Using custom JACC provider with JBoss 4.0.2

[akrestan]

Hi,

I have configured a custom JACC provider developed for WAS 6.0 that comprises a custom policy class and custom policy configuration factory. The problem is that JBoss treats the content of the deployment descriptors differently from WAS:

WAS puts all EJB methods for which there is no role specified in DD to "unchecked" policy using PolicyConfiguration.addToUncheckedPolicy() and the EJB methods, which are expressly forbidden by the <exclude-list> element in DD to "excluded" policy using PolicyConfiguration.addToExcludedPolicy().

JBoss puts both the types of method, i.e those with no role specified as well as those under <exclude-list> to "excluded" policy, which IMO makes it impossible for the policy class to distinguish between the two cases.

Please let me know if you have any opinion on this topic.

Regards

Ales

[starksm64]

My opinion is that the absence of explicit security means you are not granted access, hence the jboss behavior of using excluded as the default. Don't rely on defaults if you want portability. Explicitly mark the methods unchecked or excluded as required.

[akrestan]

Hi,

thanks for the response. After some investigation in the sources I figured that myself. I logged the issue a bit hastily as a bug - appologies for that. I lowered its severity.

A.