JBoss 3.2.2 security

Thread view:

krasm@krasy.zagiel.com.pl - 20 Nov 2003 10:14 GMT

Hello,

I'm developing EJB based system on JBoss. The system consists of
two parts: the set of EJB's, mainly Entity Beans which are interfaces
to DB and servlet which is used as user interface. As the interface to
entity beans i'm using statefull session bean. Every call from servlet
have to pass throught it.
To authenticate users I'm using DatabaseServerLoginModule. Users are
able to login, but then they try again to execute eny method from
session bean the server throws exception
Authentication exception, principal=null
What am i doing wrong ?? Should I store the users principal or
it is stored in session context ?

Cheers,

Signature

Marcin Krasowski mkrasowski (at) zagiel (dot) com (dot) pl

To iterate is human, to recurse divine.
L. Peter Deutsch

Reply to this Message

Data - 20 Nov 2003 12:15 GMT

> Hello,
>
[quoted text clipped - 11 lines]
>
> Cheers,

to propagate the principal from the authenticated servlet to the ejb
conteiner you have do protect your servlet adding in web.xml some security
constraints, somethig like this:
....
<security-constraint>
<display-name>Protected area</display-name>
<web-resource-collection>
<web-resource-name>My protected servlet</web-resource-name>
<url-pattern>URL/OF/MY/SERVLET</url-pattern>

<http-method>DELETE</http-method>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<auth-constraint>

<role-name>MyGrantedRole</role-name>
</auth-constraint>
</security-constraint>

Cheers

Reply to this Message

JBoss 3.2.2 security

Free Magazines