[JBossWS] - RestEasy Security
by jej2003
Has anyone had success with getting the Servlet security to work with RestEasy? To this point I have not been able to successfully limit access a to a resource. Following this guide http://www.jboss.org/file-access/default/members/resteasy/freezone/docs/1... chapter 25 I have got the resource asking for authentication, but when I enter a user that does not have the appropriate role the servlet still allows access. Has anyone seen this?
View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4214156#4214156
Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4214156
15 years, 2 months
- 1
- 0
[JBossWS] - Help with authMethod and security after JBoss501 upgrade
by lukeb
I'm upgrading from 422 to 501 and I'm having security related issues which I'll explain below.
I have a legacy webservice I expose in the following way.
| @Stateless
| @WebService(name = "MyWebService", targetNamespace = "http://my.services.web", serviceName = "MyWebServiceName")
| @WebContext(contextRoot = "/MyEar", transportGuarantee = "NONE", authMethod = "NONE")
| @SOAPBinding(parameterStyle = SOAPBinding.ParameterStyle.WRAPPED, style = SOAPBinding.Style.DOCUMENT, use = SOAPBinding.Use.LITERAL)
| @PermitAll
| public final class MyWebServiceBean {
|
| @WebMethod
| @PermitAll
| public final String doStuff() {
| return "i've done stuff";
| }
| }
|
In 501 this all deploys ok and I can see the wsdl in the jbossws console.
However when I try to call the webservice from my test harness, I get a 403 forbidden at the client and the following in the logs:
| 10:32:14,657 DEBUG [MapperListener] Handle jboss.web:type=RequestProcessor,worker=http-0.0.0.0-8080,name=HttpRequest1 type : JMX.mbean.registered
| 10:32:14,766 TRACE [SecurityRolesAssociation] Setting threadlocal:{}
| 10:32:14,766 TRACE [JaccContextValve] MetaData:org.jboss.metadata.web.jboss.JBossWebMetaData@1f:principalToRoleSetMap{}
| 10:32:14,766 DEBUG [AuthenticatorBase] Security checking request POST /MyEar/MyWebServiceBean
| 10:32:14,766 DEBUG [RealmBase] Checking constraint 'SecurityConstraint[/MyWebServiceBean]' against POST //MyWebServiceBean --> true
| 10:32:14,782 DEBUG [AuthenticatorBase] Calling hasUserDataPermission()
| 10:32:14,782 DEBUG [RealmBase] User data constraint has no restrictions
| 10:32:14,828 TRACE [JBossAuthorizationContext] Control flag for entry:org.jboss.security.authorization.config.AuthorizationModuleEntry{org.jboss.security.authorization.mo
| dules.DelegatingAuthorizationModule:{}REQUIRED}is:[REQUIRED]
| 10:32:14,844 DEBUG [AuthenticatorBase] Calling authenticate()
| 10:32:14,844 DEBUG [[/MyEar] User authentication is not required
| 10:32:14,844 DEBUG [AuthenticatorBase] Calling accessControl()
| 10:32:14,844 DEBUG [RealmBase] Checking roles null
| 10:32:14,860 DEBUG [RealmBase] No user authenticated, cannot grant access
| 10:32:14,860 TRACE [JBossWebRealm] hasResourcePerm:RealmBase says:false::Authz framework says:false:final=false
| 10:32:14,860 DEBUG [AuthenticatorBase] Failed accessControl() test
| 10:32:14,860 TRACE [SecurityRolesAssociation] Setting threadlocal:null
| 10:32:14,860 TRACE [SecurityRolesAssociation] Setting threadlocal:null
|
The parts of the logging above that stand out to me are,
[/MyEar] User authentication is not required
and
[RealmBase] No user authenticated, cannot grant access
...and these seem at odds with each other.
I've tried setting @SecurityDomain to "" and that didn't make any difference.
Note that my stateless bean is within an ejb3 jar within an ear. The ear has a custom security-domain declared in the jboss-app.xml.
Does anyone have any suggestions, I need to web service to ideally work as before, changing the clients would have to be a last resort.
Thanks
Luke
View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4214137#4214137
Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4214137
15 years, 2 months
- 1
- 0
[JBossWS] - Upgrade AS 4.2.3 WS to 3.0.5
by chuaky
hi,
Recently i upgraded the WS module in Jboss Portal 2.7.1 (using AS 4.2.3) because i want to run it offline and there is this issue here:
http://www.jboss.org/community/docs/DOC-12633
Later i notice that jbossws-client.jar is missing from my AS installation/client folder. It seems that jbossws-client.jar has been removed since jbossws-3.0.2.
What is the new jars files after 3.0.2 that are equivalent to the old jbossws-client.jar. I need them to make a standalone web service client.
Thank you.
View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4214068#4214068
Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4214068
15 years, 2 months
- 1
- 0