WS call is returning Status 403 - Access to the requested resource has been denied

[fernando.rubbo]

Hi

I'm facing an issue whenever a WS call (which have a security context) is being made. The problem is:

• When user/pass are not provided by the client the server respond:
  • HTTP Status 401 -This request requires HTTP authentication () 
• Whe user/pass are provided the server respond:
  • HTTP Status 403 - Access to the requested resource has been denied 
• In Jboss 4.2 it works as expected.

I've attached two files. A EJB project and the standalone.xml.

This is an issue or it have changed from Jboss 4.3?

Thanks,

Fernando Rubbo

[asoldano]

For the records, https://issues.jboss.org/browse/AS7-5732 has been created; see comments on resolution there.

[fernando.rubbo]

The solution seems to be a hack, but it works.

In all WS classes, allow only 'user' role:

@DeclareRoles("user")@RolesAllowed("user")

@Stateless

@SecurityDomain("test")

@WebService(name = "HelloSoap", portName = "HelloSoapPort", serviceName = "HelloSoap", targetNamespace = "http://com.test")

@WebContext(contextRoot = "/ws", urlPattern = "/HelloSoap", secureWSDLAccess = false, authMethod = "BASIC", transportGuarantee = "NONE")

public class HelloSoap {...}

In the login module implementation, add in roles the 'user' role.

  protected Group[] getRoleSets() throws LoginException {       

        Group[] roleSets = {new SimpleGroup("Roles"), new SimpleGroup("CallerPrincipal")};

          ....

        roleSets[0].addMember(new SimplePrincipal("user"));

        return roleSets;

    }

hope it will be fixed in the future.

Thanks