How to disable authorization, but keep authentication

[borisn]

Hi,
I want to use only authentication part, but disable authorization on all beans. As soon as security turned on (by adding security-domain to standardjboss.xml) all beans? methods are access controlled and I have to add entries to all ejb-jar.xml files (and we have a lot of them) to grant permission to all methods


Anyone knows any other way to disable authorization without modifying ejb-jar.xml files ?

Thanks
Boris

[starksm64]

Look into the unchecked element usage. This indicates that authentication is required, but no specific roles or authorization is needed.

[borisn]

That's what I am doing now.

<method-permission>
 <unchecked/>
 <method>
 <ejb-name>Fibo</ejb-name>
 <method-name>*</method-name>
 </method>
 </method-permission>

But, I have to put it in all ejb-jar.xml files. So, I was wondering if there any other way to disable authorization.

Thanks
Boris

[starksm64]

No standard mechanism. You can use a proprietary replacement for the org.jboss.ejb.plugins.SecurityInterceptor to do whatever you want.