jboss-ejb-policy and jboss-web-policy: why are there?

[sebek64]

I was unable to determine why the default jboss configuration contains security domains jboss-web-policy and jboss-ejb-policy. It seems to me that they were used in jboss-6.0 days, but now this is no longer the case. It so, It think I'd be a good idea to remove them, as they only cause confusion to people who configure authorization for EJBs.

[jaikiran]

Good point! I don't really know why those were added and don't know where they are used. Can you please file a JIRA for this?

[sebek64]

Done: https://issues.jboss.org/browse/AS7-5319

[sebek64]

After some time I used the configuration without these security domains, I ran into problems: https://community.jboss.org/thread/213041 These domains are used internally by picketbox and at least newer jboss requires them to work correctly.