[jboss-jira] [JBoss JIRA] Commented: (EJBTHREE-2255) @SecurityDomain has no equivalent for <security-domain/>

[Richard Kennard (JIRA)]

    [ https://issues.jboss.org/browse/EJBTHREE-2255?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12607333#comment-12607333 ] 

Richard Kennard commented on EJBTHREE-2255:
-------------------------------------------

Sorry, I understand what you mean now!

In my case there *is* a security-domain in jboss.xml. It is a 'top-level' security-domain, so that I don't have to individually specify a security-domain for every EJB/MDB in my app.

What I want to do is *remove* the security-domain just for this particular EJB. You can do this in jboss.xml by putting an empty <security-domain/> against that EJB (see attached test case). However you can't seem to do the same by putting an empty annotation @SecurityDomain( "" ) inside the class itself.

I believe this should be supported.

> @SecurityDomain has no equivalent for <security-domain/>
> --------------------------------------------------------
>
>                 Key: EJBTHREE-2255
>                 URL: https://issues.jboss.org/browse/EJBTHREE-2255
>             Project: EJB 3.0
>          Issue Type: Bug
>         Environment: JBoss 6.0.0.Final
>            Reporter: Richard Kennard
>         Attachments: SecurityDomainTest.zip
>
>
> Test case attached.
> We have found it useful to turn off the security-domain for certain EJBs so that they can be accessed from unauthenticated clients. We can do this in jboss.xml using <security-domain /> but not, it seems, from an EJB using the @SessionDomain annotation.
> A @SessionDomain( "" ) is simply ignored.
> We're not a big fan of hard-coding security domain names inside EJBs, but it seems fine to be able to say 'this EJB has no security domain at all'. Should the annotation work for this?

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira