Public Object: JBoss 4 and JAAS

JBoss 4 and JAAS

I've just wasted two days trying to figure out why my J2EE app's login wasn't working. Here's the EJB code:

/**
 * Log in as this user.
 *
 * @ejb.interface-method
 *      view-type="local"
 * @ejb.transaction
 *      type="Mandatory"
 */
public void tryLogin() throws LoginException {
  logger.info("Logging in to " + LOGIN_DOMAIN + " as " + getId() + " with credentials \"" + getPassword() + "\"");
  UsernamePasswordHandler handler = new UsernamePasswordHandler(getId(), getPassword());
  LoginContext loginContext = new LoginContext(LOGIN_DOMAIN, handler);
  loginContext.login();
}

In JBoss 3.2.7, this code logs in the current user so that they can run privileged methods. I can call EntityContext.getCallerPrincipal() and everything works great.

In JBoss 4, this code does absolutely nothing! It doesn't log in the user, it doesn't throw an exception and it doesn't provide any indication on why the user isn't getting logged in. EntityContext.getCallerPrincipal() returns my not-logged-in principal. Horrible!

If I find out what the heck is wrong in JBoss 4, I'll post an update.

# posted by Jesse Wilson on Monday, April 11, 2005

Problem solved! JBoss 4 doesn't honor login() when called from within an EJB method. I don't know why and I don't think it's right but this is the way that it is. The simple workaround is to move the login() code to a non-EJB method where it will all work fine.

This is somewhat upsetting since when I was calling login() from within my bean, I didn't need to expose the getPassword() etc. methods. Yuck.

# posted by swankjesse on April 11, 2005 3:01 PM