No method permissions assigned to method=create, interface=H

[kalexm]

Hi,

I know, there are some posts regarding this problem, but they do not solve my problem.

Our Application consists of a Swing Frontend connecting to the app-server using http, the 'http-invoker' and ejbs in all colors. We need Method-Level Security for the ejbs.

The http invoker is secured as well as the jar application using the jboss-specific deployment-descriptor. Both security-domains are equal.
--8<--
<jboss-web>
<security-domain>java:/jaas/xyz_realm</security-domain>
</jboss-web>
--8<--

When trying to create a session bean SomeSessionBeanHome.create(), the error 'No method permissions assigned to method=create, interface=HOME' is thrown. The userprincipal is not null, it is the one I expect and the principals role is set correct too. Thus it is no cache or jaas configuration problem.

I can solve the problem by granting method permissions to *:
--8<--
<method-name>*</method-name>
--8<--
But then I loose fine-grained security on method level.

Do I have to add method-permissions to the home interface?

yours,

kalexm

[kalexm]

I forgot:
jboss 3.0.8-tomcat 4.1.24

[starksm64]

Every method must be assigned a permission. In 3.2.x and lower the default permission for a method is excluded. 4.0.x has an option to switch the default to unchecked.

[kalexm]

Thank you very much for your help.

That every method must have method permissions is understood, and its the way we do it. But astonishingly if I do not grant *, so grant rights to all methds, but on method level I cannot invoke the create method of the home interface anymore. The SecurityInterceptor do not accept any calls to the home interface. From my experience, I never had to grant rights to the home interfaces of beans why do I get this SecurityException when working with the home-stub. Am I wrong do? Do I have to grant rights to the homeInterfaces create Method, and where do I have to do this, in the ejb-jar, jboss deployment descriptor or in the container configuration?

[starksm64]

Well, if I said permission must be explicitly granted to those methods that should be accessible, why is it astonishing that home method also need permissions granted?

[kalexm]

My understanding, but I might be wrong, was that I can only secure the Bean itself and not the home stub.

<method-permission >
<role-name>Superuser</role-name>

<ejb-name>MySessionBeanHome</ejb-name>
<method-name>*</method-name>

</method-permission>

Will this work? Im'going to try it,

thanks for your help,

kalexm

[starksm64]

That syntax applies to both the home, local home, remote and local interfaces.