Security Domain

[beckers]

Hi,

I'm porting an application from 6.0.0 to 7.0.0. I got most things working. There's a bug with oracle and hibernate 4. Another thing is, that protecting my stateless session bean is not working anymore.

I got the security domain in jboss-web.xml and jboss.xml, in the web container it's working. Accessing a protected page triggers my form login and I'm logged in.

My stateless session bean can be called no matter if I have no annotation, @DenyAll or a @RolesAllowed("some role i dont have").

Do I need to change or add a configuration or is it a bug?

Yours,

Andreas

[jaikiran]

Have you added @org.jboss.ejb3.annotation.SecurityDomain on the EJB?

[beckers]

Hi Jaijkiran,

No, I didn't have. Now I added that annotation and it seems to work.

So the jboss.xml isn't evaluated any more?

I don't like it having jboss specific annotations in my code. Is there a way to tell it in a cofiguration file, as before in the jboss.xml?

Thanks,

Andreas

[jaikiran]

We'll add support for jboss.xml in the upcoming releases.

[jean.baldessar]

beckers, could you access the caller principal from inside your stateless session bean?

I'm having a similar problem with authentication in the EJB tier: here is the post

thanks

[beckers]

With the @SecurityDomain I can access the caller principal. I don't use ajax.

[jean.baldessar]

thanks beckers.

I made a simple sample application to explain my problam and it worked.

Now a got to find whats diferent in my production application.

When I find the problem i'll post it for the community