----- Original Message -----
Sent: Friday, May 10, 2002 12:06 PM
Subject: RE: Session full web service
with ejb provider and JAAS security
I
figured out the answers to my questions.
Let
me reply to myself, just in case somebody else is
interested.
1)
The stateful bean stopped to be maintained by the ejb container in the
following cases:
- timing out in the ejb container. The ejb container, when
the stateful is not used for a while, can destroy the bean. I did not find any
code in the Axis EJBProvider to handle that correctly
(axis-beta2).
- if the ejb client object (the object created by the
EJBProvider) is explicitly calling remove, it will recycle the stateful bean.
I did not see any code in Axis to do this kind of cleanup if the Axis session
times out.
I
was actually wrong when saying that destroying the Call object will recycle
the stateful bean. When the Call object is destroyed (actually, it is more
when my java axis client program finishes), the axis session will eventually
timeout (I guess) and the ejb client will disapear, but as I said above, I did
not see any code in Axis for a proper cleanup of the ejb (remove should be
called).
2)
The problem has nothing to do with Axis. My ejb container is JBoss, and their
interpretation of the EJB spec is that a security exception is a runtime
exception and a runtime exception is destroying the stateful bean. So after
the first security exception, the stateful bean is gone, but axis is still
caching the ejb client object to this bean, so when I invoke a new web service
operation, I get some object not found type of exceptions. I sent another post
in the axis-dev list to find out if I have a way, from the client, to remove
the cached service object in a session scope service. No answers
yet.
Thomas
I have been playing with axis beta1, jboss2.4.4
with tomcat4.0.1 bundled together in order to create a web service with an
ejb implementation.
It is working quite well. By doing a stateful
ejb, I also played with the request, session and application scope of the
web service and the whole chain is working fine. The stateful ejb is doing
what it is supposed to do, and with a session scope web service, axis is
making sure that my ejb client session is reused across requests.
I also managed to setup JAAS permissions on the
ejb and having the web service client code to login in order to make a
successful call.
I have actually two questions:
1) May be this is due to my poor knowledge of
ejb, but I read in a couple of places that the stateful ejb will be
maintained by the ejb container as long as the client is not timing out (or
explicitly calling remove). What does this mean in the axis context? If I
declare my web service with an application scope, does it mean that my
stateful bean will always be maintained (as long as ejb container does not
stop)? In the case of a session scope, with a java client program to the web
service, what does it mean to timeout and if it can timeout, is it
propagated to the ejb stateful bean? Obviously, if the Call object that I am
using to do the web service calls is destroyed, the ejb stateful bean is
recycled. But does it mean that it will never be recycled as long as this
object is alive?
2) The second question is actually more a problem
than a question. When setting JAAS security on the ejb implementation, if
the web service client code is getting a security exception, it seems that I
can not do any further call to the web service. In the axis client code
included below, I login as user1. user1 has the right to call getValue, but
not setValue (those rights are defined through JAAS permissions on the ejb
implementation: some <method-permission> in the ejb-jar.xml used to
deploy the ejb). Calling getValue is working ok. When calling setValue, I
get an exception. So far, so good. Trying to call getValue again, and I get
some weird exceptions. Any ideas?
Thanks.
Thomas
Code:
======
System.out.println
("user1");
Service service = new Service
();
Call call = (Call) service.createCall
();
call.setTargetEndpointAddress (new
java.net.URL (END_POINT_URL));
call.setUsername ("user1");
call.setPassword ("user1");
call.setMaintainSession (true);
call.setOperationName (new QName ("Demo", "getValue"));
System.out.println (call.invoke (new Object
[]{}));
try {
call.setOperationName (new QName ("Demo",
"setValue"));
call.invoke
(new Object []{user + " value"});
}
catch (Exception e) {
System.out.println (e);
}
call.setOperationName (new QName ("Demo",
"getValue"));
System.out.println
(call.invoke (new Object []{}));
Output:
======
run-axis-client:
[java] user1
[java] getValue
return
[java]
java.rmi.ServerException: Transaction rolled back; nested exception
is:
[java] java.rmi.RemoteException:
checkSecurityAssociation; nested exception is:
[java]
java.lang.SecurityException: Insufficient method permissions,
principal=user1, method=setValue, required
Roles=[role2], principalRoles=[role1,
guest]
[java]
java.rmi.NoSuchObjectException: Could not activate; nested exception
is:
[java] java.io.FileNotFoundException:
H:\JBoss-2.4.4_Tomcat-4.0.1\jboss\db\sessions\Demo\1020409195143.ser
(The
system cannot find the file
specified)
