Roles Update Problem

[rkarn]

Hi all,

currently I have a problem with the apply of new Roles for a Principal.
It seems my JBoss doesn't notice new applied Roles until it will be restarted.

Scenario:

1. The Principal 'root' has the role 'Admin' and therefore he can call a method 'abc' for which the role 'Admin' is defined.

2. Principal 'doe' has the role 'User' only and therefore he can't call the method 'abc'.

3. 'root' adds the Role 'Admin' for the Principal 'doe' to the Roles table by calling a session bean method.

I assumed that the user 'doe' can call the method 'abc' now. But he can't until I restart the JBoss.


Is there any information about that problem around?

Thank you,
Nod

[gorano]

If you leave your application and have a coffe, you will be able to use the new role when you come back.

There is a cache and a time to live setting you can play with. Default is 30 minutes.

Make your changes in jboss-service.xml
org.jboss.security.plugins.JaasSecurityManagerService

/G

[clcantrell]

I had the same problem. All you have to do is upon role update, Flush the JAASSecurityManger's cache. This will force the the principal to go through the login module again, populating all the new roles.

[rkarn]

Thank you for the hints. Flushing the JAASSecurityManger's cache does it.

[auckyboy]

Hi Nod/clcantrell, gorano,

Can you please elaborate on how to clear the cache and change the time to live.

Tthx

[gorano]

In jboss-service.xml you will find:

<!-- JAAS security manager and realm mapping -->
 <mbean code="org.jboss.security.plugins.JaasSecurityManagerService"
 name="jboss.security:service=JaasSecurityManager">
 <attribute name="SecurityManagerClassName">
 org.jboss.security.plugins.JaasSecurityManager
 </attribute>
 </mbean

Add parameters:

<attribute name="DefaultCacheTimeout">TimeoutInSeconds</attribute>
<attribute name="DefaultCacheResolution">TimeoutInSeconds</attribute>

If not specified, JBoss use the following values:

DefaultCacheTimeout=1800
DefaultCacheResolution=60 (interval to check the cache)

/G

[gorano]

To be able to flush the entire cache, you can invoke the flushAuthenticationCache method.

/G