JBoss development, A new message was posted in the thread "Keeping the state of Caller principal in JBoss AppServer when authenticating from standalone WebServer": http://community.jboss.org/message/530097#530097 Author : Eric Loh Profile : http://community.jboss.org/people/eric1lyk Message: -------------------------------------------------------------- Dear experts,   I have problems understanding how i can maintain the Authentication Principal in the JBoss Appserver for subsequent invokations of an EJB3 Stateless session bean from a standalone client.   I have EJB3 Stateless session beans deployed on JBoss 5.1.0 AS     My Client is deployed on a Apache Tomcat Webserver (version 6.0.20)   My Client (deployed on Tomcat Webserver) uses the following Login Config to do authentication.   *myapp-login {* *    com.myapp.services.authentication.client.jaas.OasisLoginModule requisite debug="true"* *    facadeJndiName="myApp/authentication"* *    java.naming.factory.initial="org.jnp.interfaces.NamingContextFactory"* *    java.naming.factory.url.pkgs="org.jboss.naming:org.jnp.interfaces"* *    java.naming.provider.url="jnp://localhost:1099";* *   * *    org.jboss.security.ClientLoginModule sufficient debug="true"* *    multi-threaded="true";* *};* I realised that *org.jboss.security.ClientLoginModule is required so that the CallerPrincipal gets propagated from my Client to JBoss AppServer* *org.jboss.security.ClientLoginModule sufficient debug="true"*   After I login, i created an InitialContext to lookup the EJB3 stateless session bean deployed in JBoss.   I try to test if the Stateless session bean can obtain the principal that i propagated frmo the Tomcat Webserver to JBoss AS   The first time i called, the context.getCallerPrincipal() was able to return the principal that i set inside the Callbackhandler.   *@Stateless* *public class AuthenticationComponentFacadeBean extends AbstractComponentFacade<IAuthenticationComponentServiceLocator> implements IAuthenticationComponentFacade* *{  * *    @Resource* *    SessionContext context;* * * *    @Override* *    public char[] resetPassword(MyCredentials credential) throws AuthenticationException* *    {* *            if (context.getCallerPrincipal() != null)* *            {* *                 System.out.println("principal: " + context.getCallerPrincipal());* *            }*   But, in subsequent invocations when i create the InitialContext again, I am getting NullPointerException   *15:16:50,538 INFO  [STDOUT] 2010-03-05 15:16:50,538 [ERROR] - [AuthenticationComponentFacadeBean] java.lang.NullPointerException* *        at org.jboss.ejb3.security.helpers.EJBContextHelper.getCallerPrincipal(EJBContextHelper.java:99)*   i.e. The CallerPrincipal gets lost in subsequent invocations.   Can someone tell me how i can maintain the CallerPrincipal inside JBoss AppServer until i perform a logout operation to invalidate my session?   *What is the correct way to do it?* * * *Should I invoke the ClientLoginModule at my Client on Tomcat Webserver everytime i lookup a stateless session bean so that it will keep the CallerPrincipal there?*   *Is there a way to keep the CallerPrincipal without invoking the ClientLoginModule everytime i do a lookup?* -------------------------------------------------------------- To reply to this message visit the message page: http://community.jboss.org/message/530097#530097