Two web modules in one ear, with different login policies.

[gugrim]

Hi,

We have an EAR that contains two web modules and one ejb module. The two web modules need to use different application policies declared in logon-config.xml.

In an earlier version of out application, one policy was sufficient and it could be specified in jboss-app.xml.

The first thing I tried was to specify the policies in the two different jboss-web.xml files. This worked for one of them but not the other. I then tried to specify the latter policy in jboss-app.xml also. Now it seems to work but I don't understand why.

So, what are the rules here? Why do I need to specify the policy in jboss-app.xml for one web module but not the other?

TIA,
Gunnar

[gugrim]

Just found that it does not work at all with a policy in jboss-app.xml. Apparently it is used to authenticate accesses to the ejb module even though they come from an already authenticated web application.

My new and improved question is thus;

Is it at all possible to two web modules in one ear using two different policies?

TIA,
Gunnar

[anil.saldhana]

Yes, individual web applications can have different security domains.

The scenario you describe in your usecase (two web modules bundled in an ear behaving wierdly wrt different security domains) needs to be tested on our side, to see if there is any bug.

http://jira.jboss.com/jira/browse/JBAS-3294

You can expedite the investigation with a sample test application that you can attach to the JIRA issue, that demonstrates the issues you have.