how to enable IdentityTrust for ejbs?

[duane3]

org.jboss.security.integration.JNDIBasedSecurityManagement  is used in ejbs. IdentityTrust is disabled by default. From  JNDIBasedSecurityManagement.java:

/** Enable the IdentityTrust  feature */
   protected boolean enableIdentity = false;

I want to  use the IdentityTrust feature in ejbs. How to enable it?

Thanks for  your help.

[duane3]

Here is the background:

We need develop a runas API on JBoss, which  accepts a  user name as input:

SubjectSecurity.executeAs(String  username,  PrivilegedAction<T>action);

There is no such API on JBoss  so we decide to create  it ourselves.

In the method above, we construct a  JBoss subject  based on the user name, create a new security context and  set it as  current security context, and save the subject in current  security  context.

Now comes the problem: on accessing a secure ejb  from  the passed in PrivilegedAction object, authorization fails. I  specified  role mapping in jboss.xml (see  http://community.jboss.org/wiki/MappingRolesinJBossApplicationServerv5x)   and the role was granted to access the ejb in ejb-jar.xml.

I checked  JBoss's source code. On accessing ejb,  before authorization, JBoss will  validate current security context  first. The security context is  validated like this:

isValid =  validate current security context  using current identity trust manager;

if (!isValid) {

    invoke JAAS login(principal from  current security context, credential  from current security context);

}

For ejbs, current identity trust  manager is always  null because by default the IdentityTrust feature is  disabled in  JNDIBasedSecurityManagement. So isValid is false. There is  no credential  in current security context, and so JAAS login fails,  too.

I  have two approaches:

approach 1: implement a custom identity  trust module to validate  the security context

approach 2: save  the credential in the security context

Approach 2 is simpler. However, as  there is no  credential/password from the user's input, I need fetching  credential  from identity stores (usually LDAP servers). For some types  of LDAP  servers, fetching users' credentials is forbidden.

So approach 1  is the only choice.

Now the problem is the IdentityTrust feature is  disabled  by default in JNDIBasedSecurityManagement which is used in ejbs  and it  looks to me there is no way to enable it.