ejb3/seam-gwt-remoting/gwt security integration

[dhartford]

Jboss 4.2.1
Seam 2.0.0.GA

Security with JAAS as layed out here in GWT web app components.xml file:
http://docs.jboss.com/seam/2.0.0.GA/reference/en/html/security.html#d0e7008

*Seam GWT-remoting
*GWT Web Application (i.e. browser/javascript only web client).



JIRA to be opened to attach sample project

Seam @WebService method with @Restrict throws error:
============
10:26:50,616 ERROR [[/sample-ejb3-gwt-client]] Exception while dispatching incom
ing RPC call
org.jboss.seam.security.NotLoggedInException
at org.jboss.seam.security.Identity.checkRestriction(Identity.java:222)
at org.jboss.seam.security.SecurityInterceptor.aroundInvoke(SecurityInte
rceptor.java:38)
at org.jboss.seam.intercept.SeamInvocationContext.proceed(SeamInvocation
Context.java:68)
at org.jboss.seam.intercept.RootInterceptor.invoke(RootInterceptor.java:
106)
at org.jboss.seam.intercept.ClientSideInterceptor.invoke(ClientSideInter
ceptor.java:54)
at org.javassist.tmp.java.lang.Object_$$_javassist_0.gwtTestSecurity(Obj
ect_$$_javassist_0.java)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.
java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces
sorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.jboss.seam.remoting.gwt.GWTToSeamAdapter.callWebRemoteMethod(GWTT
oSeamAdapter.java:100)
at org.jboss.seam.remoting.gwt.GWTService.processCall(GWTService.java:24
6)
at org.jboss.seam.remoting.gwt.GWTService$1.process(GWTService.java:146)

at org.jboss.seam.servlet.ContextualHttpServletRequest.run(ContextualHtt
pServletRequest.java:53)
at org.jboss.seam.remoting.gwt.GWTService.getResource(GWTService.java:13
0)
at org.jboss.seam.servlet.SeamResourceServlet.doGet(SeamResourceServlet.
java:69)
at org.jboss.seam.servlet.SeamResourceServlet.doPost(SeamResourceServlet
.java:86)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:710)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:290)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:206)
at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFi
lter.java:96)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperV
alve.java:230)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextV
alve.java:175)
at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(Securit
yAssociationValve.java:179)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(Authentica
torBase.java:525)
at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValv
e.java:84)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.j
ava:128)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.j
ava:104)
at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedC
onnectionValve.java:157)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineVal
ve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.jav
a:241)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java
:844)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.proce
ss(Http11Protocol.java:580)
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:44
7)
at java.lang.Thread.run(Thread.java:619)

===============

[dhartford]

JIRA: http://jira.jboss.org/jira/browse/JBSEAM-2325

So far, uncovered that the following tag is slightly misleading:

<!-- misleading: apparently exclusive, either authenticate-method OR jaas-config -->
<security:identity authenticate-method="#{authenticator.authenticate}" jaas-config-name="SpringPoweredRealm"/>

should be just:
<security:identity jaas-config-name="SpringPoweredRealm"/>

then maybe something like:
 <event type="org.jboss.seam.postAuthenticate">
 <action execute="#{authenticator.login}"/>
 <action expression="#{authenticator.login}"/>
 </event>

In any event, still getting NotLoggedInException when attempting to call an @Restrict method (and yes, tried exception class="org.jboss.seam.security.NotLoggedInException" approach and that still does not work).

[dhartford]

Authenticator.login approach, the following seems to work ok (once not-logged-inexception occurs, not the postAuthenticate as that event does not seem to be happening):


@In
public Identity identity;
@Resource
private javax.ejb.SessionContext webContext;
....
Principal caller = webContext.getCallerPrincipal();
System.out.println(caller.getName());
System.out.println(identity.getJaasConfigName());

But, all other identity.get*** methods are empty, while the Principal only contains the username but no other information.

[dhartford]

unfortunately, security is a showstopper. Everything else is working great (once java.sql.Date workaround was implemented).

oh well.

[dhartford]

Still putting in a lot of time due to lack of direction/documentation on how to make this security integration happen, with little progress but no actual results.

Any pointers before I abandon Seam/Security integration?

[dhartford]

and sample code is still here: http://jira.jboss.org/jira/browse/JBSEAM-2325