Thanks for posting the solution, although I would've prefered to see a non jboss platform specific solution to this problem.

Hi,

I had the same problem, first i was trying to authenticate the client with the following code:

          Properties env = new Properties();

          env.setProperty(Context.SECURITY_PRINCIPAL, "caja");

          env.setProperty(Context.SECURITY_CREDENTIALS, "password");

          env.setProperty(Context.INITIAL_CONTEXT_FACTORY, "org.jboss.security.jndi.JndiLoginInitialContextFactory");

          env.setProperty(Context.PROVIDER_URL, "localhost:1099");

          InitialContext ctx = new InitialContext(env);

Debugging server side i found that principal doesn't propagate correctly, crawling the web i found this link:

http://msikora.typepad.com/michael_sikora_on_java_ee/2009/03/converting-to-jboss500ga-ejb3-security.html

Where it says that i had to use the following code:

          SecurityClient securityClient = SecurityClientFactory.getSecurityClient();

          securityClient.setSimple("caja", "password");

          securityClient.login();

          InitialContext ctx = new InitialContext();

The problem is that aparently org.jboss.security.client.SecurityClient and org.jboss.security.client.SecurityClientFactory appears to apply to JBoss 5.0.0 and not to JBoss 4.2.3 the one we still use in our production environment.

Any help would be apreciated!

Thanks,

Pablo.

Hi Pablo,

in AS 4.2, you might use something like this:

public class SecurityClientCallbackHandler implements CallbackHandler

{

  public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException

  {

    //loop over parameter Callbacks

    for (int intIndexCallback = 0; intIndexCallback < callbacks.length; intIndexCallback++)

    {

      //NameCallback: set Login

       if (callbacks[intIndexCallback] instanceof NameCallback)

      {

        NameCallback nameCallback = (NameCallback) callbacks[intIndexCallback];

        nameCallback.setName( "ADMIN" );

      }

      //PasswordCallback: set password.

      else if (callbacks[intIndexCallback] instanceof PasswordCallback)

      {

        PasswordCallback passwordCallback = (PasswordCallback) callbacks[intIndexCallback];

        passwordCallback.setPassword ("ADMIN".toCharArray() );

      }

      else

      {

        throw new UnsupportedCallbackException (callbacks[intIndexCallback], "Unsupported Callback!");

      }

    }

  }

}

And in your client, perform this code to login in:

      Properties props = new Properties();

      props.setProperty(Context.INITIAL_CONTEXT_FACTORY, "org.jnp.interfaces.NamingContextFactory");

      props.setProperty(Context.URL_PKG_PREFIXES, "org.jboss.naming.client");

      props.setProperty(Context.PROVIDER_URL, "jnp://localhost:1099");

      props.setProperty("j2ee.clientName", "SecurityClient");

      InitialContext initialContext = new InitialContext(props);

      //Initialize Login:

      SecurityClientCallbackHandler callbackHandler = new SecurityClientCallbackHandler();

      LoginContext loginContext = new LoginContext ("somename", callbackHandler);

      loginContext.login();

Note the the "j2ee.clientName" must be declared in a file "jboss-client.xml":

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE jboss-client PUBLIC "-//JBoss//DTD Application Client 4.2//EN" "http://www.jboss.org/j2ee/dtd/jboss-client_4_2.dtd" >

<jboss-client>

      <jndi-name>SecurityClient</jndi-name>

      ...

</jboss-client>

And the "login context" name (here: "somename") must be declared in a file "auth.conf" in META-INF of your client JAR:

somename {
   // jBoss LoginModule
   org.jboss.security.ClientLoginModule  required
   ;
};

And finally, start your client with a parameter pointing to "auth.conf": -Djava.security.auth.login.config=.../META-INF/auth.conf

Hope this helps

Wolfgang

Wolfgang,

Thanks for your reply!

I was trying to understand the example, but honestly i lost my self in the jboss-client.xml descriptor, i don't understand which resource ref do i have to map in that file and for what?

I thought it would be easier to call an EJB3 from another client EJB3 using security in JBossAS 4.2.3, just like in the example of JBossAS 5:

SecurityClient securityClient = SecurityClientFactory.getSecurityClient();

securityClient.setSimple("caja", "password");

securityClient.login();

InitialContext ctx = new InitialContext();

Maybe i mess up myself, but i will try to explain my problem with an example:

First i have an EJB3, annotated with security annotations:

@Stateless(name = "ProxyIMMEJB")

@SecurityDomain("other")

@RolesAllowed("architect")

@Local(value = ProxyIMMLocal.class)

public class ProxyIMMEJBImpl implements ProxyIMMLocal {

    @Resource SessionContext ctx;

    @RolesAllowed("architect")

    public RespuestaIMMTO comprarTicket(TicketTO ticketTO) throws ... {

        Principal cp = ctx.getCallerPrincipal();

        log.debug("Principal's name: " + cp.getName());

        ...

    }

}

As you can see "other" indicates that i use JBoss's default authentication mechanism defined in login-config.xml situated in JBOSS_HOME\server\default\conf directory. In my case of "other", login-config.xml uses 2 properties files: users.properties and roles.properties with the following contents:

login-config.xml

   <application-policy name = "other">

      <authentication>

          <login-module code = "org.jboss.security.auth.spi.UsersRolesLoginModule"

             flag = "required">

              <module-option name="usersProperties">props/users.properties</module-option>

              <module-option name="rolesProperties">props/roles.properties</module-option>

              <module-option name="unauthenticatedIdentity">anonymous</module-option>

          </login-module>

       </authentication>

   </application-policy>

users.properties

caja=password

roles.properties

caja=architect

In another EJB3 client, i tried to call the ProxyIMMEJB bean using standard security code:

Properties env = new Properties();

env.setProperty(Context.SECURITY_PRINCIPAL, "caja");

env.setProperty(Context.SECURITY_CREDENTIALS, "password");

env.setProperty(Context.INITIAL_CONTEXT_FACTORY, "org.jboss.security.jndi.JndiLoginInitialContextFactory");

env.setProperty(Context.PROVIDER_URL, "localhost:1099");

try {

   InitialContext ctx = new InitialContext(env);

   proxyIMM = (ProxyIMMLocal) ctx.lookup("estar/ejb/ProxyIMM/local");

} catch (NamingException e) {

   // TODO Auto-generated catch block

   e.printStackTrace();

}

Soon i realized, security context was not propagated because i got "javax.ejb.EJBAccessException: Authorization failure" and confirmed later changing @RolesAllowed("architect") with @PermitAll and debugging principal's name.

        Principal cp = ctx.getCallerPrincipal();

        log.debug("Principal's name: " + cp.getName());

This gave me anonymous.

In my scenario, the complete example that you wrote applies? or there is an easiest way?

Thank you very much for your patience!

Pablo.

Hi,

I think that my sample applies to your use case, too.

One big "!!!" in your code snippets: don't use a Context.INITIAL_CONTEXT_FACTORY of "org.jboss.security.jndi.JndiLoginInitialContextFactory", because this was problematic with JBoss 4.2, and it will no longer work in AS 5 and above. You will have to perform a JAAS login as I described.

The security client of AS5 is just a simplified JAAS login, which performs internally similar things as my code ;-).

Best regards

Wolfgang