See the rest of my comments inline:
On 5/4/06, Kraus, Bernhard <[EMAIL PROTECTED]> wrote:
This is typically done in a Handler, right? You can use a generic one like javax.xml.rpc.handler.Handler. The AOP / security framework I know best is Spring's acegi. The last I looked, acegi needs a servlet session and didn't have anything for web services. You could, however, wire Spring into you Handler. Anyways, a Handler I think in some form fits you needs.
You could use ThreadLocal if you don't need remoting on these vars. You might be able to use MessageContext.setProperty and such which would be simpler. Worth mentioning also is JBossCache.
One note: I planned a similair approach on a project last year, but scrapped in in favor of using container managed security and just passing the username / password in a login service, and just passing back a String generated from EJBObject as sort of a token.
HTH,
Robert
http://www.braziloutsource.com/
Hi all,
I am using Axis (1.2) to expose a Stateless Session EJB (2.1) as Webservice
using the Axis EJBProvider on a JBoss (4.0.3) Application Server.
The Webservices and EJB are the service layer of the application and the
next layer (POJO framework) is the business layer.
The plan for the security framework is to handle the authorization using AOP
before and after the business layer, but to avoid using username/password as
parameter in the business/service layer code.
This is typically done in a Handler, right? You can use a generic one like javax.xml.rpc.handler.Handler. The AOP / security framework I know best is Spring's acegi. The last I looked, acegi needs a servlet session and didn't have anything for web services. You could, however, wire Spring into you Handler. Anyways, a Handler I think in some form fits you needs.
I tried using the XML RPC security implementation on client side:
import javax.xml.rpc.Stub ;
Stub msg = (javax.xml.rpc.Stub) stub;
msg._setProperty(Stub.USERNAME_PROPERTY,"username");
msg._setProperty(Stub.PASSWORD_PROPERTY,"password");
The Axis framework EJBProvider fills the user information as described from
the msgContext:
Implementation is similar to:
...
props.put( Context.SECURITY_PRINCIPAL, msgContext.getUsername() );
props.put( Context.SECURITY_CREDENTIALS, msgContext.getPassword() );
InitialContext initialContext = new InitialContext( props );
...
When accessing the EJB, the user principal is "anonymous" (default JBoss
setting).
I debugged the EJBProvider and username/password is filled from the
msgContext. The problem is to provide the username/password from Axis to EJB
Now how can I access the Context in the EJB layer? I implemented a
LoginHandler (using: org.jboss.security.auth.spi.AbstractServerLoginModule)
but the principal and credential is still "null" even here.
Is there any other option to access the information passed to EJB and write
them e.g. to ThreadLocal to access them from the business logic?
You could use ThreadLocal if you don't need remoting on these vars. You might be able to use MessageContext.setProperty and such which would be simpler. Worth mentioning also is JBossCache.
One note: I planned a similair approach on a project last year, but scrapped in in favor of using container managed security and just passing the username / password in a login service, and just passing back a String generated from EJBObject as sort of a token.
HTH,
Robert
http://www.braziloutsource.com/
Regards,
Bernhard
