1

I am getting below error while accessing secured EJB (@RolesAllowed) deployed on GlassFish-A , I am accessing this EJB from Application deployed on Glassfish-B.

Caused by: java.lang.RuntimeException: Cannot propagate username/password required by target when using run as identity at com.sun.enterprise.iiop.security.SecurityContextUtil.getSecurityContext(SecurityContextUtil.java:141) at com.sun.enterprise.iiop.security.SecClientRequestInterceptor.send_request(SecClientRequestInterceptor.java:271) at com.sun.corba.ee.impl.interceptors.InterceptorInvoker.invokeClientInterceptorStartingPoint(InterceptorInvoker.java:290) at com.sun.corba.ee.impl.interceptors.PIHandlerImpl.invokeClientPIStartingPoint(PIHandlerImpl.java:378) at com.sun.corba.ee.impl.protocol.ClientRequestDispatcherImpl.beginRequest(ClientRequestDispatcherImpl.java:323) at com.sun.corba.ee.impl.protocol.ClientDelegateImpl.request(ClientDelegateImpl.java:220) at com.sun.corba.ee.impl.presentation.rmi.StubInvocationHandlerImpl.privateInvoke(StubInvocationHandlerImpl.java:192) at com.sun.corba.ee.impl.presentation.rmi.StubInvocationHandlerImpl.invoke(StubInvocationHandlerImpl.java:150) at com.sun.corba.ee.impl.presentation.rmi.codegen.CodegenStubBase.invoke(CodegenStubBase.java:226) at com.sun.ejb.codegen._GenericEJBHome_Generated_DynamicStub.create(com/sun/ejb/codegen/_GenericEJBHome_Generated_DynamicStub.java) at sun.reflect.GeneratedMethodAccessor131.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at com.sun.ejb.EJBUtils.lookupRemote30BusinessObject(EJBUtils.java:428) ... 107 more

Jens Piegsa
  • 7,399
  • 5
  • 58
  • 106
Chintz
  • 61
  • 5
  • I'd have to look into it, but seems a limitation. Easiest workaround is probably to make sure (if possible) that the remote EJB call is not done from an EJB that's annotated with `@RunAs`. – Arjan Tijms Dec 29 '17 at 06:35
  • @ArjanTijms , the class where lookup is written is not annotated with 'RunAs' – Chintz Jan 03 '18 at 07:39
  • Could be somewhere down the stack as well, i.e. by the class that calls the class doing the lookup etc. `RunAs` can also be defined in xml instead of via an annotation. – Arjan Tijms Jan 03 '18 at 11:19
  • It finds the privateCredSet.isEmpty() then it considers it as "runas" case. Line number 837 in below code. In my case it is getting privatecredSet as empty set. https://github.com/payara/Payara/blob/32f9e683cf01ed0b96de79648dafefa0a6087aa2/appserver/security/ejb.security/src/main/java/com/sun/enterprise/iiop/security/SecurityMechanismSelector.java – Chintz Jan 17 '18 at 06:21

0 Answers0