[jboss-user] [Security & JAAS/JBoss] - JBoss 5 authentication / authorization problem

[apph_]

Hello,

I'm having problems integrating JBoss 5 authentication / authorization in my application. I'm using EJB3, JSF 2 (but it's maven project, so actually JBoss JSF implementation is used) + Facelets.

The configuration is as follows:

1. First i've added jboss-web.xml to my WEB-INF directory. File content looks like this:

  | <?xml version="1.0" encoding="UTF-8"?>  
  | <!DOCTYPE jboss-web PUBLIC "-//JBoss//DTD Web Application 2.4//EN" "http://www.jboss.org/j2ee/dtd/jboss-web_5_0.dtd">
  | <jboss-web>
  |         <security-domain>java:/jaas/toy-shop-realm</security-domain>
  | </jboss-web>
  | 

2. I have added security domain configuration to login-config.xml located in JBOSS_INSTALL_DIR\server\default\conf\ like this:

  |    <application-policy name="toy-shop-realm">
  |     <authentication>
  |           <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule" flag="required">
  |             <module-option name="usersProperties">props/toy-shop-users.properties</module-option>
  |         <module-option name="rolesProperties">props/toy-shop-roles.properties</module-option>
  |                 <module-option name="securityDomain">java:/jaas/toy-shop-realm</module-option>
  |           </login-module>
  |         </authentication>
  |   </application-policy>
  | 
As you can see there are two files: toy-shop-users.properties and toy-shop-roles.properties in JBOSS_INSTALL_DIR\server\default\conf\props\ directory.

toy-shop-users.properties content is as simple as:
admin=admin
user=user

and toy-shop-roles.properties:
admin=admin
user=user

3. I have defined URL addresses security in web.xml in WEB-INF directory:

  | <security-constraint>
  |                 <web-resource-collection>
  |                         <web-resource-name>all</web-resource-name>
  |                         <url-pattern>/*</url-pattern>
  |                 </web-resource-collection>
  |                 <auth-constraint>
  |                         <role-name>user</role-name>
  |                 </auth-constraint>
  |         </security-constraint>
  |        
  |         <security-role>
  |                 <role-name>admin</role-name>
  |         </security-role>
  |         <security-role>
  |                 <role-name>user</role-name>
  |         </security-role>
  |        
  |         <login-config>
  |                 <auth-method>FORM</auth-method>
  |                 <form-login-config>
  |                         <form-login-page>/login.jsp</form-login-page>
  |                         <form-error-page>/error.jsp</form-error-page>
  |                 </form-login-config>
  |         </login-config>
  | 
The login.jsp page simply uses j_security_check for authentication.

4. And finally some security annotation in EJB bean:

  | @SecurityDomain("toy-shop-realm")
  | @RolesAllowed({"admin", "user"})
  | @Stateless
  | public class PaymentLogic implements PaymentContract {
  |        
  |         @EJB(mappedName="PaymentJpaDao/local")
  |         private PaymentDao paymentDao;
  | 
  |         @RolesAllowed({"admin"})
  |         public List<Payment> getActivePayments() {
  |                 return paymentDao.getActivePayments();
  |         }
  | }
  | 

PaymentContract is simple interface with one method and no annotations.
PaymentJpaDao is defined as Stateless bean.

Now, when i start the application it requires authentication. If i provide non-defined user name i will not go through. If it's 'user' or 'admin' defined in properties file it is ok. But it looks like security annotations are completely ignored. Everybody can invoke getActivePayments method. Web application is tested as war (will be packed as ear in future) and it uses another library with defined EJB's (PaymentLogic, PaymentJpaDao, etc.). Now if i add jboss.xml file to META-INF directory of this library:

  | <jboss>
  | 	<security-domain>toy-shop-realm</security-domain>
  | </jboss> 
  | 
then when i invoke getActivePayments logged as 'user' i'll get  EJBAccessException: Caller unauthorized. This is great. But when i invoke it as 'admin', i'll get the 403 error - access denied. If I add <role-name>admin</role-name> in <auth-constraint> in web.xml i'll also get EJBAccessException: Caller unauthorized for 'admin' login.

What am i missing?

Thx for any help.

View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4206330#4206330

Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4206330