[jboss-jira] [JBoss JIRA] Commented: (JBAS-7037) JBossAS 5.x fails to use EJB's security domain in jboss.xml when the call is from web container
[
https://jira.jboss.org/jira/browse/JBAS-7037?page=com.atlassian.jira.plug...
]
Stefan Guilhen commented on JBAS-7037:
--------------------------------------
I've been able to reproduce the error and my preliminary investigation shows that
calls made by remote clients directly to the EJBs are being secured as expected. However,
when a call is made from a Servlet, the EJB security uses the Web App's domain instead
of the domain that has been set in jboss.xml. I'll run the server in debug mode and
see if I can figure out why this is happening.
JBossAS 5.x fails to use EJB's security domain in jboss.xml when
the call is from web container
-----------------------------------------------------------------------------------------------
Key: JBAS-7037
URL: https://jira.jboss.org/jira/browse/JBAS-7037
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Security
Affects Versions: JBossAS-5.0.1.GA, JBossAS-5.1.0.GA
Environment: Problem found on Windows platform
Reporter: Calvin Lin
Assignee: Stefan Guilhen
Fix For: JBossAS-5.0.2.GA
Attachments: ConfigFiles-lib.zip, JBAS-jira-authenBug.zip
A degredation from JBoss 4.0.x and 4.2.x to JBoss 5.0.1.GA and JBoss 5.1.0.GA.
We noticed that the JAAS login in EJB container always picks up the Web app's
security domain when the client login is originated from a web application client. The
security domain specified in EJB container's jboss.xml is always ignored in this
situation.
The detailed problem description is posted on JBoss forum:
http://www.jboss.org/index.html?module=bb&op=viewtopic&t=156863
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira