2 Replies Latest reply on Nov 29, 2012 4:03 AM by Jacobo Chamorro

    Jboss 7 + WebJASPIAuthenticator PolicyContext subject is null but request usePrincipal is not

    Jacobo Chamorro Newbie



      I'm having this weird problem. It's not really vital as code is working but it's annoying me.


      After quite some time I have a custom ServerAuthModule working with Jasig's cas login module in my webapp, but now when i try to get the authenticated subject from a CDI SessionScoped bean like this


      subject = (Subject) PolicyContext.getContext("javax.security.auth.Subject.container");


      I keep getting a null subject, while this code


      Principal userPrincipal = externalContext.getUserPrincipal();


      returns a valid user principal. I think this is also why it keeps calling login on my loginmodule when I call a EJB why the SecurityDomain annotaion in it.


      I've done some debuging and it seems the SecurityContextAssociationValve (responsible for putting the authenticated subject in the security context) is being called before the WebJASPIAuthenticator so the user principal is not set in the request by the time the SecurityContextAssociationValve needs it.


      Is this supposed to work like this? If not there's probably some problem with my configuration.



      Hope this makes sense for someone and thanks in advance!