JAAS-MBean Authentication

[Tiago Fernandez]

That's the scenario:

1. I used to authenticate the client through org.jboss.security.ClientLoginModule and the code bellow:

    private void authenticate() throws Exception {
 
        // Login before you get initial context
        final String username = "Tiago";
        final String password = "Tiago";
 
        Principal userPrincipal =
            new Principal() {
                public String getName() {
                    return username;
                }
            };
 
        // Set security association handler-specific settings
        SecurityAssociationHandler handler = new SecurityAssociationHandler();
        handler.setSecurityInfo(userPrincipal, password.toCharArray());
 
        // Get login context (note: tiago-security is the given name in auth.conf)
        LoginContext loginContext = new LoginContext("tiago-security", (CallbackHandler) handler);
        loginContext.login();
 
    }

2. I turned this client a MBean, using the same authentication code.
3. Now I got javax.security.
auth.login.FailedLoginException: Password Incorrect/Password Required when it is attemped to loginContext.login()

What needs to be changed now that my client moved to server side?

Thx a lot

[Jeff Shelley]

If I understand your question correctly, you should be able to take out all of the authentication stuff, because you are in the same JVM.

[Tiago Fernandez]

I tried that, but I got a couple of SessionBeans in my EJB container that need authentication to be used... in this situation, do you think I still don't have to login?

[Tiago Fernandez]

I just found out how it works: to login from a MBean (it's very weird I know), you have to use "client-login" as domain. Don't ask me why this thing only works like this, in my opinion could be a JBoss bug

// e.g.
LoginContext loginContext = new LoginContext("client-login", new Subject(), new SecurityAssociationHandler());
loginContext.login();

Thanks anyway,
Tiago

[Jeff Shelley]

Crazy. And that works no matter what roles are required to access the ejb?

[Tiago Fernandez]

Yes, no matter what roles are specified in EJB.