[jboss-user] [Security] - Re: java.lang.SecurityException: Denied: caller with subject

Hi, Thanks for the reply! As you suggessted, I have rollbacked the changes that made in security-policies-jboss-beans.xml. Now this file is as it is we will get in Jboss installation. I am not build new application, this is old application developed in EJB1.1. [Is it required to upgrade to EJB3.0 but I didnt think so its required]. Now the jboss.xml in "ejb-jar"/META-INF looks like as follows : <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE jboss PUBLIC "-//JBoss//DTD JBOSS 5.0//EN" "http://www.jboss.org/j2ee/dtd/jboss_5_0.dtd"> <security-domain>java:/jaas/UIdPSso</security-domain> <enterprise-beans> <ejb-name>DsBean</ejb-name> <jndi-name>DsBean</jndi-name> </enterprise-beans> I could see from the log that its making call to the CustomLoginModule & getting the Subject. But its throwing java.lang.SecurityException. But I am able to access unprocted EJBs and protected servlet. Just for your reference from the log file: java.lang.SecurityException: Denied: caller with subject=Subject: Principal: jaasuser Principal: Roles(members:DSBeanRole,ProtectedServletGroup,ValidUser,jaasrole) Principal: CallerPrincipal(members:jaasuser) and security context post-mapping roles=Roles(DSBeanRole,ProtectedServletGroup,ValidUser,jaasrole,). Is that I need the caller subject to EJBContext in my Servlet or do I need to define some policy file to give permission? If yes, could you please let me know how to set. Thanks & Regards, Sangeetha View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4264332#... Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&a...