war-security does not work for EBWS. ------------------------------------ Key: JBESB-3165 URL: https://jira.jboss.org/jira/browse/JBESB-3165 Project: JBoss ESB Issue Type: Bug Security Level: Public (Everyone can see) Components: Rosetta, Security, Web Services Affects Versions: 4.7 Reporter: Daniel Bevenius Fix For: 4.7 CP2 In EsbWebServiceDeployer only gateways in jboss-esb.xml are considered and services configured with EBWS are not in the deploy method: webModel.setAuthDomain(esbMetaData.getModel().getAuthDomain()); webModel.setAuthMethod(esbMetaData.getModel().getAuthMethod()); ModelUtil.updateWebModel(ModelUtil.getListenerGroups(esbMetaData.getModel()), webModel); The getListenerGroups method only looks for gateways and an EBWS is not considered to be one. So there will be no security constraints for the url to the EBWS. This is just from a quick look into the code base here and I need to look into this more closely. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira