openidentityplatform / openam-jee-agents

OpenAM Java EE Policy Agents is an OpenAM add-on component that functions as a Policy Enforcement Point (PEP) for applications deployed on a Java EE-based servlet container or application server. The policy agent protects web-based applications and implements single sign-on (SSO) capabilities for the applications deployed in the container.

OpenAM Java EE Policy Agents

OpenAM Java EE Policy Agents is an OpenAM add-on component that functions as a Policy Enforcement Point (PEP) for applications deployed on a Java EE-based servlet container or application server. The policy agent protects web-based applications and implements single sign-on (SSO) capabilities for the applications deployed in the container.

License

This project is licensed under the Common Development and Distribution License (CDDL).

Downloads

• OpenAM Java Policy Agent (Tomcat v6-v9 ZIP) (All OS)
• OpenAM Java Policy Agent (Jetty v61 ZIP) (All OS)
• OpenAM Java Policy Agent (Jetty v7-v8 ZIP) (All OS)
• OpenAM Java Policy Agent (Appserver v10 ZIP) (All OS)
• OpenAM Java Policy Agent (JBoss v42 ZIP) (All OS)
• OpenAM Java Policy Agent (JBoss v7 ZIP) (All OS)
• OpenAM Java Policy Agent (JSR196 ZIP) (All OS)
• Docker:
  • OpenAM Java Policy Agent on Tomcat:
    • openidentityplatform/openam-j2ee-agent-tomcat:tomcat
    • openidentityplatform/openam-j2ee-agent-tomcat:tomee-8-jre-7.1.0-plus

Java 1.8+ required

How-to build

git clone https://github.com/OpenIdentityPlatform/OpenAM-JEE-Agents.git
mvn clean install -f OpenAM-JEE-Agents

Support and Mailing List Information

• OpenAM Java Policy Agent Community Wiki: https://github.com/OpenIdentityPlatform/OpenAM-JEE-Agents/wiki
• OpenAM Java Policy Agent Community Discussions: https://github.com/OpenIdentityPlatform/OpenAM-JEE-Agents/discussions
• OpenAM Java Policy Agent Community Issues: https://github.com/OpenIdentityPlatform/OpenAM-JEE-Agents/issues
• OpenAM Java Policy Agent Commercial support RFP: [email protected] (English, Russian)

Contributing

Please, make Pull request

Thanks for OpenAM Java Policy Agent 🥰

• Sun Access Manager
• Sun OpenSSO
• Oracle OpenSSO
• Forgerock OpenAM

openam-jee-agents's Issues

Missing com.sun.identity.install.tools.launch.AdminToolLauncher

I tried running agentadmin --install and the I received the following error:

