Java webservice client authentication

I have a java mediabin web service client which is having all sorts of trouble using the MediaBin webservice. I can access the service, but any attempt to get beyond the service to MediaBin is met with the exception:

Server was unable to process request. --> MBException: Access is denied.

I have followed the example code from the MediaBin 4.5 webservice example.

It makes no difference if I run from a linux or windows box. The windows box is not the same box as the MediaBin server.

While this has been logged as Interwoven Support Case 1232816 I would appreciate any input.

Find more posts tagged with

Comments

msnider

What call are you making when you get the exception? Can you post your call stack?

Mark

kipioneer

A "validateCurrentUser" works, as does a request for the WSDL, but not a "getMediaBinServerName".

My code to connect to the SOAP service is:

" /**
* Connect to the MediaBinServerSoap object (only has to be created once).
* @Param strURL String
* @Param strDomain String
* @Param strUsername String
* @Param strPassword String
* @throws Exception
* @return MediaBinServerSoap
*/
private static MediaBinServerSoap ConnectToMediaBin( String strURL, String strDomain, String strUsername, String strPassword ) throws Exception
{
//This creates the service
MediaBinServer myService = new MediaBinServerLocator();

//Two ways to get the Java stub to the service...
MediaBinServerSoap myServiceStub;

if( strURL.equals("") )
{
//...using the URL specified in the WSDL
myServiceStub = myService.getMediaBinServerSoap();
}
else
{
//...or we can specify the URL of the web service
java.net.URL serviceURL = new java.net.URL( strURL );
myServiceStub = myService.getMediaBinServerSoap( serviceURL );
}

//We need to specify the username\password thru the Stub and
//use basic authentication since we can't use Windows Integrated
org.apache.axis.client.Stub t = (org.apache.axis.client.Stub) myServiceStub;

String strUser = "";

if( strDomain.equals("") )
strUser = strUsername;
else
strUser = strDomain + "\\" + strUsername;

t.setUsername(strUser);
t.setPassword(strPassword);

// Now we can make calls into the web service using the Java stub
return myServiceStub;
}
"

which is, as far as I can see, the same as in the example code. The only real difference is in the sample code t.setUsername(strUser) (and the next line) are ((org.apache.axis.client.Stub) myServiceStub).setUsername(strUser); but I don't see why this should make a difference. (and it doesn't )

msnider

Yes, your code looks correct and if you can successfully call validateCurrentUser then the basic connection to the webservice is good. However, since neither validateCurrentUser nor a request for the WSDL actually log into the MediaBin server and getMediaBinServerName does, I'm wondering if you are somehow not logging in with the correct user and/or that user does not have adequate permission.

First, I'm assuming that you have verified that the web service is configured correctly....i.e. by navigating to the webservice on the host machine and invoking either GetMediaBinServerName or TestMediaBinConnection from the test form.

Second, am I correct in assuming that you are making no other calls other than getMediaBinServerName when you get this exception? ( such as requesting the root container, the container tree, the asset list of a container, the list of retrieval tasks, etc). If so, then after you make the call to getMediaBinServerName, check the audit log of the MediaBin Enterprise Manager to verify that the user specied in your java app is indeed the user logging into MediaBin.

Also, how are you specifying the user. Is this a local, domain or LDAP (ActiveDirectory) user?

Mark

kipioneer

I have tried both logons on the box running mediabin, and on our local LDAP, with the same results.

Even as a MediaBin administrator I got the same results.

If I navigate to http://imagestore.deh.sa.gov.au/MediaBinWebService/MediaBinServer.asmx (on our local network) from Firefox running on a linux box on the same network, or from IE 5.5 running on Windows 2000 on the same network I get the following:

"Click here for a complete list of operations.
ValidateCurrentUser

Test

The test form is only available for requests from the local machine.

SOAP ... "

which suggests something in our set up is preventing access.

The ....?WSDL call works.

I am using a username/password from our local Active Directory environment (ENV) for this test rather than the one on the MediaBin box.

msnider

You can only run the webservice's test form on the host machine....http://localhost/MediaBinWebService/MediaBinServer.asmx.

The error that you are getting does not indicate that you are having a problem logging into the webservice or logging into MediaBin. Rather, it indicates that you are logging in as a different user than the one you are specifying...such as "NT AUTHORITY\ANONYMOUS LOGON" or the IUSR_* account. Did you check the MediaBin Enterprise Manager's audit log to see if a login did occur and if so which user account was used?

You are using an ActiveDirectory user which is not the default configuration of the web service ( by default, the webservice is set up for Windows Domain authentication ) Did you reconfigure the webservice as specified in the ReadMe? Are you specifying the user as "ldap\{username}"? Have you tried switching to a domain user instead of the ActiveDirectory user to see if that works?

