, most likely the ones that use the getVariableData() function. Now, I don't want to repair all expressions in your process (because there are many and that is your task), but I suggest to have a look at all of them. Start with a minimal working process, such as the one above with the from exchanged and do incremental updates of functionality while testing each increment. That way, you will eventually end up with something that works.

Wicket warning allow_url_include=On

From time to time I get the following warning in the logfile of my Wicket application:
04.10.2012 14:52:08,525 WARN [org.apache.wicket.core.request.mapper.AbstractBookmarkableMapper]
Unknown listener interface 'd allow_url_include=On '
What does that mean and how do I fix it? I tried Google, but I could only find results for the PHP configuration allow_url_include.
I'm using Wicket 6.0.0
Most likely an automated tool tries to exploit some PHP application. Wicket can't handle this request and prints the warning. Look in the access log what HTTP requests hit your server at this timestamp to see which request caused this warning.
It's safe to ignore this warning in this case.