Hello,
I'm facing a problem which I think may be a bug in jboss.
I'm using jboss 2.4.10 on Windows 2000
Java Version: Sun 1.4.1_02
A Stateful SessionBean BeanA creates another Stateful SessionBean BeanB.
BeanA has method permission set for role "Administrator" and the "runAs"
attribute set to "InternalAdmin"
BeanB has method permission set for role "InternalAdmin"
This works fine during normal usage,
but after passivation the activation fails with the error:
Could not activate; nested exception is:
java.rmi.ServerException: Could not get EJBObject; nested exception is:
java.rmi.ServerException: RemoteException occurred in server thread; nested
exception is:
javax.transaction.TransactionRolledbackException: checkSecurityAssociation;
nested exception is:
java.lang.SecurityException: Insufficient method permissions,
principal=Admin, method=getEJBObject, requiredRoles=[InternalAdmin],
principalRoles=[Administrator];
I think the problem occurs on BeanB.
Why is the method getEJBObject accessed by Administrator, BeanA should acess
BeanB as "InternalAdmin" ?
Any ideas ?
Annegret
Configuration:
<session>
<ejb-name>BeanA</ejb-name>
<home>test.BeanAHome</home>
<remote>test.BeanA</remote>
<ejb-class>test.BeanABean</ejb-class>
<session-type>Stateful</session-type>
<transaction-type>Container</transaction-type>
<security-identity>
<run-as>
<role-name>InternalAdmin</role-name>
</run-as>
</security-identity>
</session>
<session>
<ejb-name>BeanB</ejb-name>
<home>test.BeanBHome</home>
<remote>test.BeanB</remote>
<ejb-class>test.BeanBBean</ejb-class>
<session-type>Stateful</session-type>
<transaction-type>Container</transaction-type>
</session>
<method-permission>
<role-name>Administrator</role-name>
<method>
<ejb-name>BeanA</ejb-name>
<method-name>*</method-name>
</method>
</method-permission>
<method-permission>
<role-name>InternalAdmin</role-name>
<method>
<ejb-name>BeanB</ejb-name>
<method-name>*</method-name>
</method>
</method-permission>
-------------------------------------------------------
This SF. Net email is sponsored by: GoToMyPC
GoToMyPC is the fast, easy and secure way to access your computer from
any Web browser or wireless device. Click here to Try it Free!
https://www.gotomypc.com/tr/OSDN/AW/Q4_2003/t/g22lp?Target=mm/g22lp.tmpl
_______________________________________________
JBoss-user mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/jboss-user