apache-tomee-plus: agentapp is missing openam-rest and it's dependencies

11-Mar-2019 10:03:19.572 SEVERE [localhost-startStop-1] sun.reflect.NativeMethodAccessorImpl.invoke ContainerBase.addChild: start:
org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Catalina].StandardHost[localhost].StandardContext[/agentapp]]
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:167)
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:754)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:730)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:734)
at org.apache.catalina.startup.HostConfig.deployWAR(HostConfig.java:985)
at org.apache.catalina.startup.HostConfig$DeployWar.run(HostConfig.java:1857)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.lang.NoClassDefFoundError: com/sun/identity/rest/ResourceBase
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClass(ClassLoader.java:763)
at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142)
at java.net.URLClassLoader.defineClass(URLClassLoader.java:468)
at java.net.URLClassLoader.access$100(URLClassLoader.java:74)
at java.net.URLClassLoader$1.run(URLClassLoader.java:369)
at java.net.URLClassLoader$1.run(URLClassLoader.java:363)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:362)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at java.lang.ClassLoader.loadClass(ClassLoader.java:411)
at java.lang.ClassLoader.loadClass(ClassLoader.java:411)
at org.apache.openejb.core.TempClassLoader.loadClass(TempClassLoader.java:225)
at org.apache.openejb.core.TempClassLoader.loadClass(TempClassLoader.java:83)
at org.apache.xbean.finder.archive.JarArchive.loadClass(JarArchive.java:89)
at org.apache.xbean.finder.archive.CompositeArchive.loadClass(CompositeArchive.java:58)
at org.apache.xbean.finder.archive.FilteredArchive.loadClass(FilteredArchive.java:45)
at org.apache.xbean.finder.archive.CompositeArchive.loadClass(CompositeArchive.java:58)
at org.apache.openejb.config.WebappAggregatedArchive.loadClass(WebappAggregatedArchive.java:128)
at org.apache.xbean.finder.AnnotationFinder$ClassInfo.get(AnnotationFinder.java:1486)
at org.apache.xbean.finder.AnnotationFinder.findMetaAnnotatedClasses(AnnotationFinder.java:582)
at org.apache.xbean.finder.AnnotationFinder.findMetaAnnotatedClasses(AnnotationFinder.java:531)
at org.apache.openejb.config.AnnotationDeployer.findRestClasses(AnnotationDeployer.java:5712)
at org.apache.openejb.config.AnnotationDeployer$DiscoverAnnotatedBeans.deploy(AnnotationDeployer.java:1157)
at org.apache.openejb.config.AnnotationDeployer$DiscoverAnnotatedBeans.deploy(AnnotationDeployer.java:492)
at org.apache.openejb.config.AnnotationDeployer.deploy(AnnotationDeployer.java:380)
at org.apache.openejb.config.ConfigurationFactory$Chain.deploy(ConfigurationFactory.java:420)
at org.apache.openejb.config.ConfigurationFactory.configureApplication(ConfigurationFactory.java:1037)
at org.apache.tomee.catalina.TomcatWebAppBuilder.startInternal(TomcatWebAppBuilder.java:1281)
at org.apache.tomee.catalina.TomcatWebAppBuilder.configureStart(TomcatWebAppBuilder.java:1125)
at org.apache.tomee.catalina.GlobalListenerSupport.lifecycleEvent(GlobalListenerSupport.java:133)
at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:94)
at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5154)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
... 10 more
Caused by: java.lang.ClassNotFoundException: com.sun.identity.rest.ResourceBase
at java.net.URLClassLoader.findClass(URLClassLoader.java:382)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
... 44 more

11-Mar-2019 10:03:19.576 SEVERE [localhost-startStop-1] sun.reflect.NativeMethodAccessorImpl.invoke Error deploying web application archive [/usr/java/apache-tomee-plus/webapps/agentapp.war]
java.lang.IllegalStateException: ContainerBase.addChild: start: org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Catalina].StandardHost[localhost].StandardContext[/agentapp]]
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:758)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:730)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:734)
at org.apache.catalina.startup.HostConfig.deployWAR(HostConfig.java:985)
at org.apache.catalina.startup.HostConfig$DeployWar.run(HostConfig.java:1857)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)

Installer for tomcat agent 4.0.4 is not working

It is not possible to run installer for tomcat agent 4.0.4 in following docker container forgerock/tomcat:9-jdk11.

Is tomcat 9 supported?

`[08/30/2021 08:26:20:062 BST] TomcatVersionValidator.getTomcatVersion() - validating ServerInfo:Server version: Apache Tomcat/9.0.41
Server built: Dec 3 2020 11:43:00 UTC
Server number: 9.0.41.0
OS Name: Linux
OS Version: 3.10.0-1160.el7.x86_64
Architecture: amd64
JVM Version: 1.8.0_152-b16
JVM Vendor: Azul Systems, Inc.

[08/30/2021 08:26:20:062 BST] TomcatVersionValidator.getTomcatVersion() - version:9.0.41.0 found version: null
[08/30/2021 08:26:20:062 BST] OpenAM Tomcat Agent does not support this tomcat server version
[08/30/2021 08:26:20:062 BST] Interaction failed to continue since one or more of the validators failed.
[08/30/2021 08:26:20:062 BST] InstallHandler: Failed to process install request
[ProductInstallException Stack]
com.sun.identity.install.tools.configurator.InstallException: Invalid directory specified for the $CATALINA_HOME environment variable
at com.sun.identity.install.tools.configurator.UserDataInteraction.interactSilent(UserDataInteraction.java:114)
at com.sun.identity.install.tools.configurator.InteractionsRunnerBase.runInteraction(InteractionsRunnerBase.java:157)
at com.sun.identity.install.tools.configurator.InteractionsRunnerBase.runInteractions(InteractionsRunnerBase.java:96)
at com.sun.identity.install.tools.configurator.Driver.executeInstanceInteractions(Driver.java:132)
at com.sun.identity.install.tools.configurator.Driver.executeAllInteractions(Driver.java:76)
at com.sun.identity.install.tools.configurator.InstallDriver.install(InstallDriver.java:82)
at com.sun.identity.install.tools.handler.InstallHandler.handleRequest(InstallHandler.java:75)
at com.sun.identity.install.tools.admin.AdminTool.dispatch(AdminTool.java:232)
at com.sun.identity.install.tools.admin.AdminTool.run(AdminTool.java:135)
at com.sun.identity.install.tools.launch.AdminToolLauncher.launchAdminTool(AdminToolLauncher.java:201)
at com.sun.identity.install.tools.launch.AdminToolLauncher.main(AdminToolLauncher.java:295)
[08/30/2021 08:26:20:064 BST] Exiting with code: 0
`

Doesn't build anymore?

