permaculture playing cards*
The moose likes EJB and other Java EE Technologies and the fly likes simplest way to restrict access to remote EJB calls Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login

Win a copy of Android Security Essentials Live Lessons this week in the Android forum!
JavaRanch » Java Forums » Java » EJB and other Java EE Technologies
Bookmark "simplest way to restrict access to remote EJB calls " Watch "simplest way to restrict access to remote EJB calls " New topic

simplest way to restrict access to remote EJB calls

john ho

Joined: Jan 25, 2008
Posts: 8
I tried asking this at the weblogic forum on but haven't gotten any reply, so I hope someone can help here, it's a general JEE/EJB quesiton on security:

I'm using weblogic 10.3 and I'm new to security with EJB's. I was looking at the documentation at
but got a little overwhelmed by the many options on how to implement security. Plus, I am getting confused between JNDI security and EJB layer security (they're not the same thing, right?)

Can someone explain what the simplest way would be to prevent an "unauthorized" client to make remote EJB calls? For example, I know of the ConnectionFilters that you can implement in weblogic, which can prevent remote callers from making T3 or IIOP calls if they're not from an authorized IP, etc. This is a good start but ideally I would want to password protect the EJBs, and any EJB client would have to provide this username/password somehow. Or possibly use two-way SSL for t3? The client app would have to provide a certificate to prove that it's trusted.

To be clear, I don't think I need the container to handle any very fine-grained access control. I just want to make sure that the client (e.g., a webapp) is a trusted one. Once the EJB container is satisfied that the client is trusted (preferably by user/pass) then the client is free to execute any EJB methods.

Thanks in advance.
E Armitage

Joined: Mar 17, 2012
Posts: 892
Why not use JAAS to secure your EJBs and then your remote clients need to add
to their context lookup properties.
See if this explains better :
john ho

Joined: Jan 25, 2008
Posts: 8
ok, thanks for the reply ... but what you are describing is JNDI lookup security, isn't it? I saw this thread:

If I understand the first reply, from "Jay", that doing this only forces authentication for the EJB lookup, but that is different from security on the EJB's themselves.

However, if I'm only worried about remote invocation of the EJB's, is JNDI authentication sufficient to prevent "rogue" applications from making the EJB calls?

Put another way: without JNDI lookup, is there any other way a client application can still call the EJBs remotely?

I agree. Here's the link:
subject: simplest way to restrict access to remote EJB calls
Similar Threads
please answer this 128 questions for WLS. Urgently!
Authentication Design with EJB
J2EE security through entire enterprise app
question for author Aaron Mudler