2 Replies Latest reply on Feb 27, 2007 2:52 AM by Mikhail Ryzh

    Security domain definition

    Mikhail Ryzh Newbie

      How I can use my own security domain for EJB endpoint instead of java:/jaas/JBossWS defined in lofin-config.xml?
      I would like to use doman java:/jaas/mydomain.
      The problem is that all my EJBs are in my own security domain.
      The domain is defined in jboss.xml:

      <jboss>
       <security-domain>java:/jaas/mydomain</security-domain>
      ........
      </jboss>

      Also I have domain definition in login-config.xml :
      <application-policy name="mydomain">
       <authentication>
       <login-module code="com.myproject.helper.MyLoginModule"
       flag="required">
       </login-module>
       </authentication>
       </application-policy>

      (MyLoginModule extends AbstractServerLoginModule and creates my own Principal (My Principal) )

      It worked ok under jBoss.NET and axis.
      But now I try to migrate to jBossWS and I do not understand how I have to define my security domain for EJB endpoint.
      I have error in my class MyLoginModule.
      It looks like that <username> and <password> is null while SOAP request.
      Should I define anything else?


        • 1. Re: Security domain definition
          zzcvbgfbgsg dfgdggf Newbie

          you can write the flow
          after the <login module>

          <module-option name = "dsJndiName">java:/dataDS</module-option>
          <module-option name = "principalsQuery">select Password from Users where UserId = ?</module-option>
          </login-module>

          dataDS is the datasource you define .
          Users is table you define in your database ,because the application checks the user name and password.

          • 2. Re: Security domain definition
            Mikhail Ryzh Newbie

            Unfortunately this solution is not possible to use because the all EJB and
            Web services must work in the same security domain.
            My security domain uses my own login module and I
            have to use this login module to authorize the Web service clients.
            So the problem is how I have to configurate the jBoss security to check
            authorization of Web service client by my own LoginModule?