[Security & JAAS/JBoss] - Re: Unable to get Subject from SecurityAssociation when call
by kimbaltrue
When the initial EJB bean is called - it's a EJB 3.0 webservice bean - I'm able to get the current context Subject, and from that I can get the principal sets, and from them I can get the full list of a user's roles.
That's actually working.
The problem occurs when I call another EJB 3.0 bean from the first bean. The second bean seems to have lost the initial security context so that I can't get the context Subject.
As for the isCallerInRole this is only useful when you already know the the role. That's taken care of by the @RolesAllowed annotation so I really don't need to call isCallerInRole. What I'm trying to do is allow for dynamic role based access to specific data elements in the database, and I can only do that if I can pull the user's role list.
Also, I'm concerned that if the Subject context is lost then I might not be able to call from one Application server instance to another using the same security associations.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4172329#4172329
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4172329
17 years, 8 months
[Security & JAAS/JBoss] - Re: JAAS Authentication from stand alone client
by ragavgomatam
2 issues here. Lets take the first one. You will have to change your login module to extend jboss AbstractServerLoginModule as follows :-
anonymous wrote : Here is my LoginModule
|
| final public class DbLoginModuleImpl implements LoginModule {
to
anonymous wrote : final public class DbLoginModuleImpl implements AbstractServerLoginModule {
There is a posting for this whole code somewhere earlier in this forum, on how to extend this jboss AbstractServerLoginModule & do a database authentication.
Second issue :- You cannot use a JAAS module only for authentication. JAAS stands for Authentication & Authorization. So as a part of logging in you will have to authenticate & also provide roles. These roles are then used by container in conjunction with j2ee artifacts (web.xml & ejb-jar.xml) to provide role based declarative authorization.This whole process is intimately tied with Roles in j2ee security architecture. Thats why you have anonymous wrote : role elements in web.xml and ejb-jar.xml.
If, however you want to provide default Roles, then go ahead, provide default roles & use these in your module and the web.xml and ejb-jar.xml. However you WILL have to provide roles.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4172326#4172326
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4172326
17 years, 8 months
[Clustering/JBoss] - Generating a NotSerializableException
by sparthan
Hi all,
I want to give clustering support for a small application and it was not successfully done and is generating the following exception stack trace.
java.io.NotSerializableException: nextapp.echo2.webrender.Connection
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1174)
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java:1527)
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java:1492)
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java:1410)
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1168)
at java.io.ObjectOutputStream.defaultWriteFields(ObjectOutputStream.java:1527)
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java:1492)
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java:1410)
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1168)
at java.io.ObjectOutputStream.writeObject(ObjectOutputStream.java:344)
at java.util.concurrent.ConcurrentHashMap.writeObject(ConcurrentHashMap.java:1284)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:623)
at java.io.ObjectStreamClass.invokeWriteObject(ObjectStreamClass.java:963)
at java.io.ObjectOutputStream.writeSerialData(ObjectOutputStream.java:1479)
at java.io.ObjectOutputStream.writeOrdinaryObject(ObjectOutputStream.java:1410)
at java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1168)
at java.io.ObjectOutputStream.writeObject(ObjectOutputStream.java:344)
at org.jboss.web.tomcat.service.session.SessionBasedClusteredSession.writeExternal(SessionBasedClusteredSession.java:175)
at org.jboss.web.tomcat.service.session.JBossCacheService.externalizeSession(JBossCacheService.java:1027)
at org.jboss.web.tomcat.service.session.JBossCacheService.putSession(JBossCacheService.java:316)
at org.jboss.web.tomcat.service.session.JBossCacheClusteredSession.processSessionRepl(JBossCacheClusteredSession.java:121)
at org.jboss.web.tomcat.service.session.JBossCacheManager.processSessionRepl(JBossCacheManager.java:1097)
at org.jboss.web.tomcat.service.session.JBossCacheManager.storeSession(JBossCacheManager.java:652)
at org.jboss.web.tomcat.service.session.InstantSnapshotManager.snapshot(InstantSnapshotManager.java:49)
at org.jboss.web.tomcat.service.session.ClusteredSessionValve.invoke(ClusteredSessionValve.java:98)
at org.jboss.web.tomcat.service.session.JvmRouteValve.invoke(JvmRouteValve.java:84)
at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:84)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:157)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:262)
at org.apache.coyote.ajp.AjpProcessor.process(AjpProcessor.java:437)
at org.apache.coyote.ajp.AjpProtocol$AjpConnectionHandler.process(AjpProtocol.java:366)
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:446)
at java.lang.Thread.run(Thread.java:675)
Please let me know how is this ObjectOutputStream.java is stopping something to be Serialized.
Thank you in advance!!
Sri..
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4172320#4172320
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4172320
17 years, 8 months