YAHOO! I solved my situation. In the ejb-jar file the <assembly-descriptor> should be the direct child of the <ejb-jar> tag. I had the <assembly-descriptor> inside the <enterprise-beans> tag which is why mine didn't work. In answer to your original problem, give us a gander of your ejb-jar.xml. Another thing that I learned is that when you do:

<ejb-name>MyBean</ejb-name>
<method-name>*</method-name>

That applies security on all methods on the home and remote interface. Otherwise you will have to place some special tags into your ejb-jar xml to specify which method you are referring to.

Danno

And if you would use XDoclet, all the desriptors would be generated for you...
( http://www.sourceforge.net/projects/xdoclet )
Strange thiung is that jboss verifier did not complained on dtd violation...

Mine is working fine, My transaction spans through a servlet, session, then to a CMP entity. I have to make sure that the security is set up with the same role through out the transaction. In other words if a servlet is used by a role called "Admin", then the session bean methods need to be "locked" by "Admin" and the entity bean methods need to be locked by "Admin". Can you give us a sample of the security portion of your web.xml and ejb-jar.xml?

Callum,

For what it's worth, I totally agree. javax.ejb.Handle does indeed lose the Security Principal as you explained.

JBoss guys, is this a bug that is going to be fixed?

thanks,

lachlan

Hi all,

I have seen many posts regarding this issue but no solutions, as yet.

I am using JBoss 2.2.2 and Tomcat 3.2.2.

I receive this error when calling Session beans from java classes accessed via JSPs. Authentication and authorisation work fine with most actions, however sometimes JBoss appears to drop either the principal or required roles which are clearly listed in the roles.properties and users.properties files.

Is there a solution to this? it appears unlikely that the application is incorrect as the security is declarative and also works in SilverStream

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

[MatrixEntity] Insufficient method permissions, principal=callumw, method=findByCollection, requiredRoles
=null
[TheSearchService] TRANSACTION ROLLBACK EXCEPTION:checkSecurityAssociation; nested exception is:
java.lang.SecurityException: Insufficient method permissions, principal=callumw, method=findByCol
lection, requiredRoles=null; nested exception is:
java.rmi.RemoteException: checkSecurityAssociation; nested exception is:
java.lang.SecurityException: Insufficient method permissions, principal=callumw, method=findByCol
lection, requiredRoles=null
[TheSearchService] java.rmi.RemoteException: checkSecurityAssociation; nested exception is:
[TheSearchService] java.lang.SecurityException: Insufficient method permissions, principal=callumw,
method=findByCollection, requiredRoles=null
[TheSearchService] java.lang.SecurityException: Insufficient method permissions, principal=callumw, metho
d=findByCollection, requiredRoles=null
[TheSearchService] at org.jboss.ejb.plugins.SecurityInterceptor.checkSecurityAssociation(SecurityInt
erceptor.java:232)
[TheSearchService] at org.jboss.ejb.plugins.SecurityInterceptor.invokeHome(SecurityInterceptor.java:
144)
[TheSearchService] at org.jboss.ejb.plugins.LogInterceptor.invokeHome(LogInterceptor.java:106)
[TheSearchService] at org.jboss.ejb.EntityContainer.invokeHome(EntityContainer.java:316)
[TheSearchService] at org.jboss.ejb.plugins.jrmp.server.JRMPContainerInvoker.invokeHome(JRMPContaine
rInvoker.java:436)
[TheSearchService] at org.jboss.ejb.plugins.jrmp.interfaces.HomeProxy.invoke(HomeProxy.java:212)
[TheSearchService] at $Proxy72.findByCollection(Unknown Source)
[TheSearchService] at uk.co.mfl.app.common.search.ejb.service.SearchServiceEJB.search(SearchServiceE
JB.java:109)
[TheSearchService] at java.lang.reflect.Method.invoke(Native Method)
[TheSearchService] at org.jboss.ejb.StatefulSessionContainer$ContainerInterceptor.invoke(StatefulSes
sionContainer.java:570)
[TheSearchService] at org.jboss.ejb.plugins.SecurityInterceptor.invoke(SecurityInterceptor.java:190)

[TheSearchService] at org.jboss.ejb.plugins.StatefulSessionInstanceInterceptor.invoke(StatefulSessio