JAAS

[silenius]

Hello all,

I'm trying to make Embedded JBoss work without success.
Each time I try to call a protected EJB3 method I get the following error:

javax.ejb.EJBAccessException: Caller unauthorized
 at org.jboss.ejb3.security.RoleBasedAuthorizationInterceptorv2.invoke(RoleBasedAuthorizationInterceptorv2.java:184)
 at org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:101)
 at org.jboss.ejb3.security.Ejb3AuthenticationInterceptorv2.invoke(Ejb3AuthenticationInterceptorv2.java:166)
 at org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:101)
 at org.jboss.ejb3.ENCPropagationInterceptor.invoke(ENCPropagationInterceptor.java:46)
 at org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:101)
 at org.jboss.ejb3.asynchronous.AsynchronousInterceptor.invoke(AsynchronousInterceptor.java:106)
 at org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:101)
 at org.jboss.ejb3.stateless.StatelessContainer.localInvoke(StatelessContainer.java:249)
 at org.jboss.ejb3.stateless.StatelessContainer.localInvoke(StatelessContainer.java:214)
 at org.jboss.ejb3.stateless.StatelessLocalProxy.invoke(StatelessLocalProxy.java:86)
 at $Proxy83.insertClient(Unknown Source)
 at my.package.business.ClientAdministrationServiceBeanTest.insertClient(ClientAdministrationServiceBeanTest.java:109)

My SessionBean looks like this:

@Stateless
@Local(ClientAdministrationService.class)
@LocalBinding(jndiBinding = "clientAdministrationService")
@SecurityDomain("MyRealm")
@RunAs("private")
public class ClientAdministrationServiceBean implements ClientAdministrationService {

 @EJB
 ClientDAO clientDAO;

 @PermitAll
 @TransactionAttribute(value = TransactionAttributeType.REQUIRED)
 public Client insertClient(Client client){
 client.setStatus(Status.ENABLE);

 return clientDAO.insert(client);
 }
 ...
}

My test class (using TestNG) looks like this:

public class ClientAdministrationServiceBeanTest {

 private static final Logger LOGGER = LoggerFactory.getLogger(ClientAdministrationServiceBeanTest.class);

 private static ClientAdministrationService service;

 private SecurityClient securityClient;

 @BeforeClass
 public void setUp() throws Exception {
 try {
 if (!Bootstrap.getInstance().isStarted()) {
 Bootstrap.getInstance().bootstrap();
 Bootstrap.getInstance().scanClasspath("classes");
// Bootstrap.getInstance().deploy(makeURLForDir("target/classes"));
// String resource = "META-INF/persistence.xml";
// Bootstrap.getInstance().deployResourceBase(resource);
 }
 } catch (DeploymentException e) {
 LOGGER.error(e.getMessage(), e);
// } catch (IOException e) {
// LOGGER.error(e.getMessage(), e);
 }
 securityClient = SecurityClientFactory.getSecurityClient();
 securityClient.setSimple("admin", "test");
 securityClient.login();
// SecurityAssociation.setPrincipal(new SimplePrincipal("admin"));
// SecurityAssociation.setCredential("test".toCharArray());
 InitialContext ctx = new InitialContext();
 service = (ClientAdministrationService) ctx.lookup("clientAdministrationService");
 }

 @AfterClass
 public void tearDown() throws Exception {
 securityClient.logout();
 if (System.getProperty("shutdown.embedded.jboss") != null) {
 Bootstrap.getInstance().shutdown();
 }
 }
 ...
}

If I remove the annotation @SecurityDomain("MyRealm") from my Session Bean the code works fine.

Is there a way to use a self defined JAAS domain policy inside my EJB3 with Embedded JBoss?

Thanks, kind regards,
Samuel Santos

[silenius]

Since I didn't find any proper way to make this work, here is a possible workaround for Maven.

Create a jboss.xml file and place it under src/main/resources:

{code:xml}
<!DOCTYPE jboss PUBLIC
    "-//JBoss//DTD JBOSS 5.0/EN"
    "http://www.jboss.org/j2ee/dtd/jboss_5_0.dtd">
<jboss>
    <security-domain></security-domain>
</jboss>
{code}

Exclude jboss.xml from your normal build process:

{code:xml}
<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-ejb-plugin</artifactId>
    <configuration>
        <excludes>
            <exclude>META-INF/jboss.xml</exclude>
        </excludes>
    </configuration>
</plugin>
{code}

This will override @SecurityDomain so you can call any protected bean/method.

[eiselejosef]

Hi Samuel,

it is very sad there is no support for this JBoss embedded container any more. Quite easy from JBoss to say (from: http://community.jboss.org/wiki/embeddedjboss)

     "Note: This implementation is retired. "

We did all our Tests for JBoss 5 in this embedded container and after we switched on security we can't test any more :-(

I tried everything what I know to login to the container and as far I know this was successful, see Log:

TRACE [org.jboss.security.auth.spi.UsersRolesLoginModule] login
TRACE [org.jboss.security.auth.spi.UsersRolesLoginModule] Authenticating as unauthenticatedIdentity=lwk
TRACE [org.jboss.security.auth.spi.UsersRolesLoginModule] User 'test' authenticated, loginOk=true
TRACE [org.jboss.security.auth.spi.UsersRolesLoginModule] commit, loginOk=true
TRACE [org.jboss.security.auth.spi.UsersRolesLoginModule] Checking user: test, roles string: Role1
TRACE [org.jboss.security.auth.spi.UsersRolesLoginModule] Adding to Roles: Role1

but later.

javax.ejb.EJBAccessException: Caller unauthorized
    at org.jboss.ejb3.security.RoleBasedAuthorizationInterceptorv2.invoke(RoleBasedAuthorizationInterceptorv2.java:184)

I gave up finding a way to get this running using client code.

