HTTP authentication on accessing WSDL

[Tim Storms]

Hi,

I'm trying to use HTTP authenitication when my WSDL is accessed. Authetication should only happen on user/pass and not on roles. During deploy time, I'm getting the following stacktrace in my JBoss 4.2.3:

java.lang.NullPointerException
	at org.jboss.ejb3.security.RoleBasedAuthorizationInterceptorFactory.createPerClass(RoleBasedAuthorizationInterceptorFactory.java:49)
	at org.jboss.aop.advice.AspectFactoryDelegator.createPerClass(AspectFactoryDelegator.java:107)
	at org.jboss.aop.Advisor.addPerClassAspect(Advisor.java:569)
	at org.jboss.aop.advice.ScopedInterceptorFactory.create(ScopedInterceptorFactory.java:72)
	at org.jboss.aop.Advisor.createInterceptorChain(Advisor.java:618)
	at org.jboss.aop.Advisor.pointcutResolved(Advisor.java:888)
	at org.jboss.aop.Advisor.resolveMethodPointcut(Advisor.java:650)
	at org.jboss.aop.ClassContainer.createInterceptorChains(ClassContainer.java:248)
	at org.jboss.aop.ClassContainer.rebuildInterceptors(ClassContainer.java:115)
	at org.jboss.aop.ClassContainer.initializeClassContainer(ClassContainer.java:58)
	at org.jboss.ejb3.EJBContainer.processMetadata(EJBContainer.java:342)
	at org.jboss.ejb3.SessionContainer.processMetadata(SessionContainer.java:140)
	at org.jboss.ejb3.Ejb3Deployment.processEJBContainerMetadata(Ejb3Deployment.java:292)
	at org.jboss.ejb3.Ejb3Deployment.start(Ejb3Deployment.java:356)
	at org.jboss.ejb3.Ejb3Module.startService(Ejb3Module.java:91)
	at org.jboss.system.ServiceMBeanSupport.jbossInternalStart(ServiceMBeanSupport.java:289)
	at org.jboss.system.ServiceMBeanSupport.jbossInternalLifecycle(ServiceMBeanSupport.java:245)
	at sun.reflect.GeneratedMethodAccessor3.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
	at java.lang.reflect.Method.invoke(Unknown Source)
...

I've looked into the source of the RoleBasedAuthorizationInterceptorFactory and on line 49, the following happens:

ctx.lookup("java:/jaas/" + securityAnnotation.value());

This could mean that the "securityAnnotation" variable, which is the SecurityDomain annotation of my web service, is not gathered.
These are my annotations in my web service class:

@Stateless
@SOAPBinding(style = SOAPBinding.Style.RPC, use = SOAPBinding.Use.LITERAL)
@WebService(name = "MyWebService", targetNamespace = "http://mystie.com", serviceName = "myservice")
@WebContext(urlPattern = "/myservice", transportGuarantee = "NONE", secureWSDLAccess = false, authMethod = "BASIC")
@SecurityDomain("mydomain")

In the web.xml of my web app, I've configured the following:

<security-constraint>
		<web-resource-collection>
			<web-resource-name>wsdl</web-resource-name>
			<url-pattern>/myservice</url-pattern>
		</web-resource-collection>
		<auth-constraint />		
	</security-constraint>

My Jboss login-config.xml contains:

<application-policy name="mydomain">
    <authentication>
      <login-module code="org.jboss.security.auth.spi.UsersLoginModule"
        flag="required">
        <module-option name="usersProperties">props/jbossws-users.properties</module-option>
        <module-option name="unauthenticatedIdentity">anonymous</module-option>
      </login-module>
    </authentication>
  </application-policy>

The props/jbossws-users.properties file exists.
I've also tried the approach given on http://jbossws.jboss.org/mediawiki/index.php?title=Authentication, but without any result.
Tips, hints, etc. are very welcome!

[Tim Storms]

Guys, any help on this?

I've managed to get this thing working in a very small dummy application but this problem is still occuring in my companies application. It's a seam application running on JBoss 4.2.3. Could seam somehow be causing this nullpointer?

This is the dependency I use to get the EJB's working:

<dependency>
  <groupId>org.jboss.embedded</groupId>
    <artifactId>jboss-embedded</artifactId>
    <version>beta2</version>
    <scope>provided</scope>
    <type>pom</type>
</dependency>

[Jaikiran Pai]

@SecurityDomain("mydomain")

Post the import statements in your EJB class. For 4.x it should be:

@org.jboss.annotation.security.SecurityDomain("mydomain")

[Tim Storms]

These are my imports regarding EJB's/Web Services:

 import javax.ejb.EJB;
import javax.ejb.Stateless;
import javax.jws.WebParam;
import javax.jws.WebService;

import org.jboss.annotation.security.SecurityDomain;
import org.jboss.wsf.spi.annotation.WebContext; 

The imports should be fine I guess.