JOSSO

In a multiple security domain setup, with different Event Managers for each domain, Josso does not honour the different event managers

Details

  • Type: Bug Bug
  • Status: Open Open
  • Priority: Major Major
  • Resolution: Unresolved
  • Affects Version/s: JOSSO 1.8.1
  • Fix Version/s: None
  • Component/s: None
  • Description:
    Hide
    In an environment with multiple security domains set up, we want different event handling in each domain. For example;

    "portal" domain - NTLM authentication, no event handling required.
    "application" domain - Bind authentication to AD. Event handling should log access attempts to separate system. Ideally we might want to retrieve additional role information for logins to this system from a non-AD source.

    Both domains have been configured with a different SpringJMXSSOEventManager instance and on the "application" domain we've added an event handler to do our custom processing. However that event handler is never being called, despite being correctly registered on the Event Manager instance for the domain.

    A little bit of additional debugging within the core classes has revealed that the "NotificationPublisher publisher" member variable on the "application" event manager instance appears to be getting set to the event manager from the "portal" domain. As a result when the app event manager fireSSOEvent method is called, it then calls the sendNotification method on the "portal" event manager, and never calls its own handleNotification method.

    The implication seems to be that there should only be one event manager per Josso Gateway - is this correct? We definitely want to have our domains cleanly separated with different handling within each one, so I am curious if this is actually intended behaviour or not.
    Show
    In an environment with multiple security domains set up, we want different event handling in each domain. For example; "portal" domain - NTLM authentication, no event handling required. "application" domain - Bind authentication to AD. Event handling should log access attempts to separate system. Ideally we might want to retrieve additional role information for logins to this system from a non-AD source. Both domains have been configured with a different SpringJMXSSOEventManager instance and on the "application" domain we've added an event handler to do our custom processing. However that event handler is never being called, despite being correctly registered on the Event Manager instance for the domain. A little bit of additional debugging within the core classes has revealed that the "NotificationPublisher publisher" member variable on the "application" event manager instance appears to be getting set to the event manager from the "portal" domain. As a result when the app event manager fireSSOEvent method is called, it then calls the sendNotification method on the "portal" event manager, and never calls its own handleNotification method. The implication seems to be that there should only be one event manager per Josso Gateway - is this correct? We definitely want to have our domains cleanly separated with different handling within each one, so I am curious if this is actually intended behaviour or not.
  • Environment:
    Tomcat 6.0.20, both on Windows XP (dev) and Ubuntu kernel 2.6.26 (test)

Activity

Hide
Tom Taylor added a comment - 12/May/10 2:39 AM
Figured out that this can be resolved by configuring specific event managers as notification listeners in the JMX config for the exporter (MBeanExporter) bean. With a bit of fiddling, this has resolved the issue from our side.
Show
Tom Taylor added a comment - 12/May/10 2:39 AM Figured out that this can be resolved by configuring specific event managers as notification listeners in the JMX config for the exporter (MBeanExporter) bean. With a bit of fiddling, this has resolved the issue from our side.

People

Dates

  • Created:
    16/Apr/10 11:46 AM
    Updated:
    22/Oct/10 3:04 PM