[jboss-user] [Security & JAAS/JBoss] - Re: How to let

[bjolletz]

Thanks for your reply!

I am already using a security domain. I'll try to describe my problem better:

For example, I have a bean like this:


  | @StateLess
  | @SecurityDomain("MySecurityDomain")
  | public class MyEntityManagerSLB {
  | 
  |   @RolesAllowed({"admin", "developer"})
  |   public void foo() {
  |     // Method that a user with admin or developer roles may use
  |     ...
  |   }
  | 
  |   @RolesAllowed("system")
  |   public void bar() {
  |     // Method that only "the system" may use. "The system" referring to scheduled tasks run by a timer.
  |     ...
  |   }
  | }
  | 

The problem is to make "the system" able to run the bar method. I can't figure out how to make "the system" authenticated in the "MySecurityDomain".

My first idea was to use @RunAs("system") in the scheduled timer methods , but to be able to use @RunAs in a class, that class must also have a security domain. If I put @SecurityDomain("MySecurityDomain") on the timer class I will get an Authentication Exception. This is understandable, since the code in this class is really not being run by someone logged in to the sucurity domain, but rather from "the system", which is not authenticated in the security domain.

I don't know if I've made this any more understandable, but maybe you understand what I'm trying to do.

/Daniel

View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4080784#4080784

Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4080784