Equivalent of ear-subdeployments-isolated true/false

[kennardconsulting]

Hi there,

I have an EAR containing multiple EJB JARs and WARs. It deploys fine with <ear-subdeployments-isolated>false</ear-subdeployments-isolated> (the WildFly default) in jboss-deployment-structure.xml. To improve security I want to change ear-subdeployments-isolated to true.

Of course this breaks deployment.

So I go through all my EJB JARs and add Dependencies to the other EJB JARs in their MANIFEST.MF. But it still doesn't deploy.

What steps should I take (dependencies to add, configs to change etc) to make the true version the equivalent of the false version?

[zhurlik]

Hi,

You can look at

Class Loading in WildFly - WildFly 10 - Project Documentation Editor

Thanks,

Vlad

[kennardconsulting]

Thanks for trying to help, but the official documentation is not sufficient.

I figured it out: you have to add META-INF/MANIFEST.MF dependencies in every EJB JAR. These dependencies must link to all other EJB JARs, including making circular dependencies. This must be what WildFly does by default.

After that, you can start pruning and streamlining dependencies.

[jaikiran]

If you mean, you want the EJB _interfaces_ accessible from other sub-deployments of the same application, then you can package those interfaces into individual jar files and place them under the lib directory of the .ear (if there isn't a lib directory at the root of the .ear, create one). Be sure to include just the interfaces and not the implementations of the EJBs. The implementations of the EJBs should be packaged separately and place at the root of the .ear.

Having said that, the ear-subdeployments-isolated attribute uses a sensible default for reasons like this - to allow sub deployments to have access to the resource loaded by the classloader of these individual sub-deployments. There isn't any security issue with it. These resources/classes aren't in any way accessible outside of the top level (.ear) deployment.