0 Replies Latest reply on Mar 16, 2016 8:06 AM by Thomas Mayr

    Setting principle calling onMessage() of a MDB

    Thomas Mayr Newbie

      Hi,

       

      there are many postings about priniples, <run-as-principal> and MDB's but no answers, so I try it again:

       

      I'm using WildFly 10.0.0.

       

      Is there a way to set the principle, which calls the method onMessage() of a message driven bean? I configured a run-as role for my MDB's:

       

      <security-identity>

        <run-as>

          <role-name>TestMessageBeanRole</role-name>

        </run-as>

      </security-identity>


      and <method-permission> in the <assembly-descriptor> for the role:


      <method-permission>

        <role-name>TestMessageBeanRole</role-name>

        <method>

          <ejb-name>TestMessageBeanHigh</ejb-name>

          <method-name>*</method-name>

        </method>

      </method-permission>


      When I do this, I get a authorization exception when the container tries to invoke onMessage(). So I configured all methods of the MDB's as <unchecked> in the <assembly-descriptor>, then the invocation works:


      <method-permission>

        <unchecked />

        <method>

          <ejb-name>TestMessageBeanHigh</ejb-name>

          <method-name>*</method-name>

        </method>

      </method-permission>

       

      The question is now, if there is a posibility to configure the role or principal, which is used to invoke onMessage()?


      I tried to configure a <run-as-principal> in  the JBoss deployment descriptor, but this doesn't help:

       

      <s:security>

        <ejb-name>TestMessageBeanLow</ejb-name>

        <s:security-domain>other</s:security-domain>

        <s:run-as-principal>TestServerUser</s:run-as-principal>

      </s:security>

       

      The configuration of the user in application-roles.properties looks like this:

       

      TestServerUser=TestMessageBeanRole

       

      Hoping for an answer

       

      Thomas