[JBoss JIRA] Created: (JBAS-7037) JBossAS 5.x fails to use EJB's security domain in jboss.xml when the call is from web container
11:32 p.m.
JBossAS 5.x fails to use EJB's security domain in jboss.xml when the call is from web
container
-----------------------------------------------------------------------------------------------
Key: JBAS-7037
URL: https://jira.jboss.org/jira/browse/JBAS-7037
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Security
Affects Versions: JBossAS-5.1.0.GA, JBossAS-5.0.1.GA
Environment: Problem found on Windows platform
Reporter: Calvin Lin
Assignee: Anil Saldhana
Priority: Critical
A degredation from JBoss 4.0.x and 4.2.x to JBoss 5.0.1.GA and JBoss 5.1.0.GA.
We noticed that the JAAS login in EJB container always picks up the Web app's security
domain when the client login is originated from a web application client. The security
domain specified in EJB container's jboss.xml is always ignored in this situation.
The detailed problem description is posted on JBoss forum:
http://www.jboss.org/index.html?module=bb&op=viewtopic&t=156863
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
12:06 a.m.
New subject: [JBoss JIRA] Updated: (JBAS-7037) JBossAS 5.x fails to use EJB's security domain in jboss.xml when the call is from web container
[
https://jira.jboss.org/jira/browse/JBAS-7037?page=com.atlassian.jira.plug...
]
Calvin Lin updated JBAS-7037:
-----------------------------
Attachment: JBAS-jira-authenBug.zip
The zip file contains the web and ejb project that demonstrate the problem.
Please read readme.txt first.
The project uses JBossAS 5.1.0.GA.
JBossAS 5.x fails to use EJB's security domain in jboss.xml when
the call is from web container
-----------------------------------------------------------------------------------------------
Key: JBAS-7037
URL: https://jira.jboss.org/jira/browse/JBAS-7037
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Security
Affects Versions: JBossAS-5.0.1.GA, JBossAS-5.1.0.GA
Environment: Problem found on Windows platform
Reporter: Calvin Lin
Assignee: Anil Saldhana
Priority: Critical
Attachments: JBAS-jira-authenBug.zip
A degredation from JBoss 4.0.x and 4.2.x to JBoss 5.0.1.GA and JBoss 5.1.0.GA.
We noticed that the JAAS login in EJB container always picks up the Web app's
security domain when the client login is originated from a web application client. The
security domain specified in EJB container's jboss.xml is always ignored in this
situation.
The detailed problem description is posted on JBoss forum:
http://www.jboss.org/index.html?module=bb&op=viewtopic&t=156863
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:58 a.m.
New subject: [JBoss JIRA] Updated: (JBAS-7037) JBossAS 5.x fails to use EJB's security domain in jboss.xml when the call is from web container
[
https://jira.jboss.org/jira/browse/JBAS-7037?page=com.atlassian.jira.plug...
]
Anil Saldhana updated JBAS-7037:
--------------------------------
Assignee: Stefan Guilhen (was: Anil Saldhana)
Priority: Major (was: Critical)
Stefan, take an initial look at this case in the next few days.
JBossAS 5.x fails to use EJB's security domain in jboss.xml when
the call is from web container
-----------------------------------------------------------------------------------------------
Key: JBAS-7037
URL: https://jira.jboss.org/jira/browse/JBAS-7037
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Security
Affects Versions: JBossAS-5.0.1.GA, JBossAS-5.1.0.GA
Environment: Problem found on Windows platform
Reporter: Calvin Lin
Assignee: Stefan Guilhen
Attachments: JBAS-jira-authenBug.zip
A degredation from JBoss 4.0.x and 4.2.x to JBoss 5.0.1.GA and JBoss 5.1.0.GA.
We noticed that the JAAS login in EJB container always picks up the Web app's
security domain when the client login is originated from a web application client. The
security domain specified in EJB container's jboss.xml is always ignored in this
situation.
The detailed problem description is posted on JBoss forum:
http://www.jboss.org/index.html?module=bb&op=viewtopic&t=156863
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
10 a.m.