I would like to use your workaround with Maven, maybe you could help me with this because I used so far only the provided ZIP-Download.

My Test with Maven was not successful: I downloaded from http://anonsvn.jboss.org/repos/jbossas/branches/EMBEDDED_JBOSS_BETA3 and I started mvn for the pom.xml. But I receive a lot of errors:

org.apache.maven.reactor.MavenExecutionException: Cannot find parent: org.jboss:
jboss-parent for project: org.jboss.jbossas:jboss-as-aggregate:pom:5.0.0-SNAPSHO
T for project org.jboss.jbossas:jboss-as-aggregate:pom:5.0.0-SNAPSHOT

Would you mind helping me on that?

Thanx in advance

Josef

[silenius]

Hi Joseff,

Off the top of my head, these are the steps you need to do to configure it with Maven:

1. Download jboss-embedded-beta3.SP12-bin.zip;
2. Extract it, and copy the folder embedded-jboss-beta3.SP12/bootstrap into YOUR_MAVEN_PROJECT/src/test/resources;
3. Add the dependencies jboss-embedded-beta3.SP12.jar, jboss-embedded-all-beta3.SP12.jar, hibernate-all-beta3.SP12.jar, and thirdparty-all-beta3.SP12.jar to your POM;
   2. <dependencies>
          ...
          <dependency>
              <groupId>org.jboss.embedded</groupId>
              <artifactId>jboss-embedded-all</artifactId>
              <version>beta3.SP12</version>
              <scope>test</scope>
          </dependency>
          <dependency>
              <groupId>org.jboss.embedded</groupId>
              <artifactId>hibernate-all</artifactId>
              <version>beta3.SP12</version>
              <scope>test</scope>
          </dependency>
          <dependency>
              <groupId>org.jboss.embedded</groupId>
              <artifactId>thirdparty-all</artifactId>
              <version>beta3.SP12</version>
              <scope>test</scope>
          </dependency>
          ...
      </dependencies>
      
4. Finally, bootstrap it as I'm doing in my first post above.

1. try {
       if (!Bootstrap.getInstance().isStarted()) {
           LOGGER.info("Jboss Embedded started!");
           Bootstrap.getInstance().bootstrap();
           Bootstrap.getInstance().scanClasspath("classes");
       }
   } catch (DeploymentException e) {
       LOGGER.error(e.getMessage(), e);
   } catch (Exception e) {
       LOGGER.error(e.getMessage(), e);
   }
   

Cheers,

Samuel

[eiselejosef]

Hi Samuel,

I remember a 2h workshop for using maven, but I think that was not enough to understand your answer...

At the moment I used ANT-Build Files to build everything necessary from the sources I have checked out from SVN (http://anonsvn.jboss.org/repos/jbossas/branches/EMBEDDED_JBOSS_BETA3). As far I see in the build.xml

...

<property name="embedded.version" value="embedded-jboss-beta3.SP12"/>

...

it is your SP12 Version. I commented the exception in RoleBasedAuthorizationInterceptorv2.java and now everything works without JAAS :-)

But I would like to understand your way to solve the problem. I have the following questions:

2) Which folder do you mean? ..\EMBEDDED_JBOSS_BETA3\embedded\src\test\resources ?

3) Which POM ? ..\EMBEDDED_JBOSS_BETA3\pom.xml ?

4) What do you mean with bootstrap ?

Maybe you could give me your pom.xml and the mvn-command you used?!

Thank you very much in advance.

Kind regards

Josef

[silenius]

Hi Josef,

I've edited my previous post.

Hopefully it will be a lot clearer now.

[eiselejosef]

Thank you very much for your answer I will try this next time I'm working in this project.

cu Josef

[alrubinger]

Josef Eisele wrote:

it is very sad there is no support for this JBoss embedded container any more. Quite easy from JBoss to say (from: http://community.jboss.org/wiki/embeddedjboss)

     "Note: This implementation is retired. "

Hi guys:

I can empathize with your frustration, but we had to go another path for Embedded usage of the AS.  The older implementation essentially was a fork, so what we've now done is added lifecycle and deployment APIs to AS itself.  Another thing we're now working hard on is the Embeddable EJB3 Container (as defined by the EJB 3.1 Specification Chapter 22).  This one takes a different approach as we bootstrap a small (read: quick) runtime and enable more rapid deployment.  When we couple these with the flexibility and power of ShrinkWrap and Arquillian, we'll be left with a solution which is fast, runnable from the IDE without any extra config, and reduces tons of boilerplate from your test code.

For now I think you might benefit from looking at the Embedded APIs that are about to ship with JBossAS 6.0.0.M3.  In time for the release I'll be providing a more expansive Wiki and Examples section, but for now:

http://anonsvn.jboss.org/repos/jbossas/projects/embedded/examples/trunk/

S,

ALR