Securty Realm Error with GWT 2.0 app on Glassfish V2

[Joe Richard]

RPC Security Error

I have a security realm setup on my machine but I get a security error when my RPC call tries to return back the object.
This is a GWT project...so data object implements IsSerializable instead of Serializable.
The application runs on Glassfish v2.

here is the code;

method:
public CustomerDataModel getNoteData(String serialNumber) {
System.out.println("!== SerialNumber = " + serialNumber);
String[] dataBack = new String[8];

Integer serk = new Integer(serialNumber);
F01131CS messageHeader = headersDAO.getNoteHeader(serk.intValue());
BigDecimal nextHeader = messageHeader.getZZSERK();
List<F01132> messageDetail = notesDetailsDAO.getMessageDetail(nextHeader);
String[] notes = new String[messageDetail.size()];

if (messageHeader != null) {
System.out.println("!== inside of GetMessageDataImpl.getNoteData.messageHeader != null");
dataBack[0] = new Integer( messageHeader.getZZAN8() ).toString();
dataBack[1] = messageHeader.getZZALPH().trim();
dataBack[2] = "$0.00";
dataBack[3] = "$";
dataBack[4] = "$0.00";
dataBack[5] = "";
dataBack[6] = messageHeader.getZZDTI();
dataBack[7] = messageHeader.getZZMSGP().trim();

if (!messageDetail.isEmpty()) {
System.out.println("!== inside of GetMessageDataImpl.getNoteData.messageDetail.isEmpty");
for (int detailCounter=0; detailCounter<messageDetail.size(); detailCounter++) {
F01132 detailLine = (F01132)messageDetail.get(detailCounter);
notes[detailCounter] = detailLine.getCYWTXT();
}
}
else {
notes[0] = " ";
}
}
System.out.println("!== Prepare messageData");
CustomerDataModel messageData = new CustomerDataModel(dataBack, notes);
System.out.println("!== messageData has been prepared sending back");
return messageData;
}

DataObject
public class CustomerDataModel implements IsSerializable {

//private static final long serialVersionUID = 1L;
private String[] listData = new String[8];
private List<String> noteData = new ArrayList<String>();

public CustomerDataModel() {
}

public CustomerDataModel(String[] list, String[] notes) {
setListData(list);
setNoteData(notes);
}
/**
* return all notes for customer
* @return String[]0
*/
public List<String> getNoteData() {
return noteData;
}
/**
* return customer list
* @return String[]
*/
public String[] getListData() {
return listData;
}
/**
* set note data for note list
* @param notedata
*/
public void setNoteData(String[] notedata) {
for (int loop=0; loop<notedata.length; loop++) {
String notes = notedata[loop];
noteData.add(notes);
}
}
/**
* set data for customer list
* @param listdata
*/
public void setListData(String[] listdata) {
listData[0] = listdata[0];
listData[1] = listdata[1];
listData[2] = listdata[2];
listData[3] = listdata[3];
listData[4] = listdata[4];
listData[5] = listdata[5];
listData[6] = listdata[6];
listData[7] = listdata[7];
}
}


Security Setup
(web.xml)
<security-constraint>
<display-name>CollectionNotesAll</display-name>
<web-resource-collection>
<web-resource-name>CollectionNotesAll</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>CollectionNotesAll</role-name>
</auth-constraint>
</security-constraint>

<login-config>
<auth-method>BASIC</auth-method>
<realm-name>glenoitRealm</realm-name>
</login-config>

<security-role>
<description>CollectionNotes all role</description>
<role-name>CollectionNotesAll</role-name>
</security-role>

(sun-web.xml)
<security-role-mapping>
<role-name>CollectionNotesAll</role-name>
<group-name>acccrd</group-name>
<group-name>xclcor</group-name>
<group-name>mis</group-name>
<group-name>usr</group-name>
</security-role-mapping>

(application.xml)
<module>
<web>
<web-uri>CollectionNotesUIBinder.war</web-uri>
<context-root>CollectionNotes_UIBinder</context-root>
</web>
</module>
<module>
<ejb>CollectionNotesEJB.jar</ejb>
</module>
<security-role>
<description>CollectionNotes all role</description>
<role-name>CollectionNotesAll</role-name>
</security-role>

(sun-application.xml)
<security-role-mapping>
<role-name>CollectionNotesAll</role-name>
<group-name>acccrd</group-name>
<group-name>xclcor</group-name>
<group-name>mis</group-name>
<group-name>usr</group-name>
</security-role-mapping>


