Message Driven Bean security problems

[I Wayan Saryada]

Hi all,
Currently I am working on WebLogic application server and have a problem about MDB security. In my application the MDB have to read a JMS administered object from the SUN LDAP server (iPlanet). The JMS AO are configured so that only a member of admin groups can read it. After adding this set of ACI the MDB cannot read the JMS AO, but it works fine if I allow the JMS AO to be read by an anonymous user.
Does anybody have any information regarding to this problem?
Regards,
Wayan

[Lasse Koskela]

Who the MDB is running as...
Have you defined the run-as identity for the MDB in ejb-jar.xml?
There should be something like:

...
<message-driven>
    ...
    <security-identity>
        <description>
            This defines the identity of the MDB
        </description>
        <run-as>SomeAdminPrincipal</run-as>
    </security-identity>
    ...
</message-driven>
...

[I Wayan Saryada]

Thanks for the reply.
Doesn't it the ejb-jar.xml suppose to be like the following? the run-as element must contains role-name element?

...
<message-driven>
    ...
    <security-identity>
        <description>
            This defines the identity of the MDB
        </description>
        <run-as>
            <description></description>
            <role-name>SomeRole</role-name>
        </run-as>
    </security-identity>
    ...
</message-driven>
...

Currently I have something like this in my ejb-jar.xml and weblogic-ejb-jar.xml

<ejb-jar>
    <description>MDBTestEJB</description>
    <display-name>MDBTestEJB</display-name>
    <enterprise-beans>
        <message-driven>
            <ejb-name>MessageEJB</ejb-name>
            <ejb-class>saryada.j2ee.mdb.MessageBean</ejb-class>
            <transaction-type>Bean</transaction-type>
            <message-driven-destination>
                <destination-type>javax.jms.Queue</destination-type>
            </message-driven-destination>
            <security-identity>
                <description></description>
                <run-as>
                    <description></description>
                    <role-name>Traders</role-name>
                </run-as>
            </security-identity>
        </message-driven>
    </enterprise-beans>
    <assembly-descriptor>
        <security-role>
            <description></description>
            <role-name>Traders</role-name>
        </security-role>
    </assembly-descriptor>
</ejb-jar>

The weblogic-ejb-jar.xml:

<weblogic-ejb-jar>
    <weblogic-enterprise-bean>
        <ejb-name>MessageEJB</ejb-name>
        <message-driven-descriptor>
            <pool>
            </pool>
            <destination-jndi-name>cn=testQueue</destination-jndi-name>
            <initial-context-factory>com.sun.jndi.ldap.LdapCtxFactory</initial-context-factory>
            <provider-url>ldap://172.16.0.108:389/ou=jmsao,ou=myjmsserver,o=mycompany</provider-url>
            <connection-factory-jndi-name>cn=testQCF</connection-factory-jndi-name>
        </message-driven-descriptor>
        <transaction-descriptor>
        </transaction-descriptor>
        <run-as-identity-principal>srunner</run-as-identity-principal>
        <jndi-name>ejb/MessageEJB</jndi-name>
    </weblogic-enterprise-bean>
    <security-role-assignment>
        <role-name>Traders</role-name>
        <principal-name>srunner</principal-name>
   </security-role-assignment>
</weblogic-ejb-jar>

[ May 06, 2003: Message edited by: I Wayan Saryada ]