I've finally sat down and traced the code on this a little more. I've found the
key difference as to why the secruity context is failing when
java2ClassLoadingCompliance=false. However, I'm not able to tell yet why it's
failing.
I'm about to check this all out on JBoss AS 4.0.3SP1. However our current
environment is AS 3.2.3 and I don't have the power to change that.
Here's what I've got so far (in AS 3.2.3):
When a web app is first accessed, JBoss attempts to lookup it's security
context from a new InitialContext(). This is done by
org.jboss.web.tomcat.security.JBossSecurityMgrRealm
during the first call to the
.invoke( Request, Response, ValveContext) method:
public void invoke(Request request, Response response, ValveContext context)
| throws IOException, ServletException
| {
| try
| {
| try
| {
| Context securityCtx = getSecurityContext();
| if( subjectAttributeName != null && securityCtx != null )
Then it calls out to .getSecurityContext():81 which returns null as the
securityCtx:
private Context getSecurityContext()
| {
| Context securityCtx = null;
| // Get the JBoss security manager from the ENC context
| try
| {
| InitialContext iniCtx = new InitialContext(); // This works
fine, but may not contain the security manager
| securityCtx = (Context) iniCtx.lookup("java:comp/env/security");
| }
| catch(NamingException e)
| {
| // Apparently there is no security context?
| //([EMAIL PROTECTED]) No there is one, but it fails to look
it up (java2ClassLoading=false)
| }
| return securityCtx; // Return's null when java2ClassLoading=false
| }
When it's left to the default: java2ClassLoadingCompliance="true" then it does
find the security context.
I'm going to test this out in JBoss 4.0.3, and I'm digging deeper into the name
lookups, but that's where I'm having trouble tracing the operation of the
program. Given the posts I've mentioned previously about people needing to set
java2ClassLoadingCompliance="true" (Since in 4.0.1 it's false by default) in
order to enable jaas I don't expect it to suddenly work, but I'll post what I
find out. More to follow as I get further in my investigation...
View the original post :
http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3939009#3939009
Reply to the post :
http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3939009
-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
JBoss-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/jboss-user
