JSR 181 EJB + WS Endpoint Authentication Problem
I'm encountering a strange authentication/authorization issue. I'm running JBAS 4.0.4GA_Patch1 and JBossWS1.0.2GA.
I have a JSR181 EJB endpoint exposed as a web-service.
My Port annotation looks thus:
@PortComponent(
transportGuarantee="NONE",
contextRoot = "/sample",
urlPattern="/InternalApi",
authMethod="BASIC"
)
I can access the Web-Service via a JSR109 client that is deployed on a separate jBoss machine (i.e., the client is a packaged jar file with application-client.xml, jaxrpc-mapping.xml, and jboss-client.xml, service-wsdl.xml. I access the client via JNDI lookup).
However, I can only access the web-service using my J2EE client as long as I package my wsdl file with the client jar.
I would like to be able to use the "wsdl-override" element of the jboss-client, so that the client simply downloads the wsdl from the remote server instead of referencing a file in my client deployment directory.
This is where things get sticky.
Option 1.) If, in my PortComponent, I have authMethod="BASIC", AND I use the jboss-client.xml "wsdl-override", then I get a 401 error saying that I am not authorized to view the wsdl (this despite specifiying a username/password in the WS Stub call). However, if I include my wsdl file in the client deployment, and don't try the "wsdl-override" trick, then everything works.
Option 2.) If, in my PortComponent, I have authMethod="NONE", then I get a 403 error, regardless of whether I use the "wsdl-override" or not.
Option 3.) If I omit the "authMethod" attribute entirely, and try to use the "wsdl-override" trick, then I can view the remote WSDL (for instance, via the web browser), but I get an javax.ejb.EJBAccessExcepion: authorization failure on my WebServices server (as one would expect, since my EJB's require a protected role), and a SOAP fault on the WS client.
In the end, it seems like my Stub Username/Password information is ignored whenever I try to use the "wsdl-override".
Is what I'm trying to do possible? I have seen hints in other forum posts (some people have decided to put the WSDL in a different, non-secure URL). However, in my case, I DO want the WSDL to be secured, along with the endpoint.
Any thoughts?