[jboss-jira] [JBoss JIRA] Commented: (JBAS-7037) JBossAS 5.x fails to use EJB's security domain in jboss.xml when the call is from web container
[
https://jira.jboss.org/jira/browse/JBAS-7037?page=com.atlassian.jira.plug...
]
Stefan Guilhen commented on JBAS-7037:
--------------------------------------
The root of the problem is that PreSecurityInterceptor ignores the container's
security domain when the incoming call is a local call. In other words, if a security
context already exists (which is the case when the call is made from within the web
container), then the security domain that has been set in the context is used, ignoring
the domain of the EJB container. I've made some changes to JBoss SX to allow updating
the context's domain and released a new version of JBoss SX. I'll now update the
application server and fix the PreSecurityInterceptor.
JBossAS 5.x fails to use EJB's security domain in jboss.xml when
the call is from web container
-----------------------------------------------------------------------------------------------
Key: JBAS-7037
URL: https://jira.jboss.org/jira/browse/JBAS-7037
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Security
Affects Versions: JBossAS-5.0.1.GA, JBossAS-5.1.0.GA
Environment: Problem found on Windows platform
Reporter: Calvin Lin
Assignee: Stefan Guilhen
Fix For: JBossAS-6.0.0.M3
Attachments: ConfigFiles-lib.zip, JBAS-jira-authenBug.zip
A degredation from JBoss 4.0.x and 4.2.x to JBoss 5.0.1.GA and JBoss 5.1.0.GA.
We noticed that the JAAS login in EJB container always picks up the Web app's
security domain when the client login is originated from a web application client. The
security domain specified in EJB container's jboss.xml is always ignored in this
situation.
The detailed problem description is posted on JBoss forum:
http://www.jboss.org/index.html?module=bb&op=viewtopic&t=156863
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira