[jboss-jira] [JBoss JIRA] (WFLY-904) The property AuthorizationManager is null exceptions and NPE on SimpleSecurityManager when connecting firstly from a remote client

[Thomas Reinhardt (JIRA)]

    [ https://issues.jboss.org/browse/WFLY-904?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12992500#comment-12992500 ] 

Thomas Reinhardt commented on WFLY-904:
---------------------------------------

Is there any progress? This is a real showstopper for all applications that want to do security beyound the basic examples. Also, I can NOT confirm that deleting jndi.properties solves the issue (at least in our application, but I may be wrong as it is a fairly complex scenario).

One of the advertised features of JBoss7 / WildFly was security by default. This bugs affects what can be done in reality. This needs a fix, asap.

If you need any testing or if you can point me to a location in the source where I can start debugging I am more than happy to help out. 


> The property AuthorizationManager is null exceptions and NPE on SimpleSecurityManager when connecting firstly from a remote client
> ----------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: WFLY-904
>                 URL: https://issues.jboss.org/browse/WFLY-904
>             Project: WildFly
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) 
>          Components: Security
>         Environment: Eclipse Juno SR2 with JBoss Tools, Mac OS X, Sun JDK 6
>            Reporter: Fernando Nasser
>            Assignee: Darran Lofthouse
>              Labels: eap6, investigation_required
>         Attachments: NPEinSimpleSecurityManager, PBOX000075, QSecuredEJB.jar, QSecuredEJB.zip, SecurityRelatedSettings
>
>
> Description of problem:
> If one tries and use security enabled EJBs from a remote client (authenticated connection) before connecting first from a servlet both a Server NPE and an erroneous exception are thrown.  However, if one uses some servlet-based authentication first, the missing field is "primed" and from that point on the remote application can use the secure EJBs normally, proper Role authorization is checked and enforced etc.  With absolutely no changes in configuration, code (incl. annotation) whatsoever.  Any number of remote client connections will succeed until you restart the server.  Then the errors are back, until you "prime" the Server by connecting using a Servlet.
> More complete data is attached, but here are some info:
> NPE is thrown at:
> org.jboss.as.security.service.SimpleSecurityManager.authenticate(SimpleSecurityManager.java:394)
> Bean method invocation fails with exceptions containing the message:
> JBAS011048: Failed to construct component instance
> I am using the "other" security context for testing.
> I am running the Server in standalone mode.
> When I say remote I mean not in the Server, but I am running my client from localhost.
> Version-Release number of selected component (if applicable):  Seen on EAP 6.1.0 alpha (apparently present on AS 7.1.1 as well).
>  



--
This message was sent by Atlassian JIRA
(v6.2.6#6264)