1 2 Previous Next 17 Replies Latest reply on Jan 30, 2012 1:09 AM by sfcoy

@RolesAllowed, @DenyAll require presence of org.jboss.ejb3.annotation.SecurityDomain?

sfcoy Jan 21, 2012 9:41 PM

Hi there,

I've been developing some Arquillian tests that test some code that use @RolesAllowed, @DenyAll annotations and friends.

It seems that these annotations only work if the class is also annotated with @org.jboss.ejb3.annotation.SecurityDomain.

EJBContext.isCallerInRole(java.lang.String) and EJBContext.getCallerPrincipal() seem to work just fine without this.

Is that the expected behaviour?

This is for a planned Arquillian article on testing secured components.

Thanks

1. Re: @RolesAllowed, @DenyAll require presence of org.jboss.ejb3.annotation.SecurityDomain?

sfcoy Jan 21, 2012 10:44 PM (in response to sfcoy)

OK, so I found JBoss AS7: Security : EJB3 Security which seems to partially answer the question.

Adding a security-domain element to a jboss-web.xml file (I'm deploying the test as a WebArchive) doesn't seem to make any difference though.
1 of 1 people found this helpful
Actions
2. Re: @RolesAllowed, @DenyAll require presence of org.jboss.ejb3.annotation.SecurityDomain?

jaikiran Jan 22, 2012 12:08 AM (in response to sfcoy)
You don't need the annotation but you can just add security-domain element to either the jboss-ejb3.xml, jboss-web.xml or jboss-app.xml (depending on the application packaging).

Stephen Coy wrote:

Adding a security-domain element to a jboss-web.xml file (I'm deploying the test as a WebArchive) doesn't seem to make any difference though.
What does the ShrinkWrap code look like? You could also print out the contents of that archive as follows:

System.out.println("Contents of war: " + webArchive.toString(true));
Actions

3. Re: @RolesAllowed, @DenyAll require presence of org.jboss.ejb3.annotation.SecurityDomain?

sfcoy Jan 22, 2012 12:40 AM (in response to jaikiran)

jaikiran pai wrote:

...

What does the ShrinkWrap code look like?

WebArchive: test.war:
/WEB-INF/
/WEB-INF/jboss-web.xml
/WEB-INF/web.xml
/WEB-INF/classes/
/WEB-INF/classes/users.properties
/WEB-INF/classes/org/
/WEB-INF/classes/org/jboss/
/WEB-INF/classes/org/jboss/arquillian/
/WEB-INF/classes/org/jboss/arquillian/secureejb/
/WEB-INF/classes/org/jboss/arquillian/secureejb/JBossLoginContextFactory$JBossJaasConfiguration.class
/WEB-INF/classes/org/jboss/arquillian/secureejb/demo/
/WEB-INF/classes/org/jboss/arquillian/secureejb/demo/SecureSessionBean.class
/WEB-INF/classes/org/jboss/arquillian/secureejb/JBossLoginContextFactory$NamePasswordCallbackHandler.class
/WEB-INF/classes/org/jboss/arquillian/secureejb/JBossLoginContextFactory.class
/WEB-INF/classes/roles.properties

I suspect that this has something to do with the fact that I'm doing a JAAS login.

4. Re: @RolesAllowed, @DenyAll require presence of org.jboss.ejb3.annotation.SecurityDomain?

jaikiran Jan 22, 2012 12:45 AM (in response to sfcoy)

Or maybe it might be a bug. Can you try packaging the EJBs in a .jar and putting that .jar in the .war/WEB-INF/lib? Then in the EJB .jar, include a META-INF/jboss-ejb3.xml with the security-domain element. I suspect the EJBs are ignoring the security-domain element because it has been specified in the jboss-web.xml (for web components).
Actions
5. Re: @RolesAllowed, @DenyAll require presence of org.jboss.ejb3.annotation.SecurityDomain?

sfcoy Jan 22, 2012 12:48 AM (in response to jaikiran)

I thought of trying that but I didn't think an EJB jar could be placed in WEB-INF/lib.

I'll try it right now
Actions
6. Re: @RolesAllowed, @DenyAll require presence of org.jboss.ejb3.annotation.SecurityDomain?

sfcoy Jan 22, 2012 1:01 AM (in response to jaikiran)
Doing this has the same result.

Demo attached FYI

arquillian-security-demo.zip 21.4 KB
Actions
7. Re: @RolesAllowed, @DenyAll require presence of org.jboss.ejb3.annotation.SecurityDomain?

sfcoy Jan 22, 2012 2:03 AM (in response to sfcoy)

Stephen Coy wrote:

I thought of trying that but I didn't think an EJB jar could be placed in WEB-INF/lib.
§20.2 of the EJB 3.1 spec says:
In a .war file, the deployment descriptor is stored with the name WEB-INF/ejb-jar.xml or the name META-INF/ejb-jar.xml in a .jar file within WEB-INF/lib.
so it should work fine.

