Error accessing custom login module on j2ee 6.40

[Former Member]

hello.

i am using was j2ee 6.40 & ep 6, both patched to sps 11, and am trying to configure a custom login module for the system... i need help.

i have followed a few of the threads in this forum, which give more detail than the sap guides i have found, but i still cannot access the login module after it has been deployed to the j2ee engine. i get the error 'Cannot load a login module' in the default trace file, and authentication does not succeed.

here are some details on what i did & where the problem occured:

1) i built & compiled a custom login module thru netweaver developer, associating the security api and other jar files needed.

2) packaged it all into an sda file, including the class i wrote & the other associated jar files.

3) deployed the j2ee component to the j2ee engine

4) logged onto visual admin & created a new login module for my class (com.bmc.sap.UIdPSAPsso).

5) added my library (UIdPSAPsso) to the login module class loaders in the security provider.

6) configured the ticket login stack to include my login module.

once the login module is part of the ‘ticket’ component stack, i stop being able to login to the enterprise portal. i go to the portal page, enter a username & password and press “Log On”, and I am returned to the portal sign on page. there is no authentication or other error shown on the portal page.

the specific error i'm seeing in the trc file is:

#1.5#0001027CAC6A00150000000000000CCC0003FFBA72AF74C0#1125601183371#com.sap.engine.services.security#sap.com/irj#com.sap.engine.services.security#j2ee_guest#0#####SAPEngine_Application_Thread[impl:3]_38##0#0#Error#1#/System/Security#Java#security_1020##Cannot load a login module.##

#1.5#0001027CAC6A00150000000100000CCC0003FFBA72AF87C4#1125601183371#com.sap.engine.services.security#sap.com/irj#com.sap.engine.services.security#j2ee_guest#0#####SAPEngine_Application_Thread[impl:3]_38##0#0#Error#1#/System/Audit#Java###Exception #1#com.sap.engine.services.security.exceptions.BaseSecurityException: Cannot load a login module. at com.sap.engine.services.security.login.LoginContextFactory.init(LoginContextFactory.java:95) at com.sap.engine.services.security.login.LoginContextFactory.getLoginContext(LoginContextFactory.java:133) at com.sap.engine.services.security.server.AuthenticationContextImpl.getLoginContext(AuthenticationContextImpl.java:227) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:324) at com.sap.engine.system.SystemLoginModule.initialize(SystemLoginModule.java:72) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:324) at javax.security.auth.login.LoginContext.invoke(LoginContext.java:662) at javax.security.auth.login.LoginContext.access$000(LoginContext.java:129) at javax.security.auth.login.LoginContext$4.run(LoginContext.java:610) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.login.LoginContext.invokeModule(LoginContext.java:607) at javax.security.auth.login.LoginContext.login(LoginContext.java:534) at com.sap.security.core.logon.imp.SAPJ2EEAuthenticator.getLoggedInUser(SAPJ2EEAuthenticator.java:86) at com.sapportals.portal.prt.service.authenticationservice.AuthenticationService.getLoggedInUser(AuthenticationService.java:305) at com.sapportals.portal.prt.connection.UMHandler.handleUM(UMHandler.java:96) at com.sapportals.portal.prt.connection.ServletConnection.handleRequest(ServletConnection.java:178) at com.sapportals.portal.prt.dispatcher.Dispatcher$doService.run(Dispatcher.java:522) at java.security.AccessController.doPrivileged(Native Method) at com.sapportals.portal.prt.dispatcher.Dispatcher.service(Dispatcher.java:405) at javax.servlet.http.HttpServlet.service(HttpServlet.java:853) at com.sap.engine.services.servlets_jsp.server.servlet.InvokerServlet.service(InvokerServlet.java:153) at javax.servlet.http.HttpServlet.service(HttpServlet.java:853) at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:290) at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:346) at com.sap.portal.navigation.Gateway.service(Gateway.java:68) at javax.servlet.http.HttpServlet.service(HttpServlet.java:853) at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:391) at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:265) at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:345) at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:323) at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:865) at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:240) at com.sap.engine.services.httpserver.server.Client.handle(Client.java:92) at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:148) at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:37) at com.sap.engine.core.cluster.impl6.session.UnorderedChannel$MessageRunner.run(UnorderedChannel.java:71) at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37) at java.security.AccessController.doPrivileged(Native Method) at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:94) at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:162) Caused by: java.lang.ClassNotFoundException: com.bmc.sap.UIdPSAPsso Found in negative cache -

---

Loader Info -

---

ClassLoader name: [common:library:com.sap.security.api.sda;library:com.sap.security.core.sda;library:security.class;library:webservices_lib;service:com.sap.security.core.ume.service;service:connector;service:dbpool;service:keystore;service:security;service:userstore] Parent loader name: [Frame ClassLoader] References: library:com.sap.ip.basecomps library:core_lib common:library:IAIKSecurity;library:activation;library:mail;library:tc_secssl library:servlet library:sapxmltoolkit library:com.sap.mw.jco library:com.sap.util.monitor.jarm library:j2eeca library:opensql interface:security interface:log interface:shell interface:keystore_api library:ejb20 interface:webservices library:com.sap.guid interface:appcontext interface:endpoint_api interface:resourceset_api interface:resourcecontext_api common:service:iiop;service:naming;service:p4;service:ts interface:ejbcomponent interface:container interface:visual_administration interface:transactionext interface:dsr_ejbcontext_api service:timeout service:memory common:service:adminadapter;service:basicadmin;service:configuration;service:deploy library:antlr library:jdbdictionary library:opensqlextensions interface:cross Resources: C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
services
dbpool
dbpool.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
security.class
tc_sec_compat.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
services
security
security.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
services
com.sap.security.core.ume.service
com.sap.security.core.ume.service.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
security.class
tc_sec_saml_toolkit_api.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
security.class
tc_sec_userstore_lib.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
webservices_lib
webservices_lib.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
security.class
tc_sec_jaas_test.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
services
dbpool
sqljimpl.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
com.sap.security.core.sda
com.sap.security.core.tpd.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
services
connector
connectorimpl.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
com.sap.security.api.sda
com.sap.security.api.perm.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
webservices_lib
saaj-api.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
security.class
tc_sec_saml_jaas.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
security.class
tc_sec_saml_xmlbind.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
security.class
tc_sec_saml_util.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
security.class
tc_sec_csi.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
security.class
tc_sec_saml_toolkit_core.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
security.class
tc_sec_ssf.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
services
userstore
userstore.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
security.class
tc_sec_saml_service_api.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
security.class
tc_sec_https.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
webservices_lib
jaxrpc-api.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
services
dbpool
opensqllib.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
security.class
tc_sec_jaas.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
com.sap.security.api.sda
com.sap.security.api.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
com.sap.security.core.sda
com.sap.security.core.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
ext
webservices_lib
jaxm-api.jar C:
usr
sap
J2E
JC00
j2ee
cluster
server0
bin
services
keystore
keystore.jar Loading model: {parent,local,references} -

---

at com.sap.engine.frame.core.load.ReferencedLoader.loadClass(ReferencedLoader.java:348) at com.sap.engine.services.security.Util.loadClass(Util.java:262) at com.sap.engine.services.security.Util.loadClassFromAdditionalLoaders(Util.java:204) at com.sap.engine.services.security.login.LoginContextFactory.init(LoginContextFactory.java:92) ... 45 more # #1.5#0001027CAC6A00150000000200000CCC0003FFBA72AF91F3#1125601183371#com.sap.engine.services.security#sap.com/irj#com.sap.engine.services.security#j2ee_guest#0#####SAPEngine_Application_Thread[impl:3]_38##0#0#Error##Java###Cannot load login module class .#1#com.bmc.sap.UIdPSAPsso#

it seems that i just need to get another reference to my class set somewhere, but i cannot determine where. i have consulted the sdn forums & a few sap guides, and have not been able to find any further information on this type of error... if anyone has seen this before, any help would be appreciated.

thanks,

-- alex winner

[Former Member · Accepted solution]

Usually you need to be very careful on how you use the classloader when looking at security. It looks here like you are hitting a java security problem where the secured classloader is not allowed to load your login class.

Read up on java security.

[Former Member · Accepted solution]

Have looked for anything on sap & java security I can; the only relevant security issue I can find is making sure my library has a reference to the sap security interface, which it does.

From the trace, I thought the classloader was unable to load the login class because of the original error, not being able to find the class. The 'cause' of the error in the trace file claims to be:

Caused by: java.lang.ClassNotFoundException: com.bmc.sap.UIdPSAPsso

not a security issue.

Where on the EP should this class location be defined? I have put the library into the "LoginModuleClassLoaders" in the Security Provider, but this does not seem to be enough...

Thanks again for any assistance,

-- Alex

[neeta_patel2 · Accepted solution]

Hi Alex,

Did you find a resolution to your problem about the class not loading. We are facing a similar problem. Any insights would be greatly appreciated.

Regards, Neeta

[Former Member · Accepted solution]

I was having a very similar problem but finally resolved it. See for details. I can't tell if this is the same problem as is described in this thread since some of the relevant details are missing, but I suspect that it is.

[Former Member · Accepted solution]

Hi,

This seems not to be enough to solve the problem.. It's something else. Any ideea?

Annie

[Former Member · Accepted solution]

Bitiusca,

In the stack trace that you are getting, do you see the following?

Caused by: java.lang.ClassNotFoundException: com.bmc.sap.UIdPSAPsso

If not, please include your stack trace or any other error you're getting.

Thanks,

Eric

[Former Member · Accepted solution]

Hello Eric,

I am also facing the same problem. But as you said in another thread i have mentioned the library:gnl.com~UserAuditLoginLibrary. But throwing the error com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:37)

at com.sap.engine.core.cluster.impl6.session.UnorderedChannel$MessageRunner.run(UnorderedChannel.java:71)

at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)

at java.security.AccessController.doPrivileged(Native Method)

at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:94)

at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:162)

Caused by: java.lang.ClassNotFoundException: com.gnl.security.UserAuditLoginModule.

But I am able to login to portal, but the custom login module is not executed due to the above error.

Kindly help

Regards,

Rukmani

[Former Member · Accepted solution]

Rukmani,

Can you confirm that a directory called "gnl.com~UserAuditLoginLibrary" exists on the file system where your module is deployed?

On our system it is in a directory like this:

%SAP_HOME%/JC08/j2ee/cluster/server0/bin/ext

If you don't find this directory, perhaps you'll find one like it. If you do, copy the name of the directory and use that in the LoginModuleClassLoaders property. For example, if you find a directory called "gnl.com_{UserAuditLoginModule" then use this in the LoginModuleClassLoaders property, "library:gnl.com}UserAuditLoginModule".

I hope this is helpful.

Eric