ERROR:
[#|2010-09-23T09:46:29.778-0400|INFO|sun-appserver9.1|javax.enterprise.system.core.security|_ThreadID=18;_ThreadName=httpSSLWorkerThread-80-4;|
JACC Policy Provider: PolicyWrapper.implies, context(Accounts-Rcv-Collection-Notes/CollectionNotesUIBinder_war)- permission((java.lang.reflect.ReflectPermission suppressAccessChecks))
domain that failed(ProtectionDomain (file:/M:/Sun/AppServer/domains/domain1/applications/j2ee-apps/Accounts-Rcv-Collection-Notes/gwt-user.jar <no signer certificates>)
EJBClassLoader : urlSet = [URLEntry : file:/M:/Sun/AppServer/domains/domain1/applications/j2ee-apps/Accounts-Rcv-Collection-Notes/CollectionNotesEJBClient.jar, URLEntry : file:/M:/Sun/AppServer/domains/domain1/applications/j2ee-apps/Accounts-Rcv-Collection-Notes/CollectionNotesJPA.jar, URLEntry : file:/M:/Sun/AppServer/domains/domain1/applications/j2ee-apps/Accounts-Rcv-Collection-Notes/glenoit-util.jar, URLEntry : file:/M:/Sun/AppServer/domains/domain1/applications/j2ee-apps/Accounts-Rcv-Collection-Notes/gwt-dev.jar, URLEntry : file:/M:/Sun/AppServer/domains/domain1/applications/j2ee-apps/Accounts-Rcv-Collection-Notes/gwt-user.jar, URLEntry : file:/M:/Sun/AppServer/domains/domain1/applications/j2ee-apps/Accounts-Rcv-Collection-Notes/CollectionNotesUIBinder_war/WEB-INF/classes/, URLEntry : file:/M:/Sun/AppServer/domains/domain1/applications/j2ee-apps/Accounts-Rcv-Collection-Notes/CollectionNotesUIBinder_war/WEB-INF/lib/gwt-servlet.jar, URLEntry : file:/M:/Sun/AppServer/domains/domain1/applications/j2ee-apps/Accounts-Rcv-Collection-Notes/CollectionNotesEJB_jar/, URLEntry : file:/M:/Sun/AppServer/domains/domain1/generated/ejb/j2ee-apps/Accounts-Rcv-Collection-Notes/]
doneCalled = false
Parent -> EJBClassLoader :
urlSet = []
doneCalled = false
Parent -> java.net.URLClassLoader@3aef16


(principals com.sun.web.security.WebPrincipal "pgmrjoe")

java.security.Permissions@101d0ba (
(java.io.FilePermission C:\DOCUME~1\ADMINI~1.EXC\LOCALS~1\Temp\\- delete)
(java.io.FilePermission M:/Sun/AppServer/domains/domain1\lib\databases\- delete)
(java.io.FilePermission M:/Sun/AppServer/domains/domain1\imq\instances\imqbroker\log\- delete)
(java.io.FilePermission //goldsboro-gw2/XclQualIssueImages/* delete)
(java.io.FilePermission //goldsboro-gw2.excellfash.com/XclQualIssueImages/* delete)
(java.io.FilePermission <<ALL FILES>> read,write)
(java.net.SocketPermission localhost:1024- listen,resolve)
(java.net.SocketPermission * connect,resolve)
(javax.management.MBeanTrustPermission register)
(java.lang.RuntimePermission getClassLoader)
(java.lang.RuntimePermission loadLibrary.*)
(java.lang.RuntimePermission accessDeclaredMembers)
(java.lang.RuntimePermission getProtectionDomain)
(java.lang.RuntimePermission modifyThreadGroup)
(java.lang.RuntimePermission stopThread)
(java.lang.RuntimePermission setContextClassLoader)
(java.lang.RuntimePermission queuePrintJob)
(java.util.PropertyPermission line.separator read)
(java.util.PropertyPermission java.vm.version read)
(java.util.PropertyPermission java.vm.specification.version read)
(java.util.PropertyPermission java.vm.specification.vendor read)
(java.util.PropertyPermission java.vendor.url read)
(java.util.PropertyPermission java.vm.name read)
(java.util.PropertyPermission * read,write)
(java.util.PropertyPermission os.name read)
(java.util.PropertyPermission java.vm.vendor read)
(java.util.PropertyPermission path.separator read)
(java.util.PropertyPermission java.specification.name read)
(java.util.PropertyPermission os.version read)
(java.util.PropertyPermission os.arch read)
(java.util.PropertyPermission java.class.version read)
(java.util.PropertyPermission java.version read)
(java.util.PropertyPermission file.separator read)
(java.util.PropertyPermission java.vendor read)
(java.util.PropertyPermission java.vm.specification.name read)
(java.util.PropertyPermission java.specification.version read)
(java.util.PropertyPermission java.specification.vendor read)
(javax.management.MBeanPermission [com.sun.messaging.jms.*:*] *)
(unresolved javax.security.jacc.WebUserDataPermission /* null)
(unresolved com.sun.corba.ee.impl.presentation.rmi.DynamicAccessPermission access null)
(unresolved javax.security.jacc.WebResourcePermission /* !GET,POST,PUT)
(unresolved com.sun.enterprise.security.CORBAObjectPermission * *)
(javax.security.auth.PrivateCredentialPermission javax.resource.spi.security.PasswordCredential * "*" read)
)

