Inherit security context from application server

[jmbarone]

Hi!

In JEE if you have an authenticaded web app, when you go through the middleware the security context is "copied" and you don't need to authenticate again to apply EJB's security.

I'm using HornetQ inside JBoss 5.1 and it will be really good to inherit authentication from the server, and when you call the method to connect into the queue session, it will happen in the same way. If you want another credentials, you could do the connect with user/password parameters.

For what i see, this is not possible right now, so:

- i need to implement my own HornetQSecurityManager?

- maybe this idea it's on the "coming soon" features? :-)

Thanks and forgive my poor english.

[clebert.suconic]

We have just been using JAAS On JBoss latest versions.

[jmbarone]

That´s ok, but you need to login again inside the middleware.

Also, you can obtain the authenticated user, but not the password from the context (obviously!).

So you need to obtain the password, the same password that the user already entered in the web app, from another source.

That´s the point, i want to connect directly to HornetQ if the current user is already authenticated in the JEE container, the same way the session beans inherits the security info from the web context.

Thanks for your time, Clebert.

(Se vc é brasileiro, vai um cumprimento de um vizinho, eu sou uruguaio)

[ataylor]

also take a look at http://docs.jboss.org/hornetq/2.2.5.Final/user-manual/en/html_single/index.html#d0e7451

[jmbarone]

andy: following your advice i found this text in the user manual (i set the most important in bold):

JBoss can be configured to allow client login, basically this is when a JEE component such as a Servlet or EJB sets security credentials on the current security context and these are used throughout the call. If you would like these credentials to be used by HornetQ when sending or consuming messages then setallowClientLogin to true. This will bypass HornetQ authentication and propgate the provided Security Context. If you would like HornetQ to authenticate using the propogated security then set theauthoriseOnClientLogin to true also.

This means that what i need it's already implemented and it's another case of poor search in the manual :-)

Sorry and thanks for the quick answers and for this excellent software.

[jmbarone]

Hi, i'm here again :-)

I'm trying to audit the business operations in a JEE container and i need to know who's sending data to the queue, without any explicit intervention in the source code (i can't wait for the collaboration of the programmer to set variables or that kind of things).

I check the API and do some tests with hornetq interceptors, but without success, i mean, i can't obtain the authenticated user inside the interceptor directly.

Maybe i'm doing wrong or exists some other way to do this?

Thanks.

[ataylor]

Hi, i'm here again :-)

I'm trying to audit the business operations in a JEE container and i need to know who's sending data to the queue, without any explicit intervention in the source code (i can't wait for the collaboration of the programmer to set variables or that kind of things).

I check the API and do some tests with hornetq interceptors, but without success, i mean, i can't obtain the authenticated user inside the interceptor directly.

Maybe i'm doing wrong or exists some other way to do this?

Sorry, Im not really sure I understand what you are saying, what API are you checking?

[jmbarone]

The hornetQ API, i was searching some class/method to obtain the actual user authenticated, but inside the interceptor.

I find some things, like UserID and ClientID but these properties doesn't refer to the authenticated user in hornetQ.

Thanks Andy.

[ataylor]

we delegate security to the App server so dont have access to it. However you can get the username from the connection info

[jmbarone]

The interceptor receives a RemoteConnection argument.

In which method/class i can find the username?...

[ataylor]

listConnectionsAsJSON on JMSServerControl thru the management API's

[jmbarone]

the management API only offers one static method: getNotificationInfos on JMSServerControlImpl.

i find 2 classes that contains the username info: JMSConnectionInfo or ServerSession, but i cannot see a path from the message or the remoting connection (the parameters of the intercept method) to them.

[ataylor]

the management API only offers one static method: getNotificationInfos on JMSServerControlImpl.

Why does it have to be a static method?

i find 2 classes that contains the username info: JMSConnectionInfo or ServerSession, but i cannot see a path from the message or the remoting connection (the parameters of the intercept method) to them.

Im not sure I understand what your entry point is for doing this, however simply look up the JMSServerControl object and call listConnectionsAsJSON

something like:

String jsonString = jmsServerControl.listConnectionsAsJSON();

JMSConnectionInfo[] infos = JMSConnectionInfo.from(jsonString);

[jmbarone]

Ok, Andy ... i understands before, but what i'm asking is how i instantiate the jmsServerControl instance?...

The constructor needs JMSServerManager and that class needs HornetQServer ... so i'm going deeper and deeper inside the core of HornetQ instantiating core classes by myself.

That's why i'm searching a static method or something like that to reach the right server instance, not a server class instantiated by me.

[ataylor]

just look it up via one of the management API's, either JMX or JMS management, take a look at the user manual