New subject: [JBoss JIRA] Updated: (JBAS-7037) JBossAS 5.x fails to use EJB's security domain in jboss.xml when the call is from web container
[
https://jira.jboss.org/jira/browse/JBAS-7037?page=com.atlassian.jira.plug...
]
Anil Saldhana updated JBAS-7037:
--------------------------------
Fix Version/s: JBossAS-5.0.2.GA
Maybe a metadata merge issue.
JBossAS 5.x fails to use EJB's security domain in jboss.xml when
the call is from web container
-----------------------------------------------------------------------------------------------
Key: JBAS-7037
URL: https://jira.jboss.org/jira/browse/JBAS-7037
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Security
Affects Versions: JBossAS-5.0.1.GA, JBossAS-5.1.0.GA
Environment: Problem found on Windows platform
Reporter: Calvin Lin
Assignee: Stefan Guilhen
Fix For: JBossAS-5.0.2.GA
Attachments: JBAS-jira-authenBug.zip
A degredation from JBoss 4.0.x and 4.2.x to JBoss 5.0.1.GA and JBoss 5.1.0.GA.
We noticed that the JAAS login in EJB container always picks up the Web app's
security domain when the client login is originated from a web application client. The
security domain specified in EJB container's jboss.xml is always ignored in this
situation.
The detailed problem description is posted on JBoss forum:
http://www.jboss.org/index.html?module=bb&op=viewtopic&t=156863
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:32 p.m.
New subject: [JBoss JIRA] Updated: (JBAS-7037) JBossAS 5.x fails to use EJB's security domain in jboss.xml when the call is from web container
[
https://jira.jboss.org/jira/browse/JBAS-7037?page=com.atlassian.jira.plug...
]
Calvin Lin updated JBAS-7037:
-----------------------------
Attachment: ConfigFiles-lib.zip
Additional files needed in JBoss AS directory for testing.
Please read the readme.txt file for details.
JBossAS 5.x fails to use EJB's security domain in jboss.xml when
the call is from web container
-----------------------------------------------------------------------------------------------
Key: JBAS-7037
URL: https://jira.jboss.org/jira/browse/JBAS-7037
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Security
Affects Versions: JBossAS-5.0.1.GA, JBossAS-5.1.0.GA
Environment: Problem found on Windows platform
Reporter: Calvin Lin
Assignee: Stefan Guilhen
Fix For: JBossAS-5.0.2.GA
Attachments: ConfigFiles-lib.zip, JBAS-jira-authenBug.zip
A degredation from JBoss 4.0.x and 4.2.x to JBoss 5.0.1.GA and JBoss 5.1.0.GA.
We noticed that the JAAS login in EJB container always picks up the Web app's
security domain when the client login is originated from a web application client. The
security domain specified in EJB container's jboss.xml is always ignored in this
situation.
The detailed problem description is posted on JBoss forum:
http://www.jboss.org/index.html?module=bb&op=viewtopic&t=156863
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
12:10 p.m.
New subject: [JBoss JIRA] Updated: (JBAS-7037) JBossAS 5.x fails to use EJB's security domain in jboss.xml when the call is from web container
[
https://jira.jboss.org/jira/browse/JBAS-7037?page=com.atlassian.jira.plug...
]
Calvin Lin updated JBAS-7037:
-----------------------------
Workaround Description:
Our workaround for standalone JBoss AS is to add "CLIENT_LOGIN_MODULE"
application-policy in login-config.xml and use that for EJB container authentication.
For clustering environment, the workaround is to add "BYPASSED-SECURITY"
application-policy in login-config.xml to handle the EJB container authentication.
was:Our workaround is to add "CLIENT_LOGIN_MODULE" application-policy in
login-config.xml and use that for EJB container authentication.
JBossAS 5.x fails to use EJB's security domain in jboss.xml when
the call is from web container
-----------------------------------------------------------------------------------------------
Key: JBAS-7037
URL: https://jira.jboss.org/jira/browse/JBAS-7037
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Security
Affects Versions: JBossAS-5.0.1.GA, JBossAS-5.1.0.GA
Environment: Problem found on Windows platform
Reporter: Calvin Lin
Assignee: Stefan Guilhen
Fix For: JBossAS-5.0.2.GA
Attachments: ConfigFiles-lib.zip, JBAS-jira-authenBug.zip
A degredation from JBoss 4.0.x and 4.2.x to JBoss 5.0.1.GA and JBoss 5.1.0.GA.
