securing web service developed as an EJB

[anas alsarairah]

Hello All

i am tryieng to secure a web service that is developed as an EJB 3.1 , here is the code for the service

@Stateless
@WebService(name = "AnasServ", serviceName = "serva")
@HandlerChain(file = "handlerChain.xml")
public class Anas {

    @WebMethod
    @RolesAllowed("ecs")
    public TestResponse sayAnas(TestRequest req) {

        System.out.println("inside say Anas");
        return new TestResponse("my response as string");
    }
}

also here is the deployment descripter i am using

<?xml version="1.0" encoding="UTF-8"?> <web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"> <session-config> <session-timeout> 30 </session-timeout> </session-config> <security-constraint> <display-name>Constraint1</display-name> <web-resource-collection> <web-resource-name>res</web-resource-name> <description/> <url-pattern>/*</url-pattern> </web-resource-collection> <auth-constraint> <description/> <role-name>ecs</role-name> </auth-constraint> </security-constraint> <login-config> <auth-method>BASIC</auth-method> <realm-name>file</realm-name> </login-config> <security-role> <description/> <role-name>ecs</role-name> </security-role> </web-app>

and here is my sun-web.xml

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE sun-web-app PUBLIC "-//Sun Microsystems, Inc.//DTD GlassFish Application Server 3.0 Servlet 3.0//EN" "http://www.sun.com/software/appserver/dtds/sun-web-app_3_0-0.dtd"> <sun-web-app error-url=""> <context-root>/Anas</context-root> <security-role-mapping> <role-name>ecs</role-name> <group-name>ecs</group-name> </security-role-mapping> <class-loader delegate="true"/> <jsp-config> <property name="keepgenerated" value="true"> <description>Keep a copy of the generated servlet class' java code.</description> </property> </jsp-config> </sun-web-app>


i have also created a user of group ecs in the application server and by the way i am using glassfish application server v3.1 , now whwen try to test this service using Soap UI and providing the user that i have created for group ecs i get the following error

[b]java.lang.Exception: Client not authorized for invocation of public com.ans.TestResponse com.ans.Anas.sayAnas(com.ans.TestRequest)[/b]

[ramesh kancherla]

Hi anas,

recently i got same problem. & i solved my problem as

username and password are configure in Glashfish server for that role ecs.

I have given that username and password in Soup ui request properties.

I got solve my problem.

I think it is help full for you.

Regards
Ramesh

[anas alsarairah]

hi
thanks for your reply .. i am already putting the user name and password in soap UI but the same ... so can you please post your code example here if possible

thank you

[ramesh kancherla]

http://jee-bpel-soa.blogspot.com/2009/03/securing-web-services-with-http-basic.html

i followed this article


Regards
Ramesh

[Wouter Oet]

Please UseCodeTags when posting code. It will highlight your code and make it much easier to read. It probably will also increase the number of people helping you. I've added them for you since you are new so that you can see the difference.