Programmatic security and multi-threaded MBeans

[bill_cchkk]

I am developing a multi-threaded MBean that will access a session bean on JBoss 3.0.1. As long as I've been using declarative security, everything was working fine. I have now switched to using programmatic security (getCallerPrincipal and isCallerInRole) in the session bean. In my priviledge checking routine, I call getCallerPrincipal and see that the user I am checking is set properly, and when I call isCallerInRole, it generally comes back with the expected 'true'.

However, when I am making these calls from a different thread in the MBean, it *sometimes* fails. The getCallerPrincipal is correct, but isCallerInRole fails. I traced the problem as far as org.jboss.ejb.EnterpriseContext, where I see that the 'principal' value in isCallerInRole is 'null'. The 'beanPrincipal' value, used by getCallerPrincipal, is the expected value. However, since isCallerInRole uses 'principal', the call always fails.

So, can anyone tell me why getCallerPrincipal returns 'beanPrincipal', bu isCallerInRole checks 'principal'? What's the difference here. I replaced the usage of 'principal' with 'beanPrincipal' in isCallerInRole, and now security works as expected.

Any clues? Have I found a bug? Or is there something I need to do special in a multi-threaded MBean that I'm missing?

TIA,
- Bill

[annapurna]

Hey I am probably not here to give you an answer but to ask you a question.
I am trying to getCallerPrincipal() it gives me a No Security Context set exception. How are you getting the CallerPrincipal. The set the security-domain to other in jboss.xml. I am using jboss3 . Can you help me with my problem.. is there anything that I have to add.

Thanks,
Anna

[bill_cchkk]

I don't see that message. I just call getCallerPrincipal within a bean's remote method, and it works. I did login from the client side with LoginContext(...).login().

- Bill