1 2 3 Previous Next 37 Replies Latest reply on Nov 3, 2012 4:21 PM by pgarner

Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

michael_gronau Mar 7, 2012 11:02 AM

Hello,

I'm trying to move our big j2ee application to JBoss 7 (currently using 7.1.1 nightly build). We have configured a SecurityDomain for our ejb's with custom login modules. The domains are configured to use caching with cache-type='default', but it seems this is not working correctly. Every single call (with the same user, who has already authenticated successfully on the client side) to a secured ejb method starts the full authentication process from the beginning, which has a big performance impact to us. Is this a bug, or (hopefully not) by design?

I found this bug, maybe its the same problem? AS7-3498

Best regards,

Michael Gronau

1. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

dlofthouse Mar 7, 2012 11:05 AM (in response to michael_gronau)

I am just testing AS7-3498 now - the description of what is happening in that issue should not be happening. For your remote client are you regularly creating a new connection or is this over the same connection?
Actions
2. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

michael_gronau Mar 7, 2012 11:08 AM (in response to dlofthouse)

Holy sh... what a fast response ;-)

I just create the connection once, lookup the bean once and then call a method in a loop. Every call starts the authentication in the ejb SecurityDomain..
Actions
3. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

dlofthouse Mar 7, 2012 11:14 AM (in response to michael_gronau)

Ok that does sound wrong - there is a situation I am still working on properly using the cache where new connections are created but if the same connection is used you should not be seeing repeated calls to the security domain - can you just show me your realm and domain configuration so I can double check it and I will cover your scenario in my testing.
Actions

4. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

michael_gronau Mar 7, 2012 11:20 AM (in response to dlofthouse)

Ok, here we go:

We have a custom login-module for the remoting connector and another custom LoginModule for EJB Security Domain:

	<security-realm name="ApplicationRealm">
	<authentication>
	<jaas name="jas-remote"/>
	</authentication>
	</security-realm>

	<security-domains>
	<security-domain name="jas-remote" cache-type="default">
	<authentication>
	<login-module code="com.os.ee.security.jboss.JBoss7RemotingLoginModule" flag="optional"/>
	</authentication>
	</security-domain>
	<security-domain name="jas" cache-type="default">
	<authentication>
	<login-module code="com.os.ee.security.jboss.JBoss7ServerLoginModule" flag="required"/>
	</authentication>
	</security-domain>

The caching with the remote connection seems to work, i see authentication only once per connection. Only securityDomain 'jas' is called everytime.

5. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

dlofthouse Mar 7, 2012 11:22 AM (in response to michael_gronau)

Just to be clear - the jas domain, is that the one assigned to your EJB?
Actions
6. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

dastraub Mar 7, 2012 11:29 AM (in response to michael_gronau)

May be the same issue like this https://issues.jboss.org/browse/AS7-3498
Actions
7. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

dlofthouse Mar 7, 2012 12:36 PM (in response to dastraub)

Michael, ok just tested the call from a web app to an EJB as described in the original issue and the cache is being skipped in the EJB tier - for remote clients the call will be passing through the exact same point that is affecting the web app calls so it does appear to be exactly the same issue.

I am just looking now at how large an issue this will be to fix.
Actions
8. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

michael_gronau Mar 8, 2012 2:32 AM (in response to dlofthouse)

Ok, Darran, thanks alot. Hope you can find a solution.

Michael
Actions
9. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

danjee Mar 10, 2012 1:58 PM (in response to michael_gronau)

Hello,

I'm facing the same issue. This happens when calling ejb method remotely and when calling it locally from a web application bundled in the same ear.
Actions
10. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

jason.greene Mar 10, 2012 2:28 PM (in response to michael_gronau)

This should be fixed in 7.1.1 which was released last night. Let us know if it resolves it for you. Thanks!
Actions
11. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

danjee Mar 10, 2012 10:02 PM (in response to jason.greene)

Unfortunately it didn't worked for me with 7.1.1 version. The login module was called for every ejb call.
Actions
12. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

jason.greene Mar 10, 2012 4:15 PM (in response to michael_gronau)

Ok the issue resolved was not the only factor then. We will look into this next week . Thanks
Actions
13. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

michael_gronau Mar 15, 2012 9:43 AM (in response to jason.greene)

Hi Jason,
are there any new about that issue. I saw, the Issue AS7-3498 was marked as duplicated by AS7-4087 But this issue is marked as resolved? I tried a brand new 7.1.2.Final-Snapshot but the problem still exists.

Michael
Actions
14. Re: Every single remote ejb call starts full authentication process with SecurityDomain cache-type="default"

dlofthouse Mar 15, 2012 10:54 AM (in response to michael_gronau)

Michael, I am reviewing this issue again as I write this.
Actions

1 2 3 Previous Next

Go to original post