We noticed that the JAAS login in EJB container always picks up the Web app's
security domain when the client login is originated from a web application client. The
security domain specified in EJB container's jboss.xml is always ignored in this
situation.
The detailed problem description is posted on JBoss forum:
http://www.jboss.org/index.html?module=bb&op=viewtopic&t=156863
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:57 p.m.
New subject: [JBoss JIRA] Commented: (JBAS-7037) JBossAS 5.x fails to use EJB's security domain in jboss.xml when the call is from web container
[
https://jira.jboss.org/jira/browse/JBAS-7037?page=com.atlassian.jira.plug...
]
Stefan Guilhen commented on JBAS-7037:
--------------------------------------
I've been able to reproduce the error and my preliminary investigation shows that
calls made by remote clients directly to the EJBs are being secured as expected. However,
when a call is made from a Servlet, the EJB security uses the Web App's domain instead
of the domain that has been set in jboss.xml. I'll run the server in debug mode and
see if I can figure out why this is happening.
JBossAS 5.x fails to use EJB's security domain in jboss.xml when
the call is from web container
-----------------------------------------------------------------------------------------------
Key: JBAS-7037
URL: https://jira.jboss.org/jira/browse/JBAS-7037
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Security
Affects Versions: JBossAS-5.0.1.GA, JBossAS-5.1.0.GA
Environment: Problem found on Windows platform
Reporter: Calvin Lin
Assignee: Stefan Guilhen
Fix For: JBossAS-5.0.2.GA
Attachments: ConfigFiles-lib.zip, JBAS-jira-authenBug.zip
A degredation from JBoss 4.0.x and 4.2.x to JBoss 5.0.1.GA and JBoss 5.1.0.GA.
We noticed that the JAAS login in EJB container always picks up the Web app's
security domain when the client login is originated from a web application client. The
security domain specified in EJB container's jboss.xml is always ignored in this
situation.
The detailed problem description is posted on JBoss forum:
http://www.jboss.org/index.html?module=bb&op=viewtopic&t=156863
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:52 p.m.
New subject: [JBoss JIRA] Commented: (JBAS-7037) JBossAS 5.x fails to use EJB's security domain in jboss.xml when the call is from web container
[
https://jira.jboss.org/jira/browse/JBAS-7037?page=com.atlassian.jira.plug...
]
Chris Imershein commented on JBAS-7037:
---------------------------------------
Could this be related at all to #EJBTHREE-1756 ?
See also the notes on the linked JBoss Forum page from 1756:
http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4216002
Possibly something with JBossWebRealm.authenticate, SubjectInfo, and CredentialIdentity?
Or these 2 bugs could be completely unrelated.
However, if 1756 could also be fixed in 5.0.2 (or at least put onto the road map), that
would be appreciated.
JBossAS 5.x fails to use EJB's security domain in jboss.xml when
the call is from web container
-----------------------------------------------------------------------------------------------
Key: JBAS-7037
URL: https://jira.jboss.org/jira/browse/JBAS-7037
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Security
Affects Versions: JBossAS-5.0.1.GA, JBossAS-5.1.0.GA
Environment: Problem found on Windows platform
Reporter: Calvin Lin
Assignee: Stefan Guilhen
Fix For: JBossAS-5.0.2.GA
Attachments: ConfigFiles-lib.zip, JBAS-jira-authenBug.zip
A degredation from JBoss 4.0.x and 4.2.x to JBoss 5.0.1.GA and JBoss 5.1.0.GA.
We noticed that the JAAS login in EJB container always picks up the Web app's
security domain when the client login is originated from a web application client. The
security domain specified in EJB container's jboss.xml is always ignored in this
situation.
The detailed problem description is posted on JBoss forum:
http://www.jboss.org/index.html?module=bb&op=viewtopic&t=156863
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:39 p.m.
