Forum Problems Installing LAMS: Re: Sakai - Lams integration Create problem

By: Anthony Xiao

[ Reply | Forward ]

From analysing the tcpdump,

when /lams/j_security_check?j_username..... is requested it's followed by a "HTTP1.1 400 Invalid direct reference to form login page"

it looks like the lams-valve.jar is not working for whatever reason. I've attached a new copy of lams-valve.jar and the cooresponding source. I've inserted more debugging statement so we can trace it easier.

Try run lams with the new lams-valve.jar see if you can see any of the debugging messages.

> I think that you have to do a POST to make j_security_check work relayable. A redirect is not good enough.

That's not true, you can try several experiment for yourself. The behaviour of j_security_check should be;

CASE 1. Invalid direct reference....
clear all the cookies (clears the session) then goto
http://10.0.0.79:8280/lams/j_security_check?j_username=sakai_admin&j_password=f3beb2ff779fc89fb9f24456cebe39b5

you should get "HTTP Status 400 - Invalid direct reference to form login page" because after j_security_check log the user in it doesn't know where to forward the user. Then if you goto http://10.0.0.79:8280/lams/ you should be logged in.

CASE 2. Login Successful
clear all the cookie again then goto http://10.0.0.79:8280/lams/ (setup the session) you should see the login page. Then goto
http://10.0.0.79:8280/lams/j_security_check?j_username=sakai_admin&j_password=f3beb2ff779fc89fb9f24456cebe39b5
you should get log straight in because the session has been setup.

CASE 3. HTTP Status 404
clear all the cookie again then goto
http://10.0.0.79:8280/lams/j_security_check?j_username=sakai_admin&j_password=f3beb2ff779fc89fb9f24456cebe39b5
you should get "HTTP Status 400 - Invalid direct reference to form login page" (same as 1) but this time goto
http://10.0.0.79:8280/lams/j_security_check?j_username=sakai_admin&j_password=f3beb2ff779fc89fb9f24456cebe39b5
again. This time you'll get "HTTP Status 404 - /lams/j_security_check" because j_security_check doesn't exist after the user has been logged in.

The role of lams-valve.jar is to intercept calls to j_security_check and setup a session. This session tells where j_security_check should forward the user after authentication has finish. So we should get case 2 instead of case 1 above, the LoginRequestServlet prevents case 3, by making sure j_security_check is not called if user is already logged it.

Posted by Anthony Xiao