Principal = null calling secured EJB from java client

[mspinetti]

I'm trying to do a very simple sample of calling a secured EJB from a Java client, but when I try to get the home of the EJB Jboss gives "SecurityInterceptor -> Authentication exception, principal = null.

Can somebody help me about that?? What's wrong??

I've tried with a Java client that uses JAAS to authenticate a user and I get the same error.

I'm using Jboss-Tomcat 3.2.0 over Win2000 professional with JDK1.4.1_02.

Thanks for help. Sorry for my english, I hope you understand.


Login-config.xml entry.
-------------------------------

<application-policy name = "ejb">

<login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
flag = "required" />

</application-policy>


ejb-jar.xml
------------------

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE ejb-jar PUBLIC "-//Sun Microsystems, Inc.//DTD Enterprise JavaBeans 2.0//EN" "http://java.sun.com/dtd/ejb-jar_2_0.dtd">
<ejb-jar>
<enterprise-beans>

<display-name>Comp1</display-name>
<ejb-name>Comp1</ejb-name>
jboss1.Comp1Home
jboss1.Comp1
<ejb-class>jboss1.Comp1Bean</ejb-class>
<session-type>Stateless</session-type>
<transaction-type>Container</transaction-type>


<display-name>First</display-name>
<ejb-name>First</ejb-name>
jboss1.FirstHome
jboss1.First
<ejb-class>jboss1.FirstBean</ejb-class>
<session-type>Stateless</session-type>
<transaction-type>Container</transaction-type>

</enterprise-beans>
<assembly-descriptor>
<security-role>

<role-name>teller</role-name>
</security-role>
<method-permission>
<role-name>teller</role-name>


<ejb-name>Comp1</ejb-name>
<method-name>*</method-name>

</method-permission>
<container-transaction>

<ejb-name>Comp1</ejb-name>
<method-name>*</method-name>


<ejb-name>First</ejb-name>
<method-name>*</method-name>

<trans-attribute>Required</trans-attribute>
</container-transaction>
</assembly-descriptor>
</ejb-jar>


jboss.xml
-------------.


<security-domain>java:/jaas/ejb</security-domain>
<enterprise-beans>

<ejb-name>Comp1</ejb-name>
<jndi-name>ejb/Comp1</jndi-name>


<ejb-name>First</ejb-name>
<jndi-name>First</jndi-name>

</enterprise-beans>

[petertje]

From a Java stand-alone client, right? Does it perform a JAAS login using the jboss ClientLoginModule?

Peter

[mspinetti]

No, in the stand-alone app I made I used UsersRolesLoginModule.

Do I have to use ClientLoginModule? why?

Do you have some sample of a java stand-alone client calling a secure EJB??

It's necessary to use Subject.doAs to make the call??

I think I don't understand very well this stuff.

Thanks.

[mspinetti]

I already solve it! using ClientLoginModule from JAAS

Thanks Peter,

[adrian.brock]

The ClientLoginModule is used to remember
the user/password in a location for later
use by the ejb proxies.
They transport this information to the server
where the authentication occurs.

Look at client/auth.conf for an example JAAS config.

Regards,
Adrian

[msmckibben]

Do you have to perform the client auth even if you have an unchecked method permission for your EJB specified in the deployment descriptor?

I have an ejb jar that has mixed beans-- i.e. some require a security role while others don't. Calling into an EJB method marked as unchecked throws this same exception. But, I can't just whack out the <security-domain> from jboss.xml as all the beans then become unsecured. It seems to be an all or nothing affair JBoss.

[adrian.brock]

If the ejb is going to authenticate the user/password
it must know that information
which means you have to pass it to the server.

Regards,
Adrian