New subject: [JBoss JIRA] Commented: (JBAS-7037) JBossAS 5.x fails to use EJB's security domain in jboss.xml when the call is from web container
[
https://jira.jboss.org/jira/browse/JBAS-7037?page=com.atlassian.jira.plug...
]
Stefan Guilhen commented on JBAS-7037:
--------------------------------------
I haven't been able to investigate this any further until now due to other pending
issues, but I'll try to put more time into this.
I don't think this issues has anything to do with the EJB3 issue but I don't
discard this possibility. I'll update this thread once I have more info.
JBossAS 5.x fails to use EJB's security domain in jboss.xml when
the call is from web container
-----------------------------------------------------------------------------------------------
Key: JBAS-7037
URL: https://jira.jboss.org/jira/browse/JBAS-7037
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Security
Affects Versions: JBossAS-5.0.1.GA, JBossAS-5.1.0.GA
Environment: Problem found on Windows platform
Reporter: Calvin Lin
Assignee: Stefan Guilhen
Fix For: JBossAS-6.0.0.Alpha1
Attachments: ConfigFiles-lib.zip, JBAS-jira-authenBug.zip
A degredation from JBoss 4.0.x and 4.2.x to JBoss 5.0.1.GA and JBoss 5.1.0.GA.
We noticed that the JAAS login in EJB container always picks up the Web app's
security domain when the client login is originated from a web application client. The
security domain specified in EJB container's jboss.xml is always ignored in this
situation.
The detailed problem description is posted on JBoss forum:
http://www.jboss.org/index.html?module=bb&op=viewtopic&t=156863
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:08 p.m.
New subject: [JBoss JIRA] Commented: (JBAS-7037) JBossAS 5.x fails to use EJB's security domain in jboss.xml when the call is from web container
[
https://jira.jboss.org/jira/browse/JBAS-7037?page=com.atlassian.jira.plug...
]
Stefan Guilhen commented on JBAS-7037:
--------------------------------------
The root of the problem is that PreSecurityInterceptor ignores the container's
security domain when the incoming call is a local call. In other words, if a security
context already exists (which is the case when the call is made from within the web
container), then the security domain that has been set in the context is used, ignoring
the domain of the EJB container. I've made some changes to JBoss SX to allow updating
the context's domain and released a new version of JBoss SX. I'll now update the
application server and fix the PreSecurityInterceptor.
JBossAS 5.x fails to use EJB's security domain in jboss.xml when
the call is from web container
-----------------------------------------------------------------------------------------------
Key: JBAS-7037
URL: https://jira.jboss.org/jira/browse/JBAS-7037
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Security
Affects Versions: JBossAS-5.0.1.GA, JBossAS-5.1.0.GA
Environment: Problem found on Windows platform
Reporter: Calvin Lin
Assignee: Stefan Guilhen
Fix For: JBossAS-6.0.0.M3
Attachments: ConfigFiles-lib.zip, JBAS-jira-authenBug.zip
A degredation from JBoss 4.0.x and 4.2.x to JBoss 5.0.1.GA and JBoss 5.1.0.GA.
We noticed that the JAAS login in EJB container always picks up the Web app's
security domain when the client login is originated from a web application client. The
security domain specified in EJB container's jboss.xml is always ignored in this
situation.
The detailed problem description is posted on JBoss forum:
http://www.jboss.org/index.html?module=bb&op=viewtopic&t=156863
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:40 p.m.
New subject: [JBoss JIRA] Closed: (JBAS-7037) JBossAS 5.x fails to use EJB's security domain in jboss.xml when the call is from web container
[
https://jira.jboss.org/jira/browse/JBAS-7037?page=com.atlassian.jira.plug...
]
Stefan Guilhen closed JBAS-7037.
--------------------------------
Resolution: Done
Closing this issue as the problem has been fixed in trunk. JBPAPP-3329 has been created to
port the fix to the EAP branch.
