1 Reply Latest reply on Apr 22, 2004 6:44 PM by csnow

Propogate EJB security credentials from standalone tomcat to

csnow Mar 25, 2004 10:00 PM

I have read that using container manager security with Tomcat and JBoss will allow security credentials to automatically propogate when using EJBs in the client (tomcat). I have a realm in Tomcat working proerly as well as a domain in JBoss. They work great separately and run in different JVMs.

I just cannot get the tomcat container to set the credentials before invoking an EJB method. I am assuming I need to go through the Tomcat container to get the home and remotes so it knows which user is invoking the calls but am not sure how to do this.

If I use the SecurityAssociation class that sets the credentials, it seems to do this on a static JVM basis, it seems. Is there a way to pin security credentials into separate instances of home and remotes? I want individual users to log into to the web container and when EJBs are invoked by the users for their individual creditals to be propograted. Any help would be appreciated. Thanks in advance.
-Chris

1. Re: Propogate EJB security credentials from standalone tomca

csnow Apr 22, 2004 6:44 PM (in response to csnow)

I found a solution to my problem. I am not sure if it is a hack but it seems reasonible. I created my own login so I could capture the userId and password and store them in the session. I then post a request to j_security_check for the container security.

I then use a filter to intercept every request and set the security credentials with SecurityAssociation, using the userId and password in the session. I had to create my own login because authentication happens before a filter is called so I had to way to capture the password entered by the user.
Actions