Bugs item #604258, was opened at 2002-09-03 16:52 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=376685&aid=604258&group_id=22866
Category: JBossSX Group: v3.0 Rabbit Hole Status: Open Resolution: None Priority: 5 Submitted By: Steve Lynch (aaprincipal) Assigned to: Nobody/Anonymous (nobody) Summary: Clinet-side use of SecurityAssociation Initial Comment: No debug trace available. The following is simply the observed effect of client-side calls to 'secured' EJBs. Scenario: A client app (in this a Java app run from the command line) holds several Subjects as a result of calls to several different LoginContexts. Calls to the same session bean were made using these different Subjects by means of 'Subject.doAs(...)'. This scenario may not be common but does not seem unreasonable. Observation: The effect as far as roles/permissions at the server was as if the Subject was that of the last successful call to 'LoginContext.login()' rather than, as expected, that of the 'Subject.doAs()' Subject. Workaround: Setting the ClientLoginModule to 'multi- threaded' and having associated '...login()'/'...doAs()' calls in a separate thread brought about the desired effect but seemed cumbersome under the circumstances. Note: It seems to me that the SecurityAssociation, whilst a good Principal/Credential <-> Subject mapping mechanism at the server-side, is inappropriate at the client side. Surely the Subject _is_ the mapping mechanism - would also get rid of the need for 'multi- threaded' flag. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=376685&aid=604258&group_id=22866 ------------------------------------------------------- This sf.net email is sponsored by: OSDN - Tired of that same old cell phone? Get a new here for FREE! https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390 _______________________________________________ Jboss-development mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-development
