File APIs for Java Developers
Manipulate DOC, XLS, PPT, PDF and many others from your application.
http://aspose.com/file-tools
The moose likes EJB and other Java EE Technologies and the fly likes simplest way to restrict access to remote EJB calls Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login
JavaRanch » Java Forums » Java » EJB and other Java EE Technologies
Bookmark "simplest way to restrict access to remote EJB calls " Watch "simplest way to restrict access to remote EJB calls " New topic
Author

simplest way to restrict access to remote EJB calls

john ho
Greenhorn

Joined: Jan 25, 2008
Posts: 8
I tried asking this at the weblogic forum on oracle.com but haven't gotten any reply, so I hope someone can help here, it's a general JEE/EJB quesiton on security:

I'm using weblogic 10.3 and I'm new to security with EJB's. I was looking at the documentation at http://docs.oracle.com/cd/E13222_01/wls/docs103/ConsoleHelp/taskhelp/security/ManageSecurityForDD.html
but got a little overwhelmed by the many options on how to implement security. Plus, I am getting confused between JNDI security and EJB layer security (they're not the same thing, right?)

Can someone explain what the simplest way would be to prevent an "unauthorized" client to make remote EJB calls? For example, I know of the ConnectionFilters that you can implement in weblogic, which can prevent remote callers from making T3 or IIOP calls if they're not from an authorized IP, etc. This is a good start but ideally I would want to password protect the EJBs, and any EJB client would have to provide this username/password somehow. Or possibly use two-way SSL for t3? The client app would have to provide a certificate to prove that it's trusted.

To be clear, I don't think I need the container to handle any very fine-grained access control. I just want to make sure that the client (e.g., a webapp) is a trusted one. Once the EJB container is satisfied that the client is trusted (preferably by user/pass) then the client is free to execute any EJB methods.

Thanks in advance.
E Armitage
Rancher

Joined: Mar 17, 2012
Posts: 892
    
    9
Why not use JAAS to secure your EJBs and then your remote clients need to add
to their context lookup properties.
See if this explains better :http://docs.oracle.com/cd/B32110_01/web.1013/b28957/ejbsec.htm
john ho
Greenhorn

Joined: Jan 25, 2008
Posts: 8
ok, thanks for the reply ... but what you are describing is JNDI lookup security, isn't it? I saw this thread:

https://forums.oracle.com/forums/thread.jspa?threadID=1093427

If I understand the first reply, from "Jay", that doing this only forces authentication for the EJB lookup, but that is different from security on the EJB's themselves.

However, if I'm only worried about remote invocation of the EJB's, is JNDI authentication sufficient to prevent "rogue" applications from making the EJB calls?

Put another way: without JNDI lookup, is there any other way a client application can still call the EJBs remotely?

Thanks
 
With a little knowledge, a cast iron skillet is non-stick and lasts a lifetime.
 
subject: simplest way to restrict access to remote EJB calls