JBossDeveloper

I am using JBoss [4.0.1sp1 (build: CVSTag=JBoss_4_0_1_SP1 date=200502160314)].

I am seeing the same behavior: getUserPrincipal() in the web tier returns my custom principal, but getCallerPrincipal() in the EJB tier returns a SimplePrincipal.

I'm also using: [4.0.1sp1 (build: CVSTag=JBoss_4_0_1_SP1 date=200502160314)]

Is this a known bug? Does anyone have any workarounds?

Jim

Here's an update...

I was seeing the same problem in [4.0.3SP1 (build: CVSTag=JBoss_4_0_3_SP1 date=200510231054)]. So I downloaded the source code for jboss and added some log statements to find out why the web tier was returning my custom prinicipal but the EJB tier was not. Here's what I found. In the class org.jboss.ejb.EnterpriseContext, line 345, the "if" was failing because RealmMapping rm was null. That's why the call to getCallerPrincipal() in the ejb tier was returning a SimplePrincipal object instead of my custom principal.

I went back to my app and added a <security-domain/> element to the jboss dd (jboss.xml) for my EJB. That fixed the problem. Now I am consistently seeing calls to both getUserPrincipal() in the web-tier and getCallerPrincipal() in the EJB tier return my custom principal object.

Hope this helps...

Jim

I have the same problem that everyone else has!

I am doing things correctly in my JAAS LoginModule:

public class GreenfieldsLoginModule extends AbstractServerLoginModule
{

...

 private void createRoleSets() throws LoginException
 {
 SimpleGroup roles = new SimpleGroup("Roles");

// Add roles held by the user.
// Currently, the only role is "User".
 roles.addMember(new GreenfieldsUserRole("User"));

 SimpleGroup callerPrincipal = new SimpleGroup("CallerPrincipal");
 callerPrincipal.addMember(getIdentity());

 roleSets = new SimpleGroup[]{ roles, callerPrincipal };
 }

...
}

 <!-- Greenfields JAAS login module. -->
 <application-policy name="Greenfields">
 <authentication>
 <login-module code="com.fcl.security.GreenfieldsLoginModule"
 flag="required">
 <module-option name="unauthenticatedIdentity">anonymous</module-option>
 <module-option name="principalClass">com.fcl.security.GreenfieldsUser</module-option>
 <module-option name="ignorePasswordCase">true</module-option>

 </login-module>
 </authentication>
 </application-policy>

<?xml version="1.0" encoding="UTF-8"?>
<jboss>
 <security-domain>java:/jaas/Greenfields</security-domain>
</jboss>

10:54:48,375 ERROR [UsersRolesLoginModule] Failed to load users/passwords/role files
java.io.IOException: No properties file: users.properties or defaults: defaultUsers.properties found

OK, it's working now.

Below, our security domain is called "Greenfields". Insert your own String there.

They key points are that you must have an empty security domain entry in your jboss.xml!!!!! You must not specify the correct one, otherwise the login will not work!.

This means that you must then annotate your EJBs with

@SecurityDomain("Greenfields")

Then create a .sar file with META-INF/jboss-service.xml like this

<?xml version='1.0'?>
<!DOCTYPE policy PUBLIC
 "-//JBoss//DTD MBean Service 4.0//EN"
 "http://www.jboss.org/j2ee/dtd/jboss-service_4_0.dtd">
<server>
 <!-- The custom JAAS login configuration that installs
 a Configuration capable of dynamically updating the
 config settings
 -->
 <mbean code="org.jboss.security.auth.login.DynamicLoginConfig"
 name="jboss.security.tests:service=LoginConfig">
 <attribute name="PolicyConfig" serialDataType="jbxb">
 <jaas:policy
 xsi:schemaLocation="urn:jboss:security-config:4.1 resource:security-config_4_1.xsd"
 xmlns:jaas="urn:jboss:security-config:4.1"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

 <!-- Our Greenfields login config -->
 <jaas:application-policy name="Greenfields">
 <jaas:authentication>
 <jaas:login-module code="com.fcl.security.GreenfieldsLoginModule" flag="required">
 <jaas:module-option name="unauthenticatedIdentity">anonymous</jaas:module-option>
 <jaas:module-option name="principalClass">com.fcl.security.GreenfieldsUser</jaas:module-option>
 <jaas:module-option name="ignorePasswordCase">true</jaas:module-option>
 </jaas:login-module>
 </jaas:authentication>
 </jaas:application-policy>
 </jaas:policy>
 </attribute>
 <depends optional-attribute-name="LoginConfigService">
 jboss.security:service=XMLLoginConfig
 </depends>
 <depends optional-attribute-name="SecurityManagerService">
 jboss.security:service=JaasSecurityManager
 </depends>
 </mbean>

</server>

 private SimpleGroup callerPrincipal = new SimpleGroup("CallerPrincipal");
 private SimpleGroup roles = new SimpleGroup("Roles");
 private Group[] roleSets = { callerPrincipal, roles };