[JBoss JIRA] (AS7-2942) when EJB method called from application client with proper authorization call is wrongly denied
6:38 a.m.
when EJB method called from application client with proper authorization call is wrongly
denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.CR1
Reporter: Peter Skopek
Assignee: jaikiran pai
Fix For: 7.1.0.CR1
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303) [:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:44 a.m.
[
https://issues.jboss.org/browse/AS7-2942?page=com.atlassian.jira.plugin.s...
]
jaikiran pai updated AS7-2942:
------------------------------
Affects Version/s: 7.1.0.Beta1
(was: 7.1.0.CR1)
when EJB method called from application client with proper
authorization call is wrongly denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.Beta1
Reporter: Peter Skopek
Assignee: jaikiran pai
Fix For: 7.1.0.CR1
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
[:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:46 a.m.
[
https://issues.jboss.org/browse/AS7-2942?page=com.atlassian.jira.plugin.s...
]
jaikiran pai commented on AS7-2942:
-----------------------------------
We currently don't have support for security aspects for a remote EJB client. This is
something that's currently being worked upon for 7.1.0.CR1.
when EJB method called from application client with proper
authorization call is wrongly denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.Beta1
Reporter: Peter Skopek
Assignee: jaikiran pai
Fix For: 7.1.0.CR1
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
[:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:46 a.m.
[
https://issues.jboss.org/browse/AS7-2942?page=com.atlassian.jira.plugin.s...
]
jaikiran pai updated AS7-2942:
------------------------------
Priority: Blocker (was: Major)
when EJB method called from application client with proper
authorization call is wrongly denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.Beta1
Reporter: Peter Skopek
Assignee: jaikiran pai
Priority: Blocker
Fix For: 7.1.0.CR1
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
[:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:48 a.m.
[
https://issues.jboss.org/browse/AS7-2942?page=com.atlassian.jira.plugin.s...
]
SBS JIRA Integration updated AS7-2942:
--------------------------------------
Forum Reference: http://community.jboss.org/message/638693#638693,
http://community.jboss.org/message/640258#640258 (was:
http://community.jboss.org/message/640258#640258)
when EJB method called from application client with proper
authorization call is wrongly denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.Beta1
Reporter: Peter Skopek
Assignee: jaikiran pai
Priority: Blocker
Fix For: 7.1.0.CR1
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
[:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:48 a.m.
[
https://issues.jboss.org/browse/AS7-2942?page=com.atlassian.jira.plugin.s...
]
SBS JIRA Integration updated AS7-2942:
--------------------------------------
Forum Reference: http://community.jboss.org/message/640258#640258
when EJB method called from application client with proper
authorization call is wrongly denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.Beta1
Reporter: Peter Skopek
Assignee: jaikiran pai
Priority: Blocker
Fix For: 7.1.0.CR1
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
[:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
7:39 a.m.
[
https://issues.jboss.org/browse/AS7-2942?page=com.atlassian.jira.plugin.s...
]
Peter Skopek commented on AS7-2942:
-----------------------------------
When this pull request will be accepted one can used tests it adds.
https://github.com/jbossas/jboss-as/pull/831
Or use branch: https://github.com/pskopek/jboss-as/tree/JBQA-5x
when EJB method called from application client with proper
authorization call is wrongly denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.Beta1
Reporter: Peter Skopek
Assignee: jaikiran pai
Priority: Blocker
Fix For: 7.1.0.CR1
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
[:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:24 p.m.
[
https://issues.jboss.org/browse/AS7-2942?page=com.atlassian.jira.plugin.s...
]
Jason Greene updated AS7-2942:
------------------------------
Forum Reference: http://community.jboss.org/message/638693#638693,
http://community.jboss.org/message/640258#640258 (was:
http://community.jboss.org/message/638693#638693,
http://community.jboss.org/message/640258#640258)
when EJB method called from application client with proper
authorization call is wrongly denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.Beta1
Reporter: Peter Skopek
Assignee: jaikiran pai
Priority: Blocker
Fix For: 7.1.0.CR1
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
[:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
12:53 a.m.
[
https://issues.jboss.org/browse/AS7-2942?page=com.atlassian.jira.plugin.s...
]
Jason Greene resolved AS7-2942.
-------------------------------
Resolution: Done
SASL Auth for EJB has been implemented
when EJB method called from application client with proper
authorization call is wrongly denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.Beta1
Reporter: Peter Skopek
Assignee: jaikiran pai
Priority: Blocker
Fix For: 7.1.0.CR1
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
[:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:42 a.m.
[
https://issues.jboss.org/browse/AS7-2942?page=com.atlassian.jira.plugin.s...
]
Jan Lanik commented on AS7-2942:
--------------------------------
Try to uncomment @Ignore in
org.jboss.as.test.integration.ejb.security.authorization.SingleMethodsAnnOnlyCheckSFSB
and run
./integration-tests.sh clean install -Dts.basic
-Dtest='org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase*'
You'll see that the request from the user with role in @RolesAllowed which should be
accepted is denied instead.
error trace:
15:13:35,766 ERROR [org.jboss.ejb3.invocation] (pool-9-thread-3) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:101)
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:76)
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
at org.jboss.as.ee.component.TCCLInterceptor.processInvocation(TCCLInterceptor.java:45)
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
at org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:285)
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:62)
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:192)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441) [:1.6.0_24]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303) [:1.6.0_24]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_24]
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_24]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_24]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_24]
at org.jboss.threads.JBossThread.run(JBossThread.java:122)
[jboss-threads-2.0.0.GA.jar:2.0.0.GA]
when EJB method called from application client with proper
authorization call is wrongly denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.Beta1
Reporter: Peter Skopek
Assignee: jaikiran pai
Priority: Blocker
Fix For: 7.1.0.CR1
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
[:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:44 a.m.
[
https://issues.jboss.org/browse/AS7-2942?page=com.atlassian.jira.plugin.s...
]
Jan Lanik reopened AS7-2942:
----------------------------
when EJB method called from application client with proper
authorization call is wrongly denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.Beta1
Reporter: Peter Skopek
Assignee: jaikiran pai
Priority: Blocker
Fix For: 7.1.0.CR1
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
[:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:08 a.m.
[
https://issues.jboss.org/browse/AS7-2942?page=com.atlassian.jira.plugin.s...
]
jaikiran pai commented on AS7-2942:
-----------------------------------
Just looked at the tests in the pull request here
https://github.com/jbossas/jboss-as/pull/880. Based on that, I believe that the subject of
this JIRA is misleading. The tests are _not_ for "application clients" but are
for remote standalone clients trying to access the secured EJBs. There's a (important)
difference between these two since the setup to propagate the security credentials varies.
I currently don't have the exact steps/configurations to help you with getting these
passing (since it's a bit involved especially on the server side). But once I am done
with the current clustering tasks, I might be able to take a more detailed look at the
setup and maybe add a quickstart example.
when EJB method called from application client with proper
authorization call is wrongly denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.Beta1
Reporter: Peter Skopek
Assignee: jaikiran pai
Priority: Blocker
Fix For: 7.1.0.CR1
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
[:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
7:13 p.m.
[
https://issues.jboss.org/browse/AS7-2942?page=com.atlassian.jira.plugin.s...
]
Brian Stansberry commented on AS7-2942:
---------------------------------------
Jaikiran, can this either be resolved against CR1 or scheduled against Final?
when EJB method called from application client with proper
authorization call is wrongly denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.Beta1
Reporter: Peter Skopek
Assignee: jaikiran pai
Priority: Blocker
Fix For: 7.1.0.CR1
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
[:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:43 p.m.
[
https://issues.jboss.org/browse/AS7-2942?page=com.atlassian.jira.plugin.s...
]
Brian Stansberry updated AS7-2942:
----------------------------------
Fix Version/s: 7.1.0.Final
(was: 7.1.0.CR1)
Forum Reference: http://community.jboss.org/message/638693#638693,
http://community.jboss.org/message/640258#640258 (was:
http://community.jboss.org/message/638693#638693,
http://community.jboss.org/message/640258#640258)
Moving the Fix Version to 7.1.0.Final so it doesn't fall in a crack. If this was
actually fixed in CR1, please re-resolve against CR1.
when EJB method called from application client with proper
authorization call is wrongly denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.Beta1
Reporter: Peter Skopek
Assignee: jaikiran pai
Priority: Blocker
Fix For: 7.1.0.Final
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
[:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:16 p.m.
[
https://issues.jboss.org/browse/AS7-2942?page=com.atlassian.jira.plugin.s...
]
jaikiran pai commented on AS7-2942:
-----------------------------------
A few days after CR1, I had a discussion with Jason about this. The security
configurations from invoking from a remote client are available but setting it up for a
real application requires a bit of improvement. I'll check back with Jason on this
one, the coming week. Thanks for reminding.
when EJB method called from application client with proper
authorization call is wrongly denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.Beta1
Reporter: Peter Skopek
Assignee: jaikiran pai
Priority: Blocker
Fix For: 7.1.0.Final
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
[:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:21 a.m.