JBossAS 5.x fails to use EJB's security domain in jboss.xml when
the call is from web container
-----------------------------------------------------------------------------------------------
Key: JBAS-7037
URL: https://jira.jboss.org/jira/browse/JBAS-7037
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Security
Affects Versions: JBossAS-5.0.1.GA, JBossAS-5.1.0.GA
Environment: Problem found on Windows platform
Reporter: Calvin Lin
Assignee: Stefan Guilhen
Fix For: JBossAS-6.0.0.M3
Attachments: ConfigFiles-lib.zip, JBAS-jira-authenBug.zip
A degredation from JBoss 4.0.x and 4.2.x to JBoss 5.0.1.GA and JBoss 5.1.0.GA.
We noticed that the JAAS login in EJB container always picks up the Web app's
security domain when the client login is originated from a web application client. The
security domain specified in EJB container's jboss.xml is always ignored in this
situation.
The detailed problem description is posted on JBoss forum:
http://www.jboss.org/index.html?module=bb&op=viewtopic&t=156863
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:52 p.m.
New subject: [JBoss JIRA] Closed: (JBAS-7037) JBossAS 5.x fails to use EJB's security domain in jboss.xml when the call is from web container
[
https://jira.jboss.org/jira/browse/JBAS-7037?page=com.atlassian.jira.plug...
]
Brian Stansberry closed JBAS-7037.
----------------------------------
Fix Version/s: JBossAS-6.0.0.M2
(was: JBossAS-6.0.0.M3)
Resolution: Done
JBossAS 5.x fails to use EJB's security domain in jboss.xml when
the call is from web container
-----------------------------------------------------------------------------------------------
Key: JBAS-7037
URL: https://jira.jboss.org/jira/browse/JBAS-7037
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Security
Affects Versions: JBossAS-5.0.1.GA, JBossAS-5.1.0.GA
Environment: Problem found on Windows platform
Reporter: Calvin Lin
Assignee: Stefan Guilhen
Fix For: JBossAS-6.0.0.M2
Attachments: ConfigFiles-lib.zip, JBAS-jira-authenBug.zip
A degredation from JBoss 4.0.x and 4.2.x to JBoss 5.0.1.GA and JBoss 5.1.0.GA.
We noticed that the JAAS login in EJB container always picks up the Web app's
security domain when the client login is originated from a web application client. The
security domain specified in EJB container's jboss.xml is always ignored in this
situation.
The detailed problem description is posted on JBoss forum:
http://www.jboss.org/index.html?module=bb&op=viewtopic&t=156863
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:52 p.m.
New subject: [JBoss JIRA] Reopened: (JBAS-7037) JBossAS 5.x fails to use EJB's security domain in jboss.xml when the call is from web container
[
https://jira.jboss.org/jira/browse/JBAS-7037?page=com.atlassian.jira.plug...
]
Brian Stansberry reopened JBAS-7037:
------------------------------------
JBossAS 5.x fails to use EJB's security domain in jboss.xml when
the call is from web container
-----------------------------------------------------------------------------------------------
Key: JBAS-7037
URL: https://jira.jboss.org/jira/browse/JBAS-7037
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Security
Affects Versions: JBossAS-5.0.1.GA, JBossAS-5.1.0.GA
Environment: Problem found on Windows platform
Reporter: Calvin Lin
Assignee: Stefan Guilhen
Fix For: JBossAS-6.0.0.M2
Attachments: ConfigFiles-lib.zip, JBAS-jira-authenBug.zip
A degredation from JBoss 4.0.x and 4.2.x to JBoss 5.0.1.GA and JBoss 5.1.0.GA.
We noticed that the JAAS login in EJB container always picks up the Web app's
security domain when the client login is originated from a web application client. The
security domain specified in EJB container's jboss.xml is always ignored in this
situation.
The detailed problem description is posted on JBoss forum:
http://www.jboss.org/index.html?module=bb&op=viewtopic&t=156863
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6025
days inactive
6256
days old
12 comments
5 participants
participants (5)
-
Anil Saldhana (JIRA) -
Brian Stansberry (JIRA)
-
Calvin Lin (JIRA)
-
Chris Imershein (JIRA)
-
Stefan Guilhen (JIRA)