Publishing messages from Stateless SessionBean security prob

[asinitsyn]

Hello,

I'm trying to port application from Weblogic to JBoss and am stuck with problems publishing JMS messages from stateless session bean.

Here is what I did. Please, advise those are valid changes:
1. modified deploy/jms/jbossmq-service.xml to comment out old SecurityDomain and point to new one. This is for my MDBs to pass authentication.

<mbean code="org.jboss.mq.security.SecurityManager" name="jboss.mq:service=SecurityManager">
 <attribute name="DefaultSecurityConfig">
 <security>
 <role name="guest" read="true" write="true" create="true"/>
 </security>
 </attribute>
 <!--attribute name="SecurityDomain">jbossmq</attribute-->
 <attribute name="SecurityDomain">DBRealm</attribute>
 <depends optional-attribute-name="NextInterceptor">jboss.mq:service=DestinationManager</depends>
 </mbean>

2. modified deploy/jms/jms-ds.xml to comment out old SecurityDomain and point to new one. This is for UpdatePublisher to pass authentication.
UpdatePublisher is session bean that sends messages. If I don't do it, I get exception saying "user guest is NOT authenticated"

<tx-connection-factory>

 <jndi-name>JmsXA</jndi-name>

 <xa-transaction/>
 <!--track-connection-by-tx/-->

 <adapter-display-name>JMS Adapter</adapter-display-name>

 <config-property name="SessionDefaultType" type="java.lang.String">javax.jms.Topic</config-property>

 <!--security-domain-and-application>JmsXARealm</security-domain-and-application-->
 <security-domain-and-application>DBRealm</security-domain-and-application>

 </tx-connection-factory

3. Here is relevant part of ejb-jar.xml

<resource-ref>
 <res-ref-name>jms/TopicConnectionFactory</res-ref-name>
 <res-type>javax.jms.TopicConnectionFactory</res-type>
 <res-auth>Container</res-auth>
 </resource-ref>

4. Here is relevant part of jboss.xml

<resource-ref>
 <res-ref-name>jms/TopicConnectionFactory</res-ref-name>
 <jndi-name>java:/JmsXA</jndi-name>
 </resource-ref>

Finally when UpdatePublisher tries to createSession I get the following exception:
2003-12-26 15:22:34,321 WARN [org.jboss.resource.connectionmanager.JBossManagedConnectionPool] Throwable while attempting to get a new connection:
javax.resource.spi.SecurityException: No Passwdord credentials found
at org.jboss.resource.adapter.jms.JmsCred.getJmsCred(JmsCred.java:74)
at org.jboss.resource.adapter.jms.JmsManagedConnectionFactory.createManagedConnection(JmsManagedConnectionFactory.java:92)
at org.jboss.resource.connectionmanager.InternalManagedConnectionPool.createConnectionEventListener(InternalManagedConnectionPool.java:451)
at org.jboss.resource.connectionmanager.InternalManagedConnectionPool.getConnection(InternalManagedConnectionPool.java:212)
at org.jboss.resource.connectionmanager.JBossManagedConnectionPool$BasePool.getConnection(JBossManagedConnectionPool.java:496)
at org.jboss.resource.connectionmanager.BaseConnectionManager2.getManagedConnection(BaseConnectionManager2.java:425)
at org.jboss.resource.connectionmanager.TxConnectionManager.getManagedConnection(TxConnectionManager.java:318)
at org.jboss.resource.connectionmanager.BaseConnectionManager2.allocateConnection(BaseConnectionManager2.java:477)
at org.jboss.resource.connectionmanager.BaseConnectionManager2$ConnectionManagerProxy.allocateConnection(BaseConnectionManager2.java:814)
at org.jboss.resource.adapter.jms.JmsSessionFactoryImpl.createTopicSession(JmsSessionFactoryImpl.java:159)
at com.alantek.ejb.msgdistribution.UpdatePublisherBean.publishMessage(UpdatePublisherBean.java:188)

Please, advise how to get SessionBean to publish several messages to Topics/Queues from within the same transaction.

Thatnks in advance,
Andrew

[adrian.brock]

The purpose of the JmsXARealm is to provide a user/password when you do
TopicConnectionFactory.createTopicConnection();
By default it provides guest/guest

Regards,
Adrian

[asinitsyn]

So, how can security credentials be propagated from EJB to JMS automatically. User that calls session bean was authenticated. If I add printout like sessionContext.getCallerPrincipal() it returns valid user authenticated in DBRealm domain.

[adrian.brock]

You need to change the JmsXARealm to use the caller identity rather than
the configured identity in conf/login-config.xml

<application-policy name = "JmsXARealm">

<!-- !!!HERE!!! -->
<login-module code = "org.jboss.resource.security.CallerIdentityLoginModule"
flag = "required">
<module-option name = "userName">guest</module-option>
<module-option name = "password">guest</module-option>
<module-option name = "managedConnectionFactoryName">jboss.jca:service=TxCM,name=JmsXA</module-option>
</login-module>

</application-policy>

The user/password is used as the default when the caller has no security context.

NOTE: This will create subpools inside java:/JmsXA for each identity.
i.e. each user gets their own pool of JMS Connections/Sessions.

Regards,
Adrian

[asinitsyn]

Thanks a lot Adrian. It worked great. The only problem I see is regarding NOTE you attached. I may have up to 1000 users that perform transactions occasionaly. User may perform transaction and don't do anything for next 3 days. So, my question is: is there any other jms ConnectionFactory I can use/configure to publish messages from EJBs that does not create separate pool for each user? Or I can still use JmsXA because overhead associated with this behaviour is not big?

Regards,
Andrew

[adrian.brock]

You can use
<idle-timeout-minutes>15</idle-timeout-minutes>
to close unused connections.

If you are just sending messages using the in VM IL (the default),
there is little overhead involved in each connection.

Regards,
Adrian