Authentication in EJB ? isn't it passed from the front end ?

[Cosmin Nicolae Vacaroiu]

Hello,

I'm studying for SCBCD JEE6 and I saw in the objectives something that I can't understand.
I know there's a login method with Servlets, but with EJB ?

Implementing Security
[ ] Understand the Java EE security architecture
[ ] Authenticate the caller Examine Java EE authorization strategies
[ ] Use declarative authorization
[ ] Use programmatic authorization Examine the responsibilities of the deployer

Thanks.

[Ivan Krizsan]

Hi!
No, authentication information is not always passed from the front end to an EJB.
For example, think of the case when you expose a web service with an endpoint implementation class being an stateless session bean.
In such a case, the authentication information has to be passed to the web service in one way or another.
Best wishes!

[Cosmin Nicolae Vacaroiu]

I think you meant authentication, not authorization. How can you authenticate and give roles to the client in your example ?

[Ivan Krizsan]

Hi!
Absolutely, I confused authorization with authentication. Thanks for pointing this out!
I have corrected the original post.
Best regards!

[Cosmin Nicolae Vacaroiu]

The problem was with JBoss which didn't checked again for the security, it checked just in the serlvet part.
So I stopped testing on JBoss and installed Glassfish and works perfect.
Thanks.