@RunAs in JBoss 5 - Caller unauthorized in second call

[komet_1978]

Hallo,

I've noticed the following strange behaviour using the @RunAs annotation in a secured STSB.

I've tried JBoss 5.0.1.GA and 5.1.0.GA.

Take a look at the following simple scenario: three secured STSBs Caller, A and B. Caller runs as Admin defined by @RunAs("Admin") annotation and uses the role Admin for all method calls on other STSBs, STSB A allowes access only by Admins (realize by @RolesAllowed("Admin") annotation) , the same definition can be found in the STSB B. All STSBs are in the same security domain defined by @SecurityDomain("foo").

1) Authorized Client calls Caller method (the Client hasn't got the role "Admin")
2) Caller method calls A method (as a "Admin")
3) A method calls B method. (I supposed that the "Admin" role is propagated to the second call)

1) and 2) are ok.
3) throws "Caller unauthorized" exception.

Is this a bug or a feature?

[komet_1978]

This is the corresponding stack trace:

ERROR [STDERR] javax.ejb.EJBAccessException: Caller unauthorized
ERROR [STDERR] at org.jboss.ejb3.security.RoleBasedAuthorizationInterceptorv2.invoke(RoleBasedAuthorizationInterceptorv2.java:199)
ERROR [STDERR] at org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:102)
ERROR [STDERR] at org.jboss.ejb3.security.Ejb3AuthenticationInterceptorv2.invoke(Ejb3AuthenticationInterceptorv2.java:186)
ERROR [STDERR] at org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:102)
ERROR [STDERR] at org.jboss.ejb3.ENCPropagationInterceptor.invoke(ENCPropagationInterceptor.java:41)
ERROR [STDERR] at org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:102)
ERROR [STDERR] at org.jboss.ejb3.asynchronous.AsynchronousInterceptor.invoke(AsynchronousInterceptor.java:106)
ERROR [STDERR] at org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:102)
ERROR [STDERR] at org.jboss.ejb3.BlockContainerShutdownInterceptor.invoke(BlockContainerShutdownInterceptor.java:67)
ERROR [STDERR] at org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:102)
ERROR [STDERR] at org.jboss.aspects.currentinvocation.CurrentInvocationInterceptor.invoke(CurrentInvocationInterceptor.java:67)
ERROR [STDERR] at org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:102)
ERROR [STDERR] at org.jboss.ejb3.stateless.StatelessContainer.dynamicInvoke(StatelessContainer.java:487)
ERROR [STDERR] at org.jboss.ejb3.remoting.IsLocalInterceptor.invokeLocal(IsLocalInterceptor.java:85)
ERROR [STDERR] at org.jboss.ejb3.remoting.IsLocalInterceptor.invoke(IsLocalInterceptor.java:72)
ERROR [STDERR] at org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:102)
ERROR [STDERR] at org.jboss.aspects.remoting.PojiProxy.invoke(PojiProxy.java:62)

[lvonk2000]

We are experiencing the same thing. Have you found an answer?

[praenti]

Seeing same behaviour in an implementation. Looks like a bug in JBoss5, bacause I cannot see the idea behind this behaviour. Can anyone do a bug report?

Regards,
Michael

[akolmakov]

[komet_1978]

"lvonk2000" wrote:
We are experiencing the same thing. Have you found an answer?

No, my work around is to propagate a second level call to a local unsecured EJB.

[akolmakov]

Created issue https://jira.jboss.org/jira/browse/EJBTHREE-1945

[wolfc]

I've added a test in the EJB 3 testsuite, see http://anonsvn.jboss.org/repos/jbossas/projects/ejb3/trunk/testsuite/src/test/java/org/jboss/ejb3/test/ejbthree1945/. It passes against AS trunk. Please take a look at the code and see if I've got the test correctly coded.

[pappy]

Hi Carlo

I have attached an archive to https://jira.jboss.org/browse/EJBTHREE-1945, which contains an small example of this kind of failure...

Please note that I haven't use any JBoss specific @annotation, however, even if I use them the error still persists

[gauravag]

Hi Thomas,

Point what you are talking about is true. Its a sort of bug i think.

For this u need to add in ur login-config.xml file (where u have specified ur authentication policy ) along with ClientLoginModule.

This whole application can be seen in here on this link

http://community.jboss.org/message/555342#555342

Also u can see the security faq in jboss community on this link ofr some details

http://community.jboss.org/wiki/SecurityFAQ

Regards,

[dlofthouse]

The ClientLoginModule should not be added to the same policy as is used to secure the actual application, doing so can cause unexpected results especially where a RunAs identity is involved.

[grossetieg]

Hi,

I found an explanation in Ejb3AuthenticationInterceptorv2 (jboss-ejb3-core 1.1.5). First call, when the security context is populated the "to" IncomingRunAs is set with the "from" OutgoingRunAs :

  private void populateSecurityContext(SecurityContext to, SecurityContext from)
  {
    SecurityActions.setSubjectInfo(to, from.getSubjectInfo());
    SecurityActions.setIncomingRunAs(to, from.getOutgoingRunAs());
  }

Second call the "from" OutgoingRunAs is now empty or null and the "to" IncomingRunAs is set to empty or null. The caller is not anymore trusted :

boolean trustedCaller = (hasIncomingRunAsIdentity(sc)) || (helper.isTrusted());

The following exception is thrown :

throw new EJBAccessException("Invalid User");

My work around is to populate the "to" SecurityContext with either the "from" OutgoingRunAs or the "from" IncomingRunAs.

I use the following code to set my "run-as" identity :

securityContext.setOutgoingRunAs(runAs)

(I was using SecurityAssociation.pushRunAsIdentity() but I think there's a memory leak because the pop() is never call on the threadRunAsStacks).

Then I call my bean annotated with @SecurityDomain(value="A") which call a second bean annotated with @SecurityDomain(value="A") which call a third bean annotated with @SecurityDomain(value="C") which....

Without my work around I can only call the first bean... then when the second bean is called an EJBAccessException is thrown.

I'm not sure this is the right way to fix the propagation issue but it's working

Guillaume.

[grossetieg]

Carlo de Wolf a écrit:

I've added a test in the EJB 3 testsuite, see http://anonsvn.jboss.org/repos/jbossas/projects/ejb3/trunk/testsuite/src/test/java/org/jboss/ejb3/test/ejbthree1945/. It passes against AS trunk. Please take a look at the code and see if I've got the test correctly coded.

I may be wrong but in your test Caller and CallerWithIdentity use StatelessBBean instead of StatelessABean.

Guillaume.

[johan.hedin]

We have the same problem porting from JBoss 4.2.3 to JBoss 5.1.0. I agree that the test needs to use StatelessABean to test the propagation.