Duke's Bank: EJB security-domain doesn't work, gives Authent

[alchemista]

I tried enabling security for the Duke's Bank application as mentioned in the Getting Started guide.

When I added the security-domain element for the jboss-web.xml file for the web application, the login does work.

However, the Getting Started guide also says to add a security-domain element to the jboss.xml file in the EJB package. However, if I add the security-domain element there, I then get an error after logging into the web app:

SecurityException - Authentication error: principal=null

on the CustomerBean EJB.

Why isn't the EJB-level security working? It's the same exact line as the web app security, using the dukesbank security domain.

[andiwauss]

you seem to be using 4.0.0

try 4.0.1RC1 or put

<module-option name="unauthenticatedIdentity">anonymous</module-option>

in your <application-policy name = "name-of-app">

in your login-config.xml

[msegvich]

I tried adding the "module-option", but I still get the same Authentication error. The only time I could get the application to work was before I made any of the security changes. Since including the security domain info, I can't get the app to work, even when I remove the security domain info. Please advise.

[fbuland]

I've got the same Authentication error after adding the "module-option", but I've not place it in the correct tag in my login-config.xml.
After placing it in the login-module tag, it works:

<application-policy name="dukesbank">
 <authentication>
 <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule" flag="required">
 <module-option name="unauthenticatedIdentity">anonymous</module-option>
 </login-module>
 </authentication>
</application-policy>

[msegvich]

Just wanted to follow-up on my earlier post. I downloaded 4.0.1 the other day and now I have no problem with the dukesbank application-policy. Everything works according to the docs. So it looks like JBoss resolved the issues.