We have an existing project with security domains for our EJB3s. We are trying to use a similar (or the same) security domain/policy for some of our web applications. I have it working, but it's sort of ugly and I'm trying to figure out what I'm missing.
The main issue is that the security domain will only match the 'other' domain that comes with the JBoss install. For whatever reason, after I decided to use a custom authenticator, the security domain I created will not 'match'.
The goal is to use the SSL_CLIENT_CERT that we receive via HTTP Header and to authenticate/authorize that with our existing policy. This works for EJBs, but not the web app I have tried.
I originally set up the web application (i.e. http://jboss/secure/index.jsp) to have a simple FORM based policy. This worked - when I would attempt to hit that URL I would get prompted for a username/password. Assuming I entered the username/password in my users.properties file, I was able to get to that url.
When I tried to change the login-module.xml to use this login module instead of the generic one, I couldn't seem to 'match' the security domain I created. I toyed around with it and eventually realized it would match 'other', but not the one I created.
Any ideas on why this is so?
Note that I had to change the "other" application-policy to use my CustomWebAppLoginModule to get it to work...otherwise it would just skip this policy and never call CustomWebAppLoginModule.
jboss-service.xml in jboss-web.deploy/META-INF:
In my GenericWebAppHeaderAuthenticator.java, this call is made:
Pertinent parts of my web.xml:
Joined: Oct 03, 2007
The easiest solution is often the most overlooked, at least with most of my mistakes. <sigh>
The problem was my jboss-web.xml. While I forgot to include it in the original post, it did have my desired security domain. However, it was not getting deployed in my .war file, hence why it would only hit the 'other' security domain.