I'm encountering a strange authentication/authorization issue. I'm running
JBAS 4.0.4GA_Patch1 and JBossWS1.0.2GA.
I have a JSR181 EJB endpoint exposed as a web-service.
My Port annotation looks thus:
@PortComponent(
transportGuarantee="NONE",
contextRoot = "/sample",
urlPattern="/InternalApi",
authMethod="BASIC"
)
I can access the Web-Service via a JSR109 client that is deployed on a separate
jBoss machine (i.e., the client is a packaged jar file with
application-client.xml, jaxrpc-mapping.xml, and jboss-client.xml,
service-wsdl.xml. I access the client via JNDI lookup).
However, I can only access the web-service using my J2EE client as long as I
package my wsdl file with the client jar.
I would like to be able to use the "wsdl-override" element of the jboss-client,
so that the client simply downloads the wsdl from the remote server instead of
referencing a file in my client deployment directory.
This is where things get sticky.
Option 1.) If, in my PortComponent, I have authMethod="BASIC", AND I use the
jboss-client.xml "wsdl-override", then I get a 401 error saying that I am not
authorized to view the wsdl (this despite specifiying a username/password in
the WS Stub call). However, if I include my wsdl file in the client
deployment, and don't try the "wsdl-override" trick, then everything works.
Option 2.) If, in my PortComponent, I have authMethod="NONE", then I get a 403
error, regardless of whether I use the "wsdl-override" or not.
Option 3.) If I omit the "authMethod" attribute entirely, and try to use the
"wsdl-override" trick, then I can view the remote WSDL (for instance, via the
web browser), but I get an javax.ejb.EJBAccessExcepion: authorization failure
on my WebServices server (as one would expect, since my EJB's require a
protected role), and a SOAP fault on the WS client.
In the end, it seems like my Stub Username/Password information is ignored
whenever I try to use the "wsdl-override".
Is what I'm trying to do possible? I have seen hints in other forum posts
(some people have decided to put the WSDL in a different, non-secure URL).
However, in my case, I DO want the WSDL to be secured, along with the endpoint.
Any thoughts?
View the original post :
http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3962334#3962334
Reply to the post :
http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3962334
_______________________________________________
jboss-user mailing list
[email protected]
https://lists.jboss.org/mailman/listinfo/jboss-user
