This content has been marked as final.
Show 3 replies
-
1. Re: SecurityDomain with EJB3.0
yantriki Jan 9, 2006 1:39 PM (in response to yantriki)Ok, I figured that with 4.0.3 JBoss server the jboss-service.xml defines mechanism to define the application-policy in the SAR deployment xml file itself, which seems to be working for me.
So now I get messages that the security is being implemented during deployment time. However I have two new issues:
1. I am getting the following error during deployment time:[ServiceController] Problem creating service jboss.j2ee:service=EJB3,module=ejb3Test.par java.lang.SecurityException: Invalid authentication attempt, principal=null
2. The LoginContext fails to initialize with "client-login" and says:creating login context failed: javax.security.auth.login.LoginException: No LoginModules configured for client-login
-
2. Re: SecurityDomain with EJB3.0
yantriki Jan 18, 2006 11:21 AM (in response to yantriki)
I fixed it with the following META-INF/jboss-service.xml configuration file:<?xml version="1.0" encoding="UTF-8"?> <server> <mbean code="org.jboss.security.auth.login.DynamicLoginConfig" name="corview:service=CORViewJAASService"> <attribute name="PolicyConfig" serialDataType="jbxb"> <jaas:policy xsi:schemaLocation="urn:jboss:security-config:4.1 resource:security-config_4_1.xsd" xmlns:jaas="urn:jboss:security-config:4.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" > <jaas:application-policy name="corview"> <jaas:authentication> <jaas:login-module code="org.vss.security.auth.spi.VssLoginModule" flag="required"> <jaas:module-option name="unauthenticatedIdentity">guest</jaas:module-option> </jaas:login-module> </jaas:authentication> </jaas:application-policy> </jaas:policy> </attribute> <depends optional-attribute-name="LoginConfigService"> jboss.security:service=XMLLoginConfig </depends> <depends optional-attribute-name="SecurityManagerService"> jboss.security:service=JaasSecurityManager </depends> </mbean> <mbean code="org.jboss.security.auth.login.DynamicLoginConfig" name="corview:service=CORViewClientJAASService"> <attribute name="AuthConfig">META-INF/clientlogin.properties</attribute> <depends optional-attribute-name="LoginConfigService"> jboss.security:service=XMLLoginConfig </depends> <depends optional-attribute-name="SecurityManagerService"> jboss.security:service=JaasSecurityManager </depends> </mbean> </server>
Where the clientlogin.properties is the security policy file as described by SUN spec: -
3. Re: SecurityDomain with EJB3.0
yantriki Jan 18, 2006 11:22 AM (in response to yantriki)The Session Bean uses @SecurityDomain("corview")