from MDB (RunAs) to SB (custom security), how to?

[gdemir]

Hi,

I call a session bean (with custom security proxy and CMT) from an MDB (with run-as role and CMT). In my security implementation, I construct a custom Principal class.

In Session Bean, I see that JBoss's RunAsIdentity principal class has been propagated from the MDB, as expected. My very simple business logic in the session bean completes and just before the txn commit, I get this message in the server log:

2005-02-23 13:22:08,394 ERROR [org.jboss.jms.asf.StdServerSession] failed to commit/rollback
org.jboss.tm.JBossRollbackException: Unable to commit, tx=TransactionImpl:XidImpl[FormatId=257, GlobalId=MARDUK/82, BranchQual=, localId=82] status=STATUS_NO_TRANSACTION; - nested throwable: (javax.ejb.EJBException: null; CausedByException is:
Entity 'PPRStmt'Incompatible Principal Class Name:org.jboss.security.RunAsIdentity toString():[roles=[admin],principal=anonymous] getName():anonymous)
at org.jboss.tm.TransactionImpl.commit(TransactionImpl.java:344)
at org.jboss.tm.TxManager.commit(TxManager.java:200)
at org.jboss.jms.asf.StdServerSession.onMessage(StdServerSession.java:341)
at org.jboss.mq.SpyMessageConsumer.sessionConsumerProcessMessage(SpyMessageConsumer.java:904)
at org.jboss.mq.SpyMessageConsumer.addMessage(SpyMessageConsumer.java:159)
at org.jboss.mq.SpySession.run(SpySession.java:351)
at org.jboss.jms.asf.StdServerSession.run(StdServerSession.java:180)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:743)
at java.lang.Thread.run(Unknown Source)
Caused by: javax.ejb.EJBException: null; CausedByException is:
Entity 'PPRStmt'Incompatible Principal Class Name:org.jboss.security.RunAsIdentity toString():[roles=[admin],principal=anonymous] getName():anonymous
at org.jboss.ejb.plugins.CMPPersistenceManager.throwRemoteException(CMPPersistenceManager.java:560)
at org.jboss.ejb.plugins.CMPPersistenceManager.ejbStore(CMPPersistenceManager.java:540)
at org.jboss.ejb.plugins.CMPPersistenceManager.invokeEjbStore(CMPPersistenceManager.java:447)
at org.jboss.resource.connectionmanager.CachedConnectionInterceptor.invokeEjbStore(CachedConnectionInterceptor.java:412)
at org.jboss.ejb.EntityContainer.invokeEjbStore(EntityContainer.java:729)
at org.jboss.ejb.GlobalTxEntityMap$2.invokeEjbStore(GlobalTxEntityMap.java:117)
at org.jboss.ejb.GlobalTxEntityMap$GlobalTxSynchronization.synchronize(GlobalTxEntityMap.java:239)
at org.jboss.ejb.GlobalTxEntityMap$GlobalTxSynchronization.beforeCompletion(GlobalTxEntityMap.java:302)
at org.jboss.tm.TransactionImpl.doBeforeCompletion(TransactionImpl.java:1383)
at org.jboss.tm.TransactionImpl.beforePrepare(TransactionImpl.java:1075)
at org.jboss.tm.TransactionImpl.commit(TransactionImpl.java:296)
... 8 more

How to make the transaction commit?
Thanks
Gokhan

[gdemir]

My real scenario indeed has one CMP too. It is called from the session bean. I think the problem is, JBoss does not propagate the caller identity to the CMP. Therefore, txn commit fails.

It might be a JBoss bug.
Or it might be my custom security implementation. I am not sure.

Thanks,
Gokhan

[starksm64]

The run-as identity does not support a custom principal as the run-as identity is a temporary grant to an identity that has at least the run-as role. You will need to create a feature request to allow the run-as identity to be an augmentation of the existing caller principal.

http://jira.jboss.com/jira/browse/JBAS

[gdemir]

Thank you for the clarification.

Can I, by any means, call a session bean from an MDB just like I call this session bean from an EJB client (therefore, forcing a new security context to be created)?

Thanks,
Gokhan

[starksm64]

Yes, do a JAAS login the same as a client.