This week's book giveaway is in the Design forum.
We're giving away four copies of Building Microservices and have Sam Newman on-line!
See this thread for details.
The moose likes EJB and other Java EE Technologies and the fly likes simplest way to restrict access to remote EJB calls Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login

Win a copy of Building Microservices this week in the Design forum!
JavaRanch » Java Forums » Java » EJB and other Java EE Technologies
Bookmark "simplest way to restrict access to remote EJB calls " Watch "simplest way to restrict access to remote EJB calls " New topic

simplest way to restrict access to remote EJB calls

john ho

Joined: Jan 25, 2008
Posts: 8
I tried asking this at the weblogic forum on but haven't gotten any reply, so I hope someone can help here, it's a general JEE/EJB quesiton on security:

I'm using weblogic 10.3 and I'm new to security with EJB's. I was looking at the documentation at
but got a little overwhelmed by the many options on how to implement security. Plus, I am getting confused between JNDI security and EJB layer security (they're not the same thing, right?)

Can someone explain what the simplest way would be to prevent an "unauthorized" client to make remote EJB calls? For example, I know of the ConnectionFilters that you can implement in weblogic, which can prevent remote callers from making T3 or IIOP calls if they're not from an authorized IP, etc. This is a good start but ideally I would want to password protect the EJBs, and any EJB client would have to provide this username/password somehow. Or possibly use two-way SSL for t3? The client app would have to provide a certificate to prove that it's trusted.

To be clear, I don't think I need the container to handle any very fine-grained access control. I just want to make sure that the client (e.g., a webapp) is a trusted one. Once the EJB container is satisfied that the client is trusted (preferably by user/pass) then the client is free to execute any EJB methods.

Thanks in advance.
E Armitage

Joined: Mar 17, 2012
Posts: 988
Why not use JAAS to secure your EJBs and then your remote clients need to add
to their context lookup properties.
See if this explains better :
john ho

Joined: Jan 25, 2008
Posts: 8
ok, thanks for the reply ... but what you are describing is JNDI lookup security, isn't it? I saw this thread:

If I understand the first reply, from "Jay", that doing this only forces authentication for the EJB lookup, but that is different from security on the EJB's themselves.

However, if I'm only worried about remote invocation of the EJB's, is JNDI authentication sufficient to prevent "rogue" applications from making the EJB calls?

Put another way: without JNDI lookup, is there any other way a client application can still call the EJBs remotely?

I’ve looked at a lot of different solutions, and in my humble opinion Aspose is the way to go. Here’s the link:
subject: simplest way to restrict access to remote EJB calls
jQuery in Action, 3rd edition