method permissions??

[dlabrosse]

Hello there,

I am trying to assign method permissions in my ejb-jar.xml file. I am simply trying to allow specific users have or not have access to various methods based on there user roles. I've been reading the tutorial from javaworld but I'm still at a dead end.

If I put this element into my ejb-jar.xml file...

<assembly-descriptor>
<method-permission>
<role-name>Admin</role-name>

<ejb-name>ResellerTableBean</ejb-name>
<method-name>*</method-name>

</method-permission>
</assembly-descriptor>

...should this mean that only users who have an Admin role will be able to access the methods in this bean?

Is this the correct console output if a user called "nobody" was to try and access this method?

[Default] User 'nobody' authenticated.
[TarrifServiceBean] No method permissions assigned to method=create
[Default] Exception caught: java.lang.reflect.InvocationTargetException

It seems as if the no permissions have been assigned to any of my methods such as the one above.

Can someone please shed some light on the scene coz I'm pulling my hair out!

hope you can help

-Dan

[agreatham]

Perhaps the "Admin" security role hasn't been defined yet? Modify the descriptor to look like the following and try again:
<assembly-descriptor>
<security-role>
<role-name>Admin</role-name>
</security-role>
<method-permission>
<role-name>Admin</role-name>

<ejb-name>ResellerTableBean</ejb-name>
<method-name>*</method-name>

</method-permission>
</assembly-descriptor>

Hope this helps.

[starksm64]

You assign permissions to a ResellerTableBean and
yet the console shows a TarrifServiceBean complaining
about no permissions. Set the permission for the
TarrifServiceBean.

[dlabrosse]

Thanks for your input guys....problem solved. I was making a slight error in placing my </assembly-descriptor> element inside my </enterprise-beans> element instead of outside it. I now have complete control over my method permissions etc.

cheers.

-Daniel

[eric138]

Hi,

Would you pleased to show me the detail that how to Login for accessing the EJB ?


Best regards,
Eric

[dlabrosse]

here's the code. be sure to set
-Djava.security.auth.login.config==auth.conf

class TestClient
{

static class AppCallbackHandler implements CallbackHandler
{
private String username;
private char[] password;

public AppCallbackHandler(String username, char[] password)
{
this.username = username;
this.password = password;
}

public void handle(Callback[] callbacks) throws
java.io.IOException, UnsupportedCallbackException
{
for (int i = 0; i < callbacks.length; i++)
{
if (callbacks instanceof NameCallback)
{
NameCallback nc = (NameCallback)callbacks;
nc.setName(username);
}
else if (callbacks instanceof PasswordCallback)
{
PasswordCallback pc = (PasswordCallback)callbacks;
pc.setPassword(password);
}
else
{
throw new UnsupportedCallbackException(callbacks, "Unrecognized Callback");
}
}
}
}

public static void main(String[] args)
{
String user = "fred";
String pass = new String("fredpass");

try
{
AppCallbackHandler handler = new AppCallbackHandler(user, pass.toCharArray());
LoginContext lc = new LoginContext("client-login", handler);
System.out.println("Created LoginContext");
lc.login();
}
catch (LoginException le)
{
System.out.println("Login failed");
le.printStackTrace();
}


try
{
Properties props = System.getProperties();
props.put(Context.INITIAL_CONTEXT_FACTORY, "org.jnp.interfaces.NamingContextFactory");
props.put(Context.PROVIDER_URL, "localhost:1099");

InitialContext jndiContext = new InitialContext(props);
System.out.println("Got context");

Object ref = jndiContext.lookup("ejb/MyEJB");

......etc