)|#]

[#|2010-09-23T09:46:29.778-0400|SEVERE|sun-appserver9.1|javax.enterprise.system.container.web|_ThreadID=18;_ThreadName=httpSSLWorkerThread-80-4;_RequestID=94f9369c-3d10-4d49-add6-0233d0f58fed;|WebModule[/CollectionNotes_UIBinder]Exception while dispatching incoming RPC call
java.security.AccessControlException: access denied (java.lang.reflect.ReflectPermission suppressAccessChecks)
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:323)
at java.security.AccessController.checkPermission(AccessController.java:546)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
at java.lang.reflect.AccessibleObject.setAccessible(AccessibleObject.java:107)
at com.google.gwt.user.server.rpc.impl.ServerSerializationStreamWriter.serializeClass(ServerSerializationStreamWriter.java:694)
at com.google.gwt.user.server.rpc.impl.ServerSerializationStreamWriter.serializeImpl(ServerSerializationStreamWriter.java:730)
at com.google.gwt.user.server.rpc.impl.ServerSerializationStreamWriter.serialize(ServerSerializationStreamWriter.java:612)
at com.google.gwt.user.client.rpc.impl.AbstractSerializationStreamWriter.writeObject(AbstractSerializationStreamWriter.java:129)
at com.google.gwt.user.server.rpc.impl.ServerSerializationStreamWriter$ValueWriter$8.write(ServerSerializationStreamWriter.java:152)
at com.google.gwt.user.server.rpc.impl.ServerSerializationStreamWriter.serializeValue(ServerSerializationStreamWriter.java:534)
at com.google.gwt.user.server.rpc.RPC.encodeResponse(RPC.java:609)
at com.google.gwt.user.server.rpc.RPC.encodeResponseForSuccess(RPC.java:467)
at com.google.gwt.user.server.rpc.RPC.invokeAndEncodeResponse(RPC.java:564)
at com.google.gwt.user.server.rpc.RemoteServiceServlet.processCall(RemoteServiceServlet.java:188)
at com.google.gwt.user.server.rpc.RemoteServiceServlet.processPost(RemoteServiceServlet.java:224)
at com.google.gwt.user.server.rpc.AbstractRemoteServiceServlet.doPost(AbstractRemoteServiceServlet.java:62)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:738)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:831)
at sun.reflect.GeneratedMethodAccessor7861.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:276)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:517)
at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:309)
at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:192)
at org.apache.catalina.core.ApplicationFilterChain.servletService(ApplicationFilterChain.java:404)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:290)
at org.apache.catalina.core.StandardContextValve.invokeInternal(StandardContextValve.java:271)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:202)
at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:632)
at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:577)
at com.sun.enterprise.web.WebPipeline.invoke(WebPipeline.java:94)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:206)
at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:632)
at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:577)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:571)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:1080)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:150)
at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:632)
at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:577)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:571)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:1080)
at org.apache.coyote.tomcat5.CoyoteAdapter.service(CoyoteAdapter.java:272)
at com.sun.enterprise.web.connector.grizzly.DefaultProcessorTask.invokeAdapter(DefaultProcessorTask.java:637)
at com.sun.enterprise.web.connector.grizzly.comet.CometEngine.executeServlet(CometEngine.java:547)
at com.sun.enterprise.web.connector.grizzly.comet.CometEngine.handle(CometEngine.java:299)
at com.sun.enterprise.web.connector.grizzly.comet.CometAsyncFilter.doFilter(CometAsyncFilter.java:87)
at com.sun.enterprise.web.connector.grizzly.async.DefaultAsyncExecutor.invokeFilters(DefaultAsyncExecutor.java:175)
at com.sun.enterprise.web.connector.grizzly.async.DefaultAsyncExecutor.interrupt(DefaultAsyncExecutor.java:153)
at com.sun.enterprise.web.connector.grizzly.async.AsyncProcessorTask.doTask(AsyncProcessorTask.java:92)
at com.sun.enterprise.web.connector.grizzly.TaskBase.run(TaskBase.java:265)
at com.sun.enterprise.web.connector.grizzly.ssl.SSLWorkerThread.run(SSLWorkerThread.java:106)
|#]