vendredi 31 juillet 2015

How to make simple JAAS login module work (EJBs, Tomcat, WebLogic)?

I want to create a simple login module which authenticates users so they can, through a servlet using the weblogic client, access EJB's methods annotated with @RolesAllowed. As you probably noted, I have two seperate tiers - one with a webapp (Tomcat) and one containing business logic (WebLogic).

Generally speaking, I followed this JAAS tutorial (setting things accordingly).

According to the answer to this question, the principals should be propaged to the business tier (even having the tiers on separate machines?)

However, what I'm getting is an error page with following header: HTTP Status 500 - [EJB:010160]Security violation: User <anonymous> has insufficient permission to access EJB type=<ejb>

Also, I created corresponding roles in the WebLogic console.

Some tests from the servlet's GET method (without calling Bean's annotaed method):

request.getUserPrincipal().getName(): ADMIN
request.getParameter("role"): null
request.isUserInRole("admins"): true

(request is obtained from the argument @Context HttpServletRequest request)

Is there any additional thing to do to make it work? Or is it sufficient but there may be an error somewhere?

Let me also point I'm quite new in creating Java EE applications.

Help appreciated

Aucun commentaire:

Enregistrer un commentaire