I tried compiling those today and the build fails at the geo step in forgerock-commons. It's probably necessary to update the submodules?

Error while activating Tomcat agent

Hi, we just tested the latest build and we get the following error while triggering an auth:

20-Sep-2023 12:48:56.360 SEVERE [main] org.apache.tomcat.util.digester.Digester.startElement Begin event threw exception
java.lang.NoClassDefFoundError: org/forgerock/openam/session/service/access/SessionPersistenceObservable
at java.base/java.lang.ClassLoader.defineClass1(Native Method)
at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:1022)
at java.base/java.security.SecureClassLoader.defineClass(SecureClassLoader.java:174)
at java.base/java.net.URLClassLoader.defineClass(URLClassLoader.java:555)
at java.base/java.net.URLClassLoader$1.run(URLClassLoader.java:458)
at java.base/java.net.URLClassLoader$1.run(URLClassLoader.java:452)
at java.base/java.security.AccessController.doPrivileged(Native Method)
at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:451)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:594)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:527)
at org.forgerock.openam.session.SessionCuller.willExpire(SessionCuller.java:122)
at org.forgerock.openam.session.SessionCuller.scheduleToTimerPool(SessionCuller.java:102)
at org.forgerock.openam.session.SessionCuller.(SessionCuller.java:65)
at org.forgerock.openam.session.SessionCache.writeSession(SessionCache.java:132)
at org.forgerock.openam.session.SessionCache.getSession(SessionCache.java:269)
at com.iplanet.sso.providers.dpro.SSOProviderImpl.createSSOToken(SSOProviderImpl.java:206)
at com.iplanet.sso.providers.dpro.SSOProviderImpl.createSSOToken(SSOProviderImpl.java:185)
at com.sun.identity.authentication.AuthContext.getSSOToken(AuthContext.java:1482)
at com.sun.identity.agents.common.ApplicationSSOTokenProvider.getApplicationSSOToken(ApplicationSSOTokenProvider.java:75)
at com.sun.identity.agents.arch.AgentConfiguration.setAppSSOToken(AgentConfiguration.java:619)
at com.sun.identity.agents.arch.AgentConfiguration.bootStrapClientConfiguration(AgentConfiguration.java:725)
at com.sun.identity.agents.arch.AgentConfiguration.initializeConfiguration(AgentConfiguration.java:1147)
at com.sun.identity.agents.arch.AgentConfiguration.(AgentConfiguration.java:1586)
at com.sun.identity.agents.arch.Manager.(Manager.java:675)
at com.sun.identity.agents.tomcat.v6.AmTomcatRealm.(AmTomcatRealm.java:67)

tomcat v6 v7 v8 agent includes services that cause class loading issues with apache-tomee-plus 1.7.2

agent's contextLoader is registered before official one present in jaxb-impl.jar and we got a NoClassDefFoundError (see tomee log, below). Removing META-INF/services/javax.xml.bind.JAXBContext (that is already provided by tomee) and META-INF/services/javax.management.remote.JMXConnectorProvider and another solves the issue.

Shall we have a openssoclientsdk.jar specific for tomee without the above shaded resources?