[
https://issues.jboss.org/browse/AS7-2942?page=com.atlassian.jira.plugin.s...
]
jaikiran pai reassigned AS7-2942:
---------------------------------
Assignee: Darran Lofthouse (was: jaikiran pai)
Darran's currently looking into this for the upcoming release.
when EJB method called from application client with proper
authorization call is wrongly denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.Beta1
Reporter: Peter Skopek
Assignee: Darran Lofthouse
Priority: Blocker
Labels: eap6_prd_req
Fix For: 7.1.0.Final
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
[:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:30 p.m.
[
https://issues.jboss.org/browse/AS7-2942?page=com.atlassian.jira.plugin.s...
]
Jason Greene reassigned AS7-2942:
---------------------------------
Assignee: Jason Greene (was: Darran Lofthouse)
when EJB method called from application client with proper
authorization call is wrongly denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.Beta1
Reporter: Peter Skopek
Assignee: Jason Greene
Priority: Blocker
Labels: eap6_prd_req
Fix For: 7.1.0.Final
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
[:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:38 a.m.
[
https://issues.jboss.org/browse/AS7-2942?page=com.atlassian.jira.plugin.s...
]
Jason Greene resolved AS7-2942.
-------------------------------
Resolution: Done
when EJB method called from application client with proper
authorization call is wrongly denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.Beta1
Reporter: Peter Skopek
Assignee: Jason Greene
Priority: Blocker
Labels: eap6_prd_req
Fix For: 7.1.0.Final
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
[:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:38 a.m.
[
https://issues.jboss.org/browse/AS7-2942?page=com.atlassian.jira.plugin.s...
]
Jason Greene commented on AS7-2942:
-----------------------------------
This has been completed
when EJB method called from application client with proper
authorization call is wrongly denied
-----------------------------------------------------------------------------------------------
Key: AS7-2942
URL: https://issues.jboss.org/browse/AS7-2942
Project: Application Server 7
Issue Type: Bug
Components: EJB, Security
Affects Versions: 7.1.0.Beta1
Reporter: Peter Skopek
Assignee: Jason Greene
Priority: Blocker
Labels: eap6_prd_req
Fix For: 7.1.0.Final
When calling EJB method from client with authenticated user holding proper authorization,
method call is denied.
It is happening for stateless as well as stateful beans.
See server exception:
09:31:58,254 INFO
[org.jboss.as.test.integration.ejb.security.SingleMethodsAnnSFSBTestCase] (main) JNDI
name=ejb:/singleMethodsAnnOnlySFSB//SingleMethodsAnnOnlyCheckSFSB!org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote?stateful
09:31:58,299 ERROR [org.jboss.ejb3.invocation] (pool-8-thread-5) JBAS014134: EJB
Invocation failed on component SingleMethodsAnnOnlyCheckSFSB for method public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String):
javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public abstract
java.lang.String
org.jboss.as.test.integration.ejb.security.authorization.SimpleAuthorizationRemote.roleBasedAccessOne(java.lang.String)
of bean: SingleMethodsAnnOnlyCheckSFSB is not allowed
at
org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:99)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:70)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:57)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
[jboss-invocation-1.1.1.Final.jar:]
at
org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
[jboss-invocation-1.1.1.Final.jar:]
at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:165)
[jboss-as-ee-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:259)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$200(MethodInvocationMessageHandler.java:56)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at
org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:177)
[jboss-as-ejb3-7.1.0.CR1-SNAPSHOT.jar:]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
[:1.6.0_27]
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
[:1.6.0_27]
at java.util.concurrent.FutureTask.run(FutureTask.java:138) [:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
[:1.6.0_27]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
[:1.6.0_27]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_27]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
4660
days inactive
4724
days old
18 comments
12 participants
participants (12)
-
Brian Stansberry (JIRA) -
jaikiran pai (Commented) (JIRA)
-
jaikiran pai (JIRA)
-
jaikiran pai (Updated) (JIRA)
-
Jan Lanik (Commented) (JIRA)
-
Jan Lanik (Reopened) (JIRA)
-
Jason Greene (JIRA)
-
Jason Greene (Resolved) (JIRA)
-
Jason Greene (Updated) (JIRA)
-
Peter Skopek (Commented) (JIRA)
-
Peter Skopek (Created) (JIRA)
-
SBS JIRA Integration (Updated) (JIRA)