javax.ejb.EJBAccessException: Caller unauthorized when calling EJB3 @Service from client code

[dbredesen]

Hello,

I'm building an application on JBoss AS 5.1 and ICEFaces.  The application runs in a single JBoss instance currently.  I'm doing authentication via JAAS, using the DatabaseServerLoginModule, and I'm able to login successfully via ICEFaces as follows:

     CallbackHandler cb = new Handler("someuser", password);

     LoginContext lc = new LoginContext("foo", cb);

     lc.login();

Once logged in, I can see clearly that "someuser" has the "admin" role.  Now, I have an EJB set up as follows:

     @Service

     @Local

     @SecurityDomain("foo") // corresponds to the security domain above

     public class MyService implements MyServiceLocal {

         @RolesAllowed("admin")

         public void doSomething() {

               // do something

         }

     }

I am trying to call MyBean.doSomething() from my ICEFaces client code as follows:

    InitialContext ctx = new InitialContext();

    final String name = "MyService/local";

         service =  (MyServiceLocal) ctx.lookup(name);

         service.doSomething();  // causes EJBAccessException: Caller unauthorized

Somehow, the callee doesn't recognize that I am authenticated.  I did a bit of debugging, and the caller thinks my principal is "anonymous".

How do I get EJB to recognize my credentials which were established outside of EJB?  Do I need to pass some extra information to the InitialContext? (I tried setting Context.SECURITY_PRINCIPAL, with no luck...).  Any help would be appreciated!

Thanks,

Dave Bredesen

[jaikiran]

What does your "foo" login config look like? Do you have ClientLoginModule in that foo stack?

[dbredesen]

Jaikiran,

Thanks for you response.  No, I don't have ClientLoginModule in the "foo" policy, just DatabaseServerLoginModule.  However, I do have ClientLoginModule alone in the "client-login" policy, and I have found I can make some progress if I authenticate on the "client-login" domain on the web app and the "foo" domain on the server side.

What is the proper way to set this up?  The web client and EJB server are running in the same container and same server, so they share a login-config.xml.  Should I just add ClientLoginModule to the foo stack? 

Thanks for your help.

Dave

[jaikiran]

Dave Bredesen wrote:

Should I just add ClientLoginModule to the foo stack? 

Yes. That ClientLoginModule is responsible for "propagating" the logged in context. There was a wiki around this. Let me see if I can find it.

[jaikiran]

jaikiran pai wrote:

Yes. That ClientLoginModule is responsible for "propagating" the logged in context. There was a wiki around this. Let me see if I can find it.

See Q3 here http://community.jboss.org/wiki/SecurityFAQ