[jboss-user] [Security & JAAS/JBoss] - Re: Integration of Custom Client and Server Login Modules

Thanks for your patience as I know this may seem to some as straight forward. I have already succeeded in a previous project to use BASIC web authentication attached to a domain using the JBoss UsersRolesLoginModule. Only Customer and Admin roles can access specific web pages and then calls to remote EJBs are also restricted based on role. Web.xml: | | <security-role> | <role-name>admin</role-name> | </security-role> | <security-role> | <role-name>customer</role-name> | </security-role> | | <login-config> | <auth-method>BASIC</auth-method> | <realm-name>BankDomain</realm-name> | </login-config> | | | JBoss-web.xml: | <?xml version="1.0" encoding="UTF-8"?> | <jboss-web> | <security-domain flushOnSessionInvalidation="false">java:/jaas/BankDomain</security-domain> | <context-root>/bank</context-root> | </jboss-web> JBoss.xml: | <jboss> | <security-domain>java:/jaas/BankDomain</security-domain> | </jboss> The target bean is the same remote stateless session bean, BankMgr, which uses the Caller Principle in the way you mentioned: public CustomerData getMyData() throws bank.BankException { | Principal p = context.getCallerPrincipal(); | String userN = p.getName(); | if (userN.equalsIgnoreCase("ANONYMOUS") || userN.equalsIgnoreCase("GUEST")) { | throw new BankException("BankMgrBean: getMyData - User not logged in"); | } | int pUserId = Integer.parseInt(userN); However, what I wanted to show in this Proof of Concept (PoC) project was that client authentication could be executed independently from server side resource control e.g. bean method execution. Such a scenario would occur if authentication of the client is not under your control however authorisation to use server side (remote) resources are. Thus, I can not use the same security realm for both the client and server resources. Thanks again for your help. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3958791#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...