Problems with different permissions for Local- and Remote-In

[ralle]

It seems, that's JBoss (Version 4.2.3) cannot handle different permissions for the local and the remote interface of an Ejb-Method.
Here is my example.

<method-permission>


<ejb-name>SbExampleBean</ejb-name>
<method-intf>Local</method-intf>
<method-name>*</method-name>

</method-permission>
<exclude-list>

<ejb-name>SbExampleBean</ejb-name>
<method-intf>Remote</method-intf>
<method-name>*</method-name>

<exclude-list>

----


<security-domain>ExampleDomain</security-domain>
<enterprise-beans>

<ejb-name>SbExampleBean</ejb-name>

</enterprise-beans>


With this configuration JBoss permits remote access to the Bean, but i want local access only to the bean.

Is this a bug or is there something wrong with the configuration?

[wolfgangknauf]

Hi,

please post the full snippet of your "method-permission" section. Wrap the xml snippet in "[ code ]"-Tags (see advanced editor for forum posts.

Best regards

Wolfgang

[ralle]

That's an extract from the XML-Descriptor:

<ejb-jar xmlns="http://java.sun.com/xml/ns/javaee"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/ejb-jar_3_0.xsd"
 version="3.0">

 <enterprise-beans>
 <session>
 <ejb-name>SbExampleBean</ejb-name>
 <business-local>Komponente.SbExampleBeanLocal</businesslocal>
 <business-remote>Komponente.SbExampleBeanRemote</business-remote>
 <ejb-class>Komponente.SbExampleBean</ejb-class>
 </session>
 </enterprise-beans>
 <assembly-descriptor>
 <method-permission>
 <unchecked/>
 <method>
 <ejb-name>SbExampleBean</ejb-name>
 <method-intf>Local</method-intf>
 <method-name>*</method-name>
 </method>
 </method-permission>

 <exclude-list>
 <method>
 <ejb-name>SbExampleBean</ejb-name>
 <method-intf>Remote</method-intf>
 <method-name>*</method-name>
 </method>
 </exclude-list>
 </assembly-descriptor>
</ejb-jar>

When a local method is called, an EJBAccessException occurs. I recognized in a JBoss-Trace, that a "NOBODY"-Role is required for the principal in this case. That's not what I'm expected.


Thanks Ralf

[wolfgangknauf]

Hi,

to my understanding, the user has to be authenticated even when accessing unsecured methods, because you specifiy a security domain in "jboss.xml".

I found a rather old thread, where someone tried to achieve the same as you do: http://www.jboss.org/index.html?module=bb&op=viewtopic&p=3960447, but through annotations. Maybe you find helpful information. And maybe the limits of this threads are no longer present.

Best regards

Wolfgang