Cannot access secured SB from MDB despite run-as set correct

[ottoberg]

OK, I know this is probably a stupid question, but I need some answers before I go on wasting my - and my employers - time.

Our applications SBs are secured using an LDAP realm with no unauthenticatedIdentity allowed. Now I have got an MDB with the run-as attribute set to a role with sufficient rights which needs to access these SBs in the context of the onMessage method.

It had been my - probably naive - expectation that setting the run-as attribute on this MDB would allow me to do so. Yet every time I try to access an SB I get a

Bad password for username=null

in JBoss' security log.

Now, what I _can_ do is passing a valid username/password combination into the InitialContext used to access the SB. But this SB in turn needs to access another secured SB/EB/whatever and so on. In short: changing the current codebase to use an explicit login when executed within an MDB is no option.

I am doing something terribly wrong here and thus would be exceedingly grateful if someone could answer me the following questions:

(1) What's the use of the run-as attribute for an MDB?

(2) What's the generally accepted way of accessing an SB from an MDB?

Many thx for any pointers,

Olaf

[starksm64]

run-as sets the role of the caller, but if there is no authenticated caller, then the security domain receiving the call has to all unauthenticated callers. run-as is a grant of a role, not identity.

[ottoberg]

run-as sets the role of the caller, but if there is no authenticated caller, then the security domain receiving the call has to all unauthenticated callers. run-as is a grant of a role, not identity.

Yes, I figured that out. So if I mark an MDB with run-as="myrole" I still have to explicitly login via JAAS prior to accessing a secured resource, but the roleset assigned to my newly established Subject will get replaced by "myrole"?

Olaf

[starksm64]

Yes.