<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<body link="#355491" alink="#4262a1" vlink="#355491" style="background: #e2e2e2; margin: 0; padding: 20px;">
<div>
<table cellpadding="0" bgcolor="#FFFFFF" border="0" cellspacing="0" style="border: 1px solid #dadada; margin-bottom: 30px; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td>
<table border="0" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF" style="border: solid 2px #ccc; background: #dadada; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td bgcolor="#000000" valign="middle" height="58px" style="border-bottom: 1px solid #ccc; padding: 20px; -moz-border-radius-topleft: 3px; -moz-border-radius-topright: 3px; -webkit-border-top-right-radius: 5px; -webkit-border-top-left-radius: 5px;">
<h1 style="color: #333333; font: bold 22px Arial, Helvetica, sans-serif; margin: 0; display: block !important;">
<!-- To have a header image/logo replace the name below with your img tag -->
<!-- Email clients will render the images when the message is read so any image -->
<!-- must be made available on a public server, so that all recipients can load the image. -->
<a href="http://community.jboss.org/index.jspa" style="text-decoration: none; color: #E1E1E1">JBoss Community</a></h1>
</td>
</tr>
<tr>
<td bgcolor="#FFFFFF" style="font: normal 12px Arial, Helvetica, sans-serif; color:#333333; padding: 20px; -moz-border-radius-bottomleft: 4px; -moz-border-radius-bottomright: 4px; -webkit-border-bottom-right-radius: 5px; -webkit-border-bottom-left-radius: 5px;"><h3 style="margin: 10px 0 5px; font-size: 17px; font-weight: normal;">
Re: security in ejb3.1 using jboss 6.0 CR1
</h3>
<span style="margin-bottom: 10px;">
created by <a href="http://community.jboss.org/people/aravindsk">aravind kopparthi</a> in <i>EJB3</i> - <a href="http://community.jboss.org/message/575244#575244">View the full discussion</a>
</span>
<hr style="margin: 20px 0; border: none; background-color: #dadada; height: 1px;">
<div class="jive-rendered-content"><p>Here is the log that i got ( when i enabled debug).</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>logged in as admin expecting that i will get a permission denied when calling getMembers() in SLSB since it is annotated as @RolesAllowed("businessowner").</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>user=admin</p><p>roles=<strong>HttpInvoker,JBossAdmin,WebAppUser</strong></p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p class="MsoNormal">REST/WEB-REQUEST</p><p class="MsoNormal" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p class="MsoNormal">@Path("/members")</p><p class="MsoNormal">@RequestScoped</p><p class="MsoNormal"><strong>public</strong> <strong>class</strong> MemberRESTService</p><p class="MsoNormal">{</p><p class="MsoNormal" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p class="MsoNormal">      @EJB</p><p class="MsoNormal">      Private SLSBProcessBean memberBean;</p><p class="MsoNormal">      @GET</p><p class="MsoNormal">      @Produces(MediaType.<em>APPLICATION_XML</em>)</p><p class="MsoNormal">      <strong>public</strong> List<Member> findMember() {</p><p class="MsoNormal">            <strong>return</strong> <span style="text-decoration: underline;">memberBean</span><span style="text-decoration: underline;">.getMembers()</span></p><p class="MsoNormal">      }</p><p class="MsoNormal">}</p><p class="MsoNormal" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p class="MsoNormal">-----------EJB----------</p><p class="MsoNormal">@Stateless</p><p class="MsoNormal">Public class SLSBProcessBean {</p><p class="MsoNormal" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p class="MsoNormal" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p class="MsoNormal">@RolesAllowed("businessowner")</p><p class="MsoNormal">Public List getMembers()</p><p class="MsoNormal">{</p><p class="MsoNormal">            //Business Logic</p><p class="MsoNormal">            Return members;</p><p class="MsoNormal">}</p><p class="MsoNormal">}</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p><span style="font-family: 'Courier New'; color: #1f497d; font-size: 10pt;"> config</span></p><p class="MsoNormal">META-INF/Jboss.xml</p><p