Authentication failing with Worklight-Liberty profile configured to LDAP (SSO)

Question

When I try to login from WL hybird application in the emulator I get the below exceptions.

Environment:

1) Worklight Server (505 version) installed using the default Liberty profile and Derby database.
2) Userregistry is configured to LDAP. LDAP is up and running.
3) I have followed "Module 20.1 Form-based Authentication"

Server.xml is correctly configured :

   ldapRegistry id="IBMDirectoryServerLDAP" realm="defaultWIMFileBasedRealm"
        host="testserver.com" port="4389" ignoreCase="true"
        baseDN="dc=ibm,dc=com"
        bindDN="cn=xyz"
        bindPassword="xyz123"
        ldapType="IBM Tivoli Directory Server" reuseConnection="true"
        idsFilters
            userFilter="(&amp;(uid=%v)(objectclass=ePerson))"
            groupFilter="(&amp;(cn=%v)(|(objectclass=groupOfNames)(objectclass=groupOfUniqueNames)(objectclass=groupOfURLs)))"
            userIdMap="*:uid"
            groupIdMap="*:cn"
            groupMemberIdMap="ibm-allGroups:member;ibm-allGroups:uniqueMember;groupOfNames:member;groupOfUniqueNames:uniqueMember"
    ldapRegistry

Login module is : com.worklight.core.auth.ext.WebSphereLoginModule
Authenticator is : com.worklight.core.auth.ext.WebSphereFormBasedAuthenticator

Exception:

[RandomNumberGenerationServlet]: Initialization successful.
[2/13/13 15:37:21:349 IST] 00000049 com.worklight.core.auth.ext.WebSphereFormBasedAuthenticator  I FWLSE0055I: Not recognized.
[2/13/13 15:38:27:288 IST] 0000004b ication.internal.jaas.modules.UsernameAndPasswordLoginModule A CWWKS1100A: Authentication did not succeed for user ID wpsbind. An invalid user ID or password was specified.
[2/13/13 15:38:27:742 IST] 0000004f com.worklight.core.auth.ext.WebSphereFormBasedAuthenticator  I FWLSE0055I: Not recognized.
[2/13/13 15:38:27:746 IST] 0000004f com.worklight.core.auth.ext.WebSphereFormBasedAuthenticator  I FWLSE0055I: Not recognized.
[2/13/13 15:38:27:747 IST] 0000004f com.worklight.core.auth.impl.AuthenticationFilter            E FWLSE0048E: Unhandled exception caught: realm WASLTPARealm is not allowed to ignore request to a protected resouce in a non-success state
java.lang.IllegalStateException: realm WASLTPARealm is not allowed to ignore request to a protected resouce in a non-success state
    at com.worklight.core.auth.impl.AuthenticationContext.checkAuthentication(AuthenticationContext.java:515)
    at com.worklight.core.auth.impl.AuthenticationContext.processRealms(AuthenticationContext.java:396)
    at com.worklight.core.auth.impl.AuthenticationContext.pushCurrentResource(AuthenticationContext.java:373)
    at com.worklight.core.auth.impl.AuthenticationServiceBean.accessResource(AuthenticationServiceBean.java:63)
    at com.worklight.core.auth.impl.AuthenticationFilter.doFilter(AuthenticationFilter.java:162)
    at com.ibm.ws.webcontainer.filter.FilterInstanceWrapper.doFilter(FilterInstanceWrapper.java:188)
    at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:85)
    at com.ibm.ws.webcontainer.filter.WebAppFilterManager.doFilter(WebAppFilterManager.java:940)
    at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:1037)
    at com.ibm.ws.webcontainer.servlet.CacheServletWrapper.handleRequest(CacheServletWrapper.java:81)
    at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:930)
    at com.ibm.ws.webcontainer.osgi.DynamicVirtualHost$2.run(DynamicVirtualHost.java:274)
    at com.ibm.ws.http.dispatcher.internal.channel.HttpDispatcherLink$TaskWrapper.run(HttpDispatcherLink.java:529)
    at com.ibm.ws.threading.internal.Worker.executeWork(Worker.java:398)
    at com.ibm.ws.threading.internal.Worker.run(Worker.java:380)

Idan Adar Idan Adar · Accepted Answer · 2013-02-13T11:49:08

The authentication takes place in Liberty, and in order for Worklight to recognize the logged-in user, it needs to know of it.

Form-based authentication will not help here. What you can and should do is implement a Custom-based Authenticator that will retrieve from the response from Liberty the custom HTTP header containing the user information.

You can read more about Custom-based Authentication in the following Getting Started training module, to first familiarize yourself with the concept: ftp://public.dhe.ibm.com/software/mobile-solutions/worklight/docs/v505/Module_23_-_Custom_Authenticator_and_Login_Module.pdf

For a clearer "image" of the authentication flow, you can see the diagram as depicted here: http://pic.dhe.ibm.com/infocenter/wrklight/v5r0m5/topic/com.ibm.worklight.help.doc/integ/r_authentication_at_the_gateway.html

Authentication failing with Worklight-Liberty profile configured to LDAP (SSO)

1 Answers