2

I use JBoss WildFly, Jax-Rs 2.0 and EJB 3.0.

I am trying to implement authentication by calling login method in my service.

@POST
@PermitAll
public Response login(AuthLoginElement al) {
    try {
        httpRequest.login(al.getUsername(), al.getPassword());
        return Response.status(Response.Status.OK).build();
    } catch (ServletException e) {
        return Response.status(Response.Status.UNAUTHORIZED)
                .entity(e.getMessage())
                .build();
    }
}

Also my EJB is annotated properly to WildFLy documentation.

@Stateless
@RolesAllowed({ "guest", "admin" })
@SecurityDomain("test-policy")
public class SecuredEJB {

public String getSecurityInfo() {
    // Session context injected using the resource annotation
    Principal principal = ctx.getCallerPrincipal();

    return principal.getName();
}

In my standalone.xml I have defined security domain:

            <security-domain name="test-policy" cache-type="default">
                <authentication>
                    <login-module code="Database" flag="required">
                        <module-option name="dsJndiName" value="java:jboss/datasources/SecurityDS"/>
                        <module-option name="principalsQuery" value="select password from  PRINCIPLES where principal_id=?"/>
                        <module-option name="rolesQuery" value="select user_role, 'Roles' from  ROLES where  principal_id=?"/>
                        <module-option name="unauthenticatedIdentity" value="guest"/>
                    </login-module>
                </authentication>
            </security-domain>

However after calling httpRequest.login(), 200 is returned but nothing happens, security logs are clears and user is not authenticated. Could you help me or suggest another way of authentication to EJB?

Drops
  • 2,680
  • 18
  • 16
schaffe
  • 399
  • 2
  • 16
  • 1
    My guess is that you are calling the EJB in a separate request and it throws that the user is unauthenticated. Most probably the `login` does not create a session or (less probably but still an option) the subsequent request to the EJB does not return the session cookie. – Nikos Paraskevopoulos Jun 05 '15 at 13:13
  • I think there may be an option to create security realms but security-domains. – schaffe Jul 06 '15 at 13:19

0 Answers0