[jboss-dev-forums] [Security Development] New message: "Keeping the state of Caller principal in JBoss AppServer when authenticating from standalone WebServer"

[Eric Loh]

JBoss development,

A new message was posted in the thread "Keeping the state of Caller principal in JBoss AppServer when authenticating from standalone WebServer":

http://community.jboss.org/message/530097#530097

Author  : Eric Loh
Profile : http://community.jboss.org/people/eric1lyk

Message:
--------------------------------------------------------------
Dear experts,
 
I have problems understanding how i can maintain the Authentication Principal in the JBoss Appserver for subsequent invokations of an EJB3 Stateless session bean from a standalone client.
 
I have EJB3 Stateless session beans deployed on JBoss 5.1.0 AS
 
 
My Client is deployed on a Apache Tomcat Webserver (version 6.0.20)
 
My Client (deployed on Tomcat Webserver) uses the following Login Config to do authentication.
 
*myapp-login {*
*    com.myapp.services.authentication.client.jaas.OasisLoginModule requisite debug="true"*
*    facadeJndiName="myApp/authentication"*
*    java.naming.factory.initial="org.jnp.interfaces.NamingContextFactory"*
*    java.naming.factory.url.pkgs="org.jboss.naming:org.jnp.interfaces"*
*    java.naming.provider.url="jnp://localhost:1099";*
*   * 
*    org.jboss.security.ClientLoginModule sufficient debug="true"*
*    multi-threaded="true";*
*};*
 
I realised that *org.jboss.security.ClientLoginModule is required so that the CallerPrincipal gets propagated from my Client to JBoss AppServer*
 
*org.jboss.security.ClientLoginModule sufficient debug="true"*
 
After I login, i created an InitialContext to lookup the EJB3 stateless session bean deployed in JBoss.
 
I try to test if the Stateless session bean can obtain the principal that i propagated frmo the Tomcat Webserver to JBoss AS
 
The first time i called, the context.getCallerPrincipal() was able to return the principal that i set inside the Callbackhandler.
 
*@Stateless*
*public class AuthenticationComponentFacadeBean extends AbstractComponentFacade<IAuthenticationComponentServiceLocator> implements IAuthenticationComponentFacade*
*{  * 
*    @Resource*
*    SessionContext context;*
*
*
*    @Override*
*    public char[] resetPassword(MyCredentials credential) throws AuthenticationException*
*    {*
*            if (context.getCallerPrincipal() != null)*
*            {*
*                 System.out.println("principal: " + context.getCallerPrincipal());*
*            }*
 
 
But, in subsequent invocations when i create the InitialContext again, I am getting NullPointerException
 
*15:16:50,538 INFO  [STDOUT] 2010-03-05 15:16:50,538 [ERROR] - [AuthenticationComponentFacadeBean] java.lang.NullPointerException*
*        at org.jboss.ejb3.security.helpers.EJBContextHelper.getCallerPrincipal(EJBContextHelper.java:99)*
 
i.e. The CallerPrincipal gets lost in subsequent invocations.
 
Can someone tell me how i can maintain the CallerPrincipal inside JBoss AppServer until i perform a logout operation to invalidate my session?
 
*What is the correct way to do it?*
*
*
*Should I invoke the ClientLoginModule at my Client on Tomcat Webserver everytime i lookup a stateless session bean so that it will keep the CallerPrincipal there?*
 
*Is there a way to keep the CallerPrincipal without invoking the ClientLoginModule everytime i do a lookup?*

--------------------------------------------------------------

To reply to this message visit the message page: http://community.jboss.org/message/530097#530097