Basic HTTP authentication for WSDL (using JAAS LoginModule)

[timstorms]

Hi,

I'm trying to use basic HTTP authentication for my WSDL. The user credentials should be validated by a (JAAS) LoginModule for Atlassian Crowd. Somehow the deployment of my EAR file fails. The following stacktrace shows up in my logs:

java.lang.NullPointerException
 at org.jboss.ejb3.security.RoleBasedAuthorizationInterceptorFactory.createPerClass(RoleBasedAuthorizationInterceptorFactory.java:49)
 at org.jboss.aop.advice.AspectFactoryDelegator.createPerClass(AspectFactoryDelegator.java:107)
 at org.jboss.aop.Advisor.addPerClassAspect(Advisor.java:569)
 at org.jboss.aop.advice.ScopedInterceptorFactory.create(ScopedInterceptorFactory.java:72)
 at org.jboss.aop.Advisor.createInterceptorChain(Advisor.java:618)
 at org.jboss.aop.Advisor.pointcutResolved(Advisor.java:888)
 at org.jboss.aop.Advisor.resolveMethodPointcut(Advisor.java:650)
 at org.jboss.aop.ClassContainer.createInterceptorChains(ClassContainer.java:248)
 at org.jboss.aop.ClassContainer.rebuildInterceptors(ClassContainer.java:115)
 at org.jboss.aop.ClassContainer.initializeClassContainer(ClassContainer.java:58)
 at org.jboss.ejb3.EJBContainer.processMetadata(EJBContainer.java:342)
 at org.jboss.ejb3.SessionContainer.processMetadata(SessionContainer.java:140)
 at org.jboss.ejb3.Ejb3Deployment.processEJBContainerMetadata(Ejb3Deployment.java:292)
 at org.jboss.ejb3.Ejb3Deployment.start(Ejb3Deployment.java:356)
 at org.jboss.ejb3.Ejb3Module.startService(Ejb3Module.java:91)
 at org.jboss.system.ServiceMBeanSupport.jbossInternalStart(ServiceMBeanSupport.java:289)
 at org.jboss.system.ServiceMBeanSupport.jbossInternalLifecycle(ServiceMBeanSupport.java:245)
 at sun.reflect.GeneratedMethodAccessor3.invoke(Unknown Source)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
 at java.lang.reflect.Method.invoke(Unknown Source)
 at org.jboss.mx.interceptor.ReflectedDispatcher.invoke(ReflectedDispatcher.java:155)
 at org.jboss.mx.server.Invocation.dispatch(Invocation.java:94)
 at org.jboss.mx.server.Invocation.invoke(Invocation.java:86)
 at org.jboss.mx.server.AbstractMBeanInvoker.invoke(AbstractMBeanInvoker.java:264)
 at org.jboss.mx.server.MBeanServerImpl.invoke(MBeanServerImpl.java:659)
 at org.jboss.system.ServiceController$ServiceProxy.invoke(ServiceController.java:978)
 at $Proxy0.start(Unknown Source)

Apparantly the RoleBasedAuthorizationInterceptorFactory throws an exception on line 49. When I checked its source, I've found the following code:

ctx.lookup("java:/jaas/" + securityAnnotation.value());

Probably, this means that the class doesn't find my SecurityDomain annotation, while it IS present. I've got the following annotations on my web service:

@Stateless
@SecurityDomain("mydomain")
@SOAPBinding(style = SOAPBinding.Style.RPC, use = SOAPBinding.Use.LITERAL)
@WebService(name = "ProjectWebService", targetNamespace = "url", serviceName = "service")
@WebContext(urlPattern = "/url", authMethod ="BASIC", transportGuarantee ="NONE", secureWSDLAccess = false)
@RolesAllowed("admin")
@Remote(clazz.class)

Other things I've done:
web.xml:

<security-constraint>
 <web-resource-collection>
 <web-resource-name>wsdl</web-resource-name>
 <url-pattern>/url</url-pattern>
 </web-resource-collection>
 <auth-constraint>
 <role-name>admin</role-name>
 </auth-constraint>
</security-constraint>
<login-config>
 <auth-method>BASIC</auth-method>
</login-config>
<security-role>
 <role-name>admin</role-name>
</security-role>

login-config.xml (in the conf folder):

<application-policy name="mydomain">
 <authentication>
 <login-module code="com.atlassian.crowd.application.jaas.CrowdLoginModule" flag = "required">
 <module-option name="application.name">admin</module-option>
 <module-option name="application.password">admin</module-option>
 <module-option name="crowd.server.url">server/</module-option>
 </login-module>
 </authentication>
 </application-policy>

This is the code which should be responsible for authenticating the users. What am I doing wrong here? Thanks!

[wolfgangknauf]

Hi,

which JBoss version do you use?

In JBoss 4.2, the "@SecurityDomain" annotation was in package "org.jboss.annotation.security", while for 5.0, it is in "org.jboss.ejb3.annotation". Does your source code compile against the correct jboss version and import the correct packages?

Hope this helps

Wolfgang

[timstorms]

Thanks for your reply Wolfgang. I'm using JBoss 4.2.3. In our seam application, we use the following jboss dependency:

<dependency>
 <groupId>org.jboss.embedded</groupId>
 <artifactId>jboss-embedded</artifactId>
 <version>beta3</version>
 <type>pom</type>
</dependency>

And yes, we do use the org.jboss.annotation.security package for the SecurityDomain annotation. Any other ideas?

[wolfgangknauf]

Hmmmm...
Unfortunately, I never tried to secure a web service, I used it only for servlets/JSPs.

For those, I would add a "jboss-web.xml" to my app:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE jboss-web PUBLIC
 "-//JBoss//DTD Web Application 4.2//EN"
 "http://www.jboss.org/j2ee/dtd/jboss-web_4_2.dtd">

<jboss-web>
 <security-domain>java:/jaas/mydomain</security-domain>
 <context-root>...<context-root>

</jboss-web>

Maybe you could give this one a try?

Wolfgang

[timstorms]

I've managed to get this thing working in a very small dummy application but this problem is still occuring in my companies application. It's a seam application running on JBoss 4.2.3. Could seam somehow be causing this nullpointer?

[timstorms]

Forgot to tell you that this problem only occurs when I use this SecurityDomain annotation.

[timstorms]

Sorry for spamming in my own post... I'm starting to doubt whether this is possible. Check https://jira.jboss.org/jira/browse/SECURITY-38.

If my approach isn't possible, what approach should I go for (considering that only the web service should be behind basic authentication)?