Mark

kipioneer

Mark, thanks for your help so far.

The Enterprise Manager Audit Log suggests the log in name is correct although I'm just a user here and I have to rely on the systems people to help so the message might have got confused in the communication Smiley Happy

One user I try is one on the MediaBin host itself using that hostname as the domain. This has about as much luck.

Our ldap environment is "env" and I have been using "env\nwaller", my user name in that environment, as the login user. This seems to have been passed through OK.

I shall check how the webservice was set up and get back later in the day. It was set up by Interwoven people rather than our people I believe.

Neil

kipioneer

This was a permissions problem - the directory allowed scripts only, rather than executables and scripts.

It now works!

msnider

That's great that you've got it up and running. However, the fix is interesting since "Scripts only" should be sufficient and is the default configuration. I haven't heard of anyone else having this type of problem with that setting, but I will keep a note of it.

Mark

kipioneer

Well I'm not sure we did. Our systems bloke fiddled around a bit the other day and everything started to connect and did so for a few days, then we had to bounce MediaBin and we are back to square 1 - grrrrrr.

Neil

kipioneer

Update: I ran the tests suggested from a browser on the MediaBin box and they ran OK. Now the client running on another box is getting an MBException back from mediaBin - Error loading library/DLL - 0x80029C4A.

This is when we try and return an asset preview.

msnider

So then you can connect and perform other functions but you get the error when retrieving the asset preview? Does an error message show up in your MBP.log at the same time?

Mark

kipioneer

I'll enquire of our systems person and get back ASAP. This may not be until next week as I'm off bush for a few days.
The annoying part is this worked last Friday! (And the MediaBin web browser interface can display images - I would have thought the mechanism was not dissimilar but I could be wrong)

kipioneer

The following is a log since the bounce of MediaBin. It doesn't seem to show anything untoward.

Neil

msnider

You will want to check the Audit log, not the MBP.log, to verify that the user logging into MediaBin is the same as the user you are specifying in the java app. The Audit log is only accessible via the MediaBin Enterprise Manager and you will want to check the log immediately after you get the error so that it is easier to map the login vs error.

Mark

kipioneer

Connection is not the problem now, we can connect and do almost anything except retrieve a preview image. We get that DLL error.

msnider

Can you post the exception call stack?

kipioneer

This is the client exception stack.

I'm wondering whether rebuilding the client stubs would help. Nothing has changed since they worked though Smiley Happy

(or not at least as far as I know).

msnider

No, you shouldn't have to rebuild the client stubs.....that error is coming directly from the webservice so the client stubs are working correctly. But I've never seen that type of error before, so let me do some investigating and I'll get back to you.

Mark

msnider

What version of MediaBin are you using? What are the datetime stamps on the following files:

located in inetpub\wwwroot\MediaBinWebService\bin:
MBPNetModel.dll
Interop.MBPSCRIPTMODEL2Lib.dll
Interop.MBUTILSLib.dll

and located in Program Files\Common Files\Interwoven, Inc\MediaBin Models:
Client API 2.dll
jsTools4.dll
MBModel4.dll
MBPScriptModel2.dll
MBUtils
ActiveFile.dll

Mark

kipioneer

At last I can get back to this! Just upgraded a linux box to Fedora Core 4 and it kiled my mouse since I was using a KVM. Another couple of days banging my head against the wall Smiley Happy

Our systems bloke has checked all of the DLL and nothing seems untoward.

I thought I would check the retrieving of an array of previews with the same result which isn't surprising since retrieving a preview is retrieving a preview.

It works in the web GUI though. Presumably that uses the same DLL.

msnider

No, it does not. The web client is ASP based while the web service is ASP.NET based. While the web client does use the same core DLLs (the ones located in Program Files\Common Files\Interwoven, Inc.\MediaBin DLLs) it does not use the web service DLLs (MBPNetModel.dll, Interop.MBPSCRIPTMODEL2Lib.dll, Interop.MBUTILSLib.dll).

It would probably be better if you opened up a support case....it would be much more efficient to track your specific issue.

Mark

kipioneer

No, it does not. The web client is ASP based while the web service is ASP.NET based. While the web client does use the same core DLLs (the ones located in Program Files\Common Files\Interwoven, Inc.\MediaBin DLLs) it does not use the web service DLLs (MBPNetModel.dll, Interop.MBPSCRIPTMODEL2Lib.dll, Interop.MBUTILSLib.dll).

It would probably be better if you opened up a support case....it would be much more efficient to track your specific issue.

Mark

Will do.

Thanks for your time and advice Mark.

Neil