Problem with method permissions

[artur]

I'm using JBoss 2.4.4 with tomcat 4.0.1

The ejb-jar.xml dtd states that <method-permissions>
need not be defined in <assembly-descriptor>.
This to me means that if don't have <method-permissions>
the ejb container should not check for them. Yet when I
try to call a create() on home for one of my session beans
I get the following error:

java.lang.SecurityException: No method permissions assigned to method=create

My application has lots of security roles defined for the
web protion and I really don't want to define permissions
for each role/bean.

Is there some configuration option in JBoss to prevent
this permission check? It this fixed in 3.0?

Thanks,

Artur...

[yeroc]

We appear to be living in parallel universes! We ran into this problem today as well.

[starksm64]

You have assumed a default behavior of allowing access in the absense of method-permission declarations. This is not how JBoss defaults the security behavior. If a security-domain is defined then you must defined method-permissions to allow access to your ejbs or they will be inaccessible.