Bugs item #604258, was opened at 2002-09-03 16:52 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=376685&aid=604258&group_id=22866
Category: JBossSX Group: v3.0 Rabbit Hole >Status: Closed >Resolution: Rejected Priority: 5 Submitted By: Steve Lynch (aaprincipal) Assigned to: Nobody/Anonymous (nobody) Summary: Client-side use of SecurityAssociation Initial Comment: No debug trace available. The following is simply the observed effect of client-side calls to 'secured' EJBs. Scenario: A client app (in this a Java app run from the command line) holds several Subjects as a result of calls to several different LoginContexts. Calls to the same session bean were made using these different Subjects by means of 'Subject.doAs(...)'. This scenario may not be common but does not seem unreasonable. Observation: The effect as far as roles/permissions at the server was as if the Subject was that of the last successful call to 'LoginContext.login()' rather than, as expected, that of the 'Subject.doAs()' Subject. Workaround: Setting the ClientLoginModule to 'multi- threaded' and having associated '...login()'/'...doAs()' calls in a separate thread brought about the desired effect but seemed cumbersome under the circumstances. Note: It seems to me that the SecurityAssociation, whilst a good Principal/Credential <-> Subject mapping mechanism at the server-side, is inappropriate at the client side. Surely the Subject _is_ the mapping mechanism - would also get rid of the need for 'multi- threaded' flag. ---------------------------------------------------------------------- >Comment By: Scott M Stark (starksm) Date: 2002-09-24 14:27 Message: Logged In: YES user_id=175228 Having to use the Subject.doAs construct is too instrusive and non-portable. If you want this as the mechanism for client side propagation of the thread caller write your own client side security interceptor. ---------------------------------------------------------------------- Comment By: Holger Engels (hengels) Date: 2002-09-04 01:51 Message: Logged In: YES user_id=315382 what you actually need is a client container, that deploys a application-client jar, where you can define ejb-refs and provide run-as mappings. Subject.doAs is another possibility, that works without client the container approach. In any case, the association of the correct principal with the invocation is the job of a client side interceptor. Holger PS: it's always the same with me: I have ideas, I am taking part at discussions but don't have the time to actually DO it. Sorry! ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=376685&aid=604258&group_id=22866 ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Jboss-development mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-development