class="MsoNormal" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p class="MsoNormal"><jboss></p><p class="MsoNormal">    <security-domain>java:/<span style="text-decoration: underline;">jaas</span>/my<span style="text-decoration: underline;">app-secure-domain</span></security-domain></p><p class="MsoNormal"></jboss></p><p class="MsoNormal" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p align="center" class="MsoNormal" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p class="MsoNormal">WEB-INF/jboss-web.xml</p><p class="MsoNormal"><jboss-web></p><p class="MsoNormal" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p class="MsoNormal">  <security-domain>java:/<span style="text-decoration: underline;">jaas</span>/my<span style="text-decoration: underline;">app-secure-domain</span> </security-domain></p><p class="MsoNormal" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p class="MsoNormal"></jboss-web></p><p class="MsoNormal" style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p class="MsoNormal">------------------------------------------------------------------------------------------------------------------------------------LOG-------------------------------------------------------</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p class="MsoNormal">11:44:16,109 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase] Security checking request GET /javaee6-app/rest/members</p><p class="MsoNormal">11:44:16,109 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase] We have cached auth type FORM for principal GenericPrincipal[<strong>admin(HttpInvoker,JBossAdmin,WebAppUser</strong>,)]</p><p class="MsoNormal">11:44:16,109 DEBUG [org.apache.catalina.realm.RealmBase]   Checking constraint 'SecurityConstraint[All resources]' against GET /rest/members--> false</p><p class="MsoNormal">11:44:16,109 DEBUG [org.apache.catalina.realm.RealmBase]   No applicable constraint located</p><p class="MsoNormal">11:44:16,109 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase]  Not subject to any constraint</p><p class="MsoNormal">11:44:16,109 DEBUG [org.jboss.resteasy.core.SynchronousDispatcher] PathInfo: members</p><p class="MsoNormal">11:44:16,109 DEBUG [org.jboss.resteasy.cdi.CdiConstructorInjector] Beans found for class com.sak.home.service.rest.MemberRESTService : [Managed Bean [class com.sak.home.service.rest.MemberRESTService] with qualifiers [@Any @Default @Exact]]</p><p class="MsoNormal">11:44:16,109 DEBUG [org.jboss.ejb3.ejbref.resolver.ejb30.impl.EJB30MetaDataBasedEjbReferenceResolver] Resolving reference for [EJB Reference: beanInterface 'com.sak.home.process.SLSBProcessBean', beanName '', mappedName 'null'] in org.jboss.metadata.ejb.jboss.JBossMetaData@1f</p><p class="MsoNormal">11:44:16,109 DEBUG [org.jboss.ejb3.ejbref.resolver.ejb30.impl.EJB30MetaDataBasedEjbReferenceResolver] Found match in EJB SLSBProcessBean for [EJB Reference: beanInterface 'com.sak.home.process.SLSBProcessBean', beanName '', mappedName 'null']</p><p class="MsoNormal">11:44:16,109 DEBUG [org.jboss.ejb3.ejbref.resolver.ejb31.impl.EJB31MetaDataBasedEjbReferenceResolver] Found specified beanInterface that is not a direct beanInterface of EJB SLSBProcessBean: com.sak.home.process.SLSBProcessBean</p><p class="MsoNormal">11:44:16,109 DEBUG [org.jboss.metadata.ejb.jboss.jndi.resolver.impl.JNDIPolicyBasedSessionBeanJNDINameResolver] Resolved JNDI Name for Interface com.sak.home.process.SLSBProcessBean of type NO_INTERFACE is SLSBProcessBean/no-interface</p><p class="MsoNormal">11:44:16,109 DEBUG [org.jboss.ejb3.ejbref.resolver.ejb31.impl.EJB31MetaDataBasedEjbReferenceResolver] Resolved JNDI Name for [EJB Reference: beanInterface 'com.sak.home.process.SLSBProcessBean', beanName '', mappedName 'null'] of EJB SLSBProcessBean: SLSBProcessBean/no-interface</p></div>
<div style="background-color: #f4f4f4; padding: 10px; margin-top: 20px;">
<p style="margin: 0;">Reply to this message by <a href="http://community.jboss.org/message/575244#575244">going to Community</a></p>
<p style="margin: 0;">Start a new discussion in EJB3 at <a href="http://community.jboss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2029">Community</a></p>
</div></td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
</body>
</html>