It does beg the question as to whether or not jboss-ejb3.xml can also be placed in the WEB-INF directory, but that's wandering off topic.
Actions

8. Re: @RolesAllowed, @DenyAll require presence of org.jboss.ejb3.annotation.SecurityDomain?

jaikiran Jan 23, 2012 6:40 AM (in response to sfcoy)

I haven't been able to try that application. But the jboss-ejb3.xml doesn't look right. Can you try changing its contents to (let it remain in its current location of .jar/META-INF):

<?xml version="1.0"?>  
<jboss:ejb-jar xmlns:jboss="http://www.jboss.com/xml/ns/javaee"
                  xmlns="http://java.sun.com/xml/ns/javaee"
                  xmlns:s="urn:security"
                  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                  xsi:schemaLocation="http://www.jboss.com/xml/ns/javaee http://www.jboss.org/j2ee/schema/jboss-ejb3-2_0.xsd
                     http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/ejb-jar_3_1.xsd"
                  version="3.1"
                  impl-version="2.0">

    <s:security>
      <ejb-name>*</ejb-name>
      <s:security-domain>other</s:security-domain>
    </s:security>


</jboss:ejb-jar>

9. Re: @RolesAllowed, @DenyAll require presence of org.jboss.ejb3.annotation.SecurityDomain?

sfcoy Jan 23, 2012 7:59 AM (in response to jaikiran)

That did not help I'm afraid.

Right now I'm wondering if the jboss-ejb3.xml is even being parsed. I put some junk in it but there were no deployment errors.
Actions
10. Re: @RolesAllowed, @DenyAll require presence of org.jboss.ejb3.annotation.SecurityDomain?

sfcoy Jan 23, 2012 7:13 PM (in response to jaikiran)
I have debugged this to some extent.

Deployment descriptors in WEB-INF/lib jars are not processed at all. That would be a bug. Presumably ejb-jars should be detected here and processed as subdeployments, but they are not.

However, jboss-ejb3.xml is parsed when it is present in the WEB-INF directory which answers the question above.

Unfortunately the parser seems to know nothing about the urn:security namespace and barfs on that xml.

In fact {color:blue}org.jboss.metadata.ejb.parser.jboss.ejb3.Namespace{color} is only aware of the http://www.jboss.com/xml/ns/javaee and http://java.sun.com/xml/ns/javaee namespaces, so I think this is another bug.
Actions

11. Re: @RolesAllowed, @DenyAll require presence of org.jboss.ejb3.annotation.SecurityDomain?

swd847 Jan 24, 2012 12:07 AM (in response to sfcoy)

I belive Jaikirens code should actually be:

<?xml version="1.0"?>  
<jboss:ejb-jar xmlns:jboss="http://www.jboss.com/xml/ns/javaee"
                  xmlns="http://java.sun.com/xml/ns/javaee"
                  xmlns:s="urn:security"
                  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                  xsi:schemaLocation="http://www.jboss.com/xml/ns/javaee http://www.jboss.org/j2ee/schema/jboss-ejb3-2_0.xsd
                     http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/ejb-jar_3_1.xsd"
                  version="3.1"
                  impl-version="2.0">
  <assembly-descriptor>
    <s:security>
      <ejb-name>*</ejb-name>
      <s:security-domain>other</s:security-domain>
    </s:security>
  </assembly-descriptor>

</jboss:ejb-jar>

12. Re: @RolesAllowed, @DenyAll require presence of org.jboss.ejb3.annotation.SecurityDomain?

sfcoy Jan 24, 2012 12:15 AM (in response to swd847)

Adding the assembly descriptor worked when the jboss-ejb3.xml is in WEB-INF/lib.

I suspect that
Deployment descriptors in WEB-INF/lib jars are not processed at all. That would be a bug. Presumably ejb-jars should be detected here and processed as subdeployments, but they are not
may still be an (off topic) problem.

Thanks for your time guys.
Actions
13. Re: @RolesAllowed, @DenyAll require presence of org.jboss.ejb3.annotation.SecurityDomain?

jaikiran Jan 24, 2012 12:44 AM (in response to swd847)

Ah right, I missed that assembly-descriptor part!

I'll come back to this later this week, because I think this misconfigured jboss-ejb3.xml should have thrown an error.
Actions
14. Re: @RolesAllowed, @DenyAll require presence of org.jboss.ejb3.annotation.SecurityDomain?

sfcoy Jan 24, 2012 1:29 AM (in response to jaikiran)

jaikiran pai wrote:

Ah right, I missed that assembly-descriptor part!

I'll come back to this later this week, because I think this misconfigured jboss-ejb3.xml should have thrown an error.

It did throw an error when placed in the WEB-INF directory. I did mention it:
Stephen Coy wrote:

Unfortunately the parser seems to know nothing about the urn:security namespace and barfs on that xml.

Deployment descriptors in WEB-INF/lib jars do not seem to get parsed at all however.
Actions

1 2 Previous Next

Go to original post