getClientHost() works in EJB

[guy_rouillier]

Copying some old RMI code I'd written, I tried

String aHost = java.rmi.server.UnicastRemoteObject.getClientHost();

in an EJB and it works. I tried a Unix client and a Windows client accessing an EJB on a Windows box and got the correct client IP address both times. Can I rely on this, or did I just get lucky? (i.e., hit some fluke)

[adrian.brock]

This might not be supported in future?

Currently in JBoss the same thread that accepts the
rmi request, calls the bean. This might be changed
in a future version.

Regards,
Adrian

[guy_rouillier]

Is there then a way to accomplish the same thing in a way that won't break? i.e., is there a "right" way to do this?

[adrian.brock]

What are you trying to do with ip address?

Regards,
Adrian

[guy_rouillier]

We have a sensitive application. One of the security checks that we do is to make sure that our methods are being invoked from a "known host".

[adrian.brock]

You shouldn't really code security into the bean.
Especially, since it won't catch all methods.
Some of the methods are implemented by the
container (your code in the bean won't stop these).

If you want to deny access from an ip address have a
look at
http://www.jboss.org/online-manual/HTML/ch13s131.html
add a customized socket that only accepts certain
ip addresses.

This puts your check in the RMI layer which will
always allow your code. It will also trap all access.

Regards,
Adrian

[guy_rouillier]

Adrian, thanks - haven't checked back in awhile. This entire EJB is an authentication/authorization module. We'll have methods like authenticate(userid, password) and isApplicationEnabled(userid, appplid). I'm aware of (but not conversant in) the security mechanism in the EJB framework, but we want something that will work for all our applications, and is more fine-grained than just roles. So we are rolling our own. Rather than filter out unknown hosts at the RMI level, I'd rather let them through then reject them through our standard hierarchy of exceptions.