Problem with JNDI security - please help

[alexserbul]

Good day! I read in JBoss4 App.Server Guide that "Subcontexts and object bindings directly under java: are only visible within the JBoss server virtual machine and not to remote clients." But when my LOCAL client connects to REMOTE jboss4 server:

Hashtable<String,String> env = new Hashtable<String,String>();
env.put("java.naming.factory.initial","org.jnp.interfaces.NamingContextFactory");
env.put("java.naming.provider.url","jnp://"+args[1]);
env.put("java.naming.factory.url.pkgs","org.jboss.naming:org.jnp.interfaces");
iniCtx = new InitialContext(env);
NamingEnumeration ne = NamingEnumeration) iniCtx.list("java:");
while (ne.hasMore()) log.info(ne.next());
CMDBSHome thome = (CMDBSHome) iniCtx.lookup("CMDBSBean");
log.info(thome);
CMDBS tobj = (CMDBS) thome.create();
log.info(tobj);
log.info(tobj.start());

i simply can create and invoke methods on REMOTE ejb residing in java: context. Please answer, why?

[darranl]

I don't understand your problem, the code example you have posted is performing a lookup in the global namespace not the java: namespace.

[alexserbul]

Thank you very much! Really, by default jboss deployed my EJBs in global context. So to hide them in local JBoss server I need explicitly deploy them to java:.

[darranl]

If you are trying to hide the beans so they are only accessible remotely why are you establishing a remote connection to lookup the beans? The lookup will not work which is what you wanted!

[alexserbul]

No. I want to hide my beans in JBoss from outside, but make them accessible inside JBoss. So, to test that they are not visible outside i list global JNDI context from remote client. As I understood, to make EJBs visible only inside JBoss server I need to deploy them in java: context. Is it correct?