[jboss-jira] [JBoss JIRA] Commented: (EJBTHREE-2042) Investigate performance issue related to use of @SecurityDomain on EJB

[jaikiran pai (JIRA)]

    [ https://jira.jboss.org/jira/browse/EJBTHREE-2042?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12519644#action_12519644 ] 

jaikiran pai commented on EJBTHREE-2042:
----------------------------------------

When a @SecurityDomain is involved, the Ejb3AuthenticationInterceptorv2 and RoleBasedAuthorizationInterceptorv2 come into picture. These interceptors have some relatively heavy processing involved for authentication/authorization.

A quick look shows that even with @PermitAll being set, we end up doing a (expensive) authorization call. Discussion about this is here http://community.jboss.org/message/531585#531585. Carlo, pointed out that skipping the authorization may not be an option because of auditing requirements.


> Investigate performance issue related to use of @SecurityDomain on EJB
> ----------------------------------------------------------------------
>
>                 Key: EJBTHREE-2042
>                 URL: https://jira.jboss.org/jira/browse/EJBTHREE-2042
>             Project: EJB 3.0
>          Issue Type: Task
>            Reporter: jaikiran pai
>            Assignee: jaikiran pai
>
> A user has reported that the use of @SecurityDomain shows a relatively poor performance (even when a @PermitAll) is applied to the bean. See the referenced forum thread for details. 
> Although, it can't be guaranteed that the performance of a bean method invocation with a @SecurityDomain will be same as that without a @SecurityDomain, the difference in the timings as reported in that thread looks a bit too high. This JIRA is to track to investigate the issue and see if there's any genuine performance bug.
>  

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira