10 Replies Latest reply on Dec 14, 2006 8:59 AM by sts

Unexpected Security Identity Propagation Switch

soon_shin May 25, 2005 6:32 PM

Environment:
JBoss 4.0.2

Problem Definition:

I have a web application utilizing JAAS (form based authentication, DatabaseServerLoginModule), Struts, Session Beans and Entity Beans. This configuration is working successfully, but I have noticed an unexpected switch in the Principal that is associated with the EJB invocation layer when more than one call to a session bean is made from the web tier (Struts Action) within one request.

Permissions & Security Identity

Web Tier - User Credentials

- id=joe
- password=pw
- role=administratorRole

Session Bean (fooSessionBean)

- Permissions: administratorRole, internalRole
- Security Identity (run-as): internalRole

Entity Bean (fooEntityBean)

- Permission: internalRole
- Security Identity (run-as): internalRole

Note: fooSessionBean.bar() calls fooEntityBean.bar()

Scenario

1) User logs in via form authentication (j_security_check)

2) User clicks on link that invokes an action that results in 2 calls to fooSessionBean.bar().

2a) First call to fooSessionBean.bar() is successful.

2b) Second call to fooSessionBean.bar() fails.

javax.security.auth.login.FailedLoginException: No matching username found in Principals

I set a breakpoint in the JaasSecurityManager.isValid(..) (line 251) and noticed that this method is called on the 'second' invocation of the fooSessionBean.bar() where the

principal = [roles=[internalRole],principal=anonymous]
credential = null

It appears as if the security-identity (run-as) defined for fooSessionBean is replacing the original principal credentials of the user that logged in during the first call to fooSessionBean.bar().

Questions

1. Has anyone else run into this problem? Suggestions?
2. Is there a way to configure JBoss, so that the second call uses the same/original principal credentials that were used in the first call?

Thanks in advance.

1. Re: Unexpected Security Identity Propagation Switch

starksm64 May 25, 2005 8:06 PM (in response to soon_shin)

File a bug report with more details like the ejb-jar.xml/web.xml (or a example that produces this beahvior if you have it):

http://jira.jboss.com/jira/browse/JBAS
Actions
2. Re: Unexpected Security Identity Propagation Switch

lianse May 26, 2005 7:26 AM (in response to soon_shin)

I have the exact same problem as as the one described above! Anyone that has any suggestions to what can be the reason for this and how to get around it?

This is an annoying problem!
Actions
3. Re: Unexpected Security Identity Propagation Switch

starksm64 May 26, 2005 9:11 AM (in response to soon_shin)

Then instead of adding a zero content posting, attach an example that illustrates the problem to the associated jira issue:

http://jira.jboss.com/jira/browse/JBAS-1852
Actions
4. Re: Unexpected Security Identity Propagation Switch

innovatis Jun 2, 2005 2:00 AM (in response to soon_shin)

Hi Scott
You said that this will be fixed in Jboss 4.03. Do you know when this version will be available? Could you provide us a patch (or tell how to implement this fix in the Jboss 4.0.2 source code) that solves this problem in the meantime?

Regards,
Carlo
Actions
5. Re: Unexpected Security Identity Propagation Switch

starksm64 Jun 2, 2005 9:33 AM (in response to soon_shin)

There will be a patch out at the end of the week.
Actions
6. Re: Unexpected Security Identity Propagation Switch

crepindany Jul 6, 2005 7:59 AM (in response to soon_shin)

I tried both the patch and version 4.0.3RC1. Both end up with the same "No matching username found in Principals".
Just as if the code responsible for pushing the credentials from Tomcat to the EJB container was pushing null instead of the corect value. Amazingly enough, version 4.0.3RC1 works fine when I replace Tomcat 5.5 sar by Tomcat 5.0.
Of course, when you declare a run-as element for you EJBs, the caller identity will be that one instead of the one that was authenticated by the web container.
This can produce different error messages, but imho these are due to the same problem in Tomcat5.5 sar.
Works fine with JBAS 4.0.1SP1 as well as version 3.2.3.
Actions
7. Re: Unexpected Security Identity Propagation Switch

innovatis Jul 11, 2005 4:25 PM (in response to soon_shin)

Hi
Me too, I've tried several times without success. If I run Tomcat sepparately out of Jboss everything is fine, but as soon as I deploy my frontend application from within the Embedded Tomcat instance the Jboss DatabaseServerLoginModule gets "null" as the username and this will throw the "username/password" exception. The exception is usually thrown after several lookup calls to some ejbs, but never after the first lookup to a bean (the first few calls are always fine).

I'll write a simple testcase and post it asap.

Crepidany, where can I get a version of Tomcat5.0.sar?

Regards,
Carlo
Actions
8. Re: Unexpected Security Identity Propagation Switch

crepindany Jul 12, 2005 8:08 AM (in response to soon_shin)

Download and extract version 4.0.1SP1.
Under %JBOSS_HOME%\server\default\deploy\ there is a directory called jbossweb-tomcat50.sar which contains a lot of jars as well as the root web application for your server. Replace jbossweb-tomcat55.sar from JBOSS 4.0.3 RC1 by jbossweb-tomcat50.sar from version 4.0.1SP1.
This is an ugly hack but it works. But unfortunatedly 4.0.1SP1 contains another annoyance: when a default page contains tags, tomcat translates the values of the src attributes incorrectly, so no images display in the welcome page.
Hope this will help you.
Actions
9. Re: Unexpected Security Identity Propagation Switch

fdifonzo Nov 16, 2006 11:57 AM (in response to soon_shin)

At the moment I'm using jboss 4.0.5 an when I call an Ejb 2.1 staleless method from a stateful one, in the latter one I get:

principal = [roles=[internalRole],principal=anonymous]

It seems an info propagation error from stateful to stateless EJB. I don't understand if the bug has been solved or it hasn't solved since the version 4.0.3 (as you has previously said in anather post).

Regards, Fabrizio
Actions
10. Re: Unexpected Security Identity Propagation Switch

sts Dec 14, 2006 8:59 AM (in response to soon_shin)

Hi,
I have a similar problem with jboss-4.0.5.GA: Calling stateless session bean 2 from stateless session bean 1 using 'runAs' makes me loose the caller principal. It changes to 'anonymous'.

I filed the follwing bug report http://jira.jboss.com/jira/browse/JBAS-3945 which contains a test case to re-produce the error.

Regards,

Stefan
Actions

Go to original post