Apr 15, 2019 9:46:09 AM org.apache.openejb.config.ConfigurationFactory configureApplication
INFO: Configuring enterprise application: /usr/share/tomee/webapps/portal
java.lang.NoClassDefFoundError: org/forgerock/openam/sdk/javax/activation/DataSource
        at org.forgerock.openam.sdk.com.sun.xml.bind.v2.model.impl.RuntimeBuiltinLeafInfoImpl.<clinit>(RuntimeBuiltinLeafInfoImpl.java:474)
        at org.forgerock.openam.sdk.com.sun.xml.bind.v2.model.impl.RuntimeTypeInfoSetImpl.<init>(RuntimeTypeInfoSetImpl.java:63)
        at org.forgerock.openam.sdk.com.sun.xml.bind.v2.model.impl.RuntimeModelBuilder.createTypeInfoSet(RuntimeModelBuilder.java:128)
        at org.forgerock.openam.sdk.com.sun.xml.bind.v2.model.impl.RuntimeModelBuilder.createTypeInfoSet(RuntimeModelBuilder.java:84)
        at org.forgerock.openam.sdk.com.sun.xml.bind.v2.model.impl.ModelBuilder.<init>(ModelBuilder.java:162)
        at org.forgerock.openam.sdk.com.sun.xml.bind.v2.model.impl.RuntimeModelBuilder.<init>(RuntimeModelBuilder.java:92)
        at org.forgerock.openam.sdk.com.sun.xml.bind.v2.runtime.JAXBContextImpl.getTypeInfoSet(JAXBContextImpl.java:455)
        at org.forgerock.openam.sdk.com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:303)
        at org.forgerock.openam.sdk.com.sun.xml.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:139)
        at org.forgerock.openam.sdk.com.sun.xml.bind.v2.runtime.JAXBContextImpl$JAXBContextBuilder.build(JAXBContextImpl.java:1156)
        at org.forgerock.openam.sdk.com.sun.xml.bind.v2.ContextFactory.createContext(ContextFactory.java:165)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:247)
        at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:234)
        at javax.xml.bind.ContextFinder.find(ContextFinder.java:441)
        at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:641)
        at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:584)
        at ***************************.Navigation.load(Navigation.java:85)
        at ***************************.AdminRS.<clinit>(AdminRS.java:116)
        at java.lang.Class.forName0(Native Method)
        at java.lang.Class.forName(Class.java:348)
        at org.apache.openejb.util.Classes.forName(Classes.java:64)
        at org.apache.openejb.config.rules.ValidationBase.loadClass(ValidationBase.java:151)
        at org.apache.openejb.config.rules.CheckMethods.check_unusedCreateMethods(CheckMethods.java:318)
        at org.apache.openejb.config.rules.CheckMethods.validate(CheckMethods.java:55)
        at org.apache.openejb.config.rules.ValidationBase.validate(ValidationBase.java:50)
        at org.apache.openejb.config.AppValidator.validate(AppValidator.java:101)
        at org.apache.openejb.config.ValidateModules.deploy(ValidateModules.java:38)
        at org.apache.openejb.config.ConfigurationFactory$Chain.deploy(ConfigurationFactory.java:403)
        at org.apache.openejb.config.ConfigurationFactory.configureApplication(ConfigurationFactory.java:971)
        at org.apache.tomee.catalina.TomcatWebAppBuilder.startInternal(TomcatWebAppBuilder.java:1227)
        at org.apache.tomee.catalina.TomcatWebAppBuilder.configureStart(TomcatWebAppBuilder.java:1100)
        at org.apache.tomee.catalina.GlobalListenerSupport.lifecycleEvent(GlobalListenerSupport.java:130)
        at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117)
        at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:90)
        at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5416)
        at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
        at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:901)
        at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:877)
        at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
        at org.apache.catalina.startup.HostConfig.deployWAR(HostConfig.java:1095)
        at org.apache.catalina.startup.HostConfig$DeployWar.run(HostConfig.java:1930)
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: java.lang.ClassNotFoundException: org.forgerock.openam.sdk.javax.activation.DataSource
        at org.apache.openejb.core.TempClassLoader.loadClass(TempClassLoader.java:176)
        at org.apache.openejb.core.TempClassLoader.loadClass(TempClassLoader.java:80)
        ... 50 more

Wildfly Compatibility

Could you consider adding support for one or more of the later versions of the Wildfly application server?

Wildfly 26.x which is Jakarta EE 8 compliant.
Wildfly 31.x which is Jakarta EE10 compliant.

A Wildfly 31.x compatible version of the JEE policy agent would lend itself to also having a JBoss EAP v8 compatible version, given that JBoss is built on Wildfly.

Thanks and much appreciated.

Tomcat agent setup does not modify web.xml

Hi,
when configuring a new agent on a Tomcat instance the installer modifies the server.xml and the web.xml files under webapps/, but does not add the filter to the global web.xml config file. I think it used to do that automatically, but honestly have no idea when this behavior changed.
I'll try to take a look at the code and see if there's anything obvious in there.