Cached Principal's not supported?

[paper57]

It appears that cached principals are not supported in JbossWS.

I noticed that my login module was called on every web service invocation.

Looking in ServerLoginHandler, I see a new SimplePrincipal is created on every invocation.

As my authentication process is very expensive, what is the recommended procedure to make use of the cache?

Under Jboss.net in 3.2.6 I did not have this problem.

[paper57]

Please disregard, I see tomcat is implemented the same way which works fine...the problem is elsewhere.

[paper57]

I apologize for all the posts. It appears that tomcat goes to a lot of trouble to work around this issue. I guess in jboss.net in 3.2 I skirted by by riding on top of the basic authentication done in the servlet container under the covers.

Any suggestions on how to proceed?

[starksm64]

Try describing exactly what the issue is here as this discussion does not actually tell me what you view as an issue and what security setup of the deployment in question is.

[paper57]

Everytime I invoke a method on an EJB through a web service, configured to use basic authentication, my custom login module is invoked.

Contrast this to a sample web app, configured to use basic authentication, which invokes the custom module the first time but not on subsequent requests by the same user.

The login process is very expensive, so obviously I do not want this occuring on every invocation.

[starksm64]

I need to see how the server side components are secured. What are the associated deployment descriptors? It may be easier to simply create a bug report in jira with an example deployment.

http://jira.jboss.com/jira/browse/JBWS

[paper57]

I have done so here: http://jira.jboss.com/jira/browse/JBWS-106