Having major problems setting up a user on JNDI Security using JBoss 5

[Luke Murphy]

Hi,
I am trying to write some simple programs to explore the power of security in EJB 3.0. I am using JBoss 5.
According to this cool and short article: http://community.jboss.org/wiki/JndiLoginInitialContextFactory

I should be able to set up a User / Password on JNDI as described in the article and invoke an EJB method that has security constraints.

Here is my EJB:

@Stateless
@SecurityDomain("TitanIdentityDB")
@RolesAllowed("AUTHORIZED_MERCHANT")
public class TravelAgentBean implements TravelAgentRemote {

    public Cabin findCabin(int pKey) {
        ...
    }

}

Here is the application-policy I added to login-config.xml

<application-policy name="TitanIdentityDB">
    <authentication>
      <login-module code="org.jboss.security.auth.spi.UserRolesLoginModule"
        flag="required">
         <!-- Any existing security context will be restored on logout -->
         <module-option name="usersProperties">props/user-titan.properties</module-option>
         <module-option name="rolesProperties">props/roles-titan.properties</module-option>
      </login-module>
    </authentication>
  </application-policy>

Here is user-titan.properties

admin=admin

Here is roles-titan.properties

admin=AUTHORIZED_MERCHANT

And here is my stand alone client which runs outside the EJB container.

public class TextClient {
     public static Context getInitialContext() throws NamingException {
        if (context == null){
            Properties p = new Properties();
            p.put(Context.INITIAL_CONTEXT_FACTORY, "org.jboss.security.jndi.JndiLoginInitialContextFactory");
            p.put(Context.PROVIDER_URL, "jnp://localhost:1099");
            p.put(Context.SECURITY_PRINCIPAL, "admin");
            p.put(Context.SECURITY_CREDENTIALS, "admin");
            context = new javax.naming.InitialContext(p);
        }
        return context;
     }

     public static void main(String[] args) throws Exception{
        java.lang.Object ref = getInitialContext().lookup("TravelAgentBean/remote");

        TravelAgentRemote dao =
            (TravelAgentRemote)PortableRemoteObject.narrow(ref, TravelAgentRemote.class);

            cabin_2 = dao.findCabin(1);

     }

}

When I run the client I keep getting:

Exception in thread "main" javax.ejb.EJBAccessException: Invalid User
    at org.jboss.ejb3.security.Ejb3AuthenticationInterceptorv2.invoke(Ejb3AuthenticationInterceptorv2.java:165)
    at org.jboss.aop.joinpoint.MethodInvocation.invokeNext(MethodInvocation.java:102)

And I am tearing my hair out about this all day.



Any ideas?



Thanks in Advance.

[Sunil Dixit]

Hey Luke,

I can give hints on EJB security, I have done this on WSAD but not on JBOSS, so probably you have do extra work/investigation.
Before I jump to the steps what I have done in WSAD, you need to understand whats wrong in code snippet.
You have configured JAAS module in JBOSS server which will be called automatcially whenever you call LoginContext.login(...)
Whenever you use EJB security there are two possiblities/paths:

1. User is already authenticated and authorised before you invoke any EJB method/s.
2. User is not authenticated and authorised before you invoke any EJB method/s.

Case 1: Principals and Credentials (returned by login API) are set in ThreadLocal before you make a call. Once server recevived these data then it trust on caller and check/extract the role information and if role matches with specified role then it allows method invocation otherwise it throws exception.

Case 2 : Whenever you pass user details using Context.SECURITY_PRINCIPAL, Context.SECURITY_CREDENTIALS then server tries to do authentication based on passed details and they are correct then its tries to match roles.

Again that dependces what EJB flow we are talking (i.e. we want that user passes their details and server first do authentication and then role check OR user details are already authenticated and we would like to use Principals and Credentials )

Now in WSAD what we do is , we defines roles and then map roles to methods (using ejb-jar.xml or annotations). before you deploy the build you use WSAD feature to collect all roles defines in EJB-jar.xml and then map these roles to specific OU (org unit). After this you start deployment and container ask you lookup all roles from LDAP or some files and map these roles to your EJB. once this mapping is done,container know what role and OU maps to which role and OU.


Hope that this helps.

Thanks,
Sunil Dixit

[Jaikiran Pai]

JNDILoginIntialContextFactory is no longer supported in AS-5. See this recent discussion

[Luke Murphy]

Thanks for both answers.