anonymous wrote : | 1) Make a different container configuration for your | ejb that does not include the client side security | interceptor (assumes the client does not need to pass | this information). | 2) Create your own client side security interceptor that | retrieves the info using some other mechanism. |
Hello, I am having the same problem with EJB's and applets. I would like to access a stateless session bean I've already made it to make things working, by updating the policy file at client side. The solution I prefer, is to make EJB call's from applets possible, without changing the Applet's security settings. The applet is being downloaded from the JBoss application server, so the restriction that an applet may only open a socket to the server where it's coming from, isn't a problem. I'm just guessing if I should choose solution 1 or solution 2 1. Making a different container configuration that doesn't include client side security To test this, according to the documentation (bottom of my post)server/default/conf/standardjboss.xml, opened the stateless session bean container configuration, and updated it to the following: | <container-configuration> | <container-name>Standard Stateless SessionBean</container-name> | <call-logging>false</call-logging> | <invoker-proxy-binding-name>stateless-rmi-invoker</invoker-proxy-binding-name> | <container-interceptors> | <interceptor>org.jboss.ejb.plugins.ProxyFactoryFinderInterceptor</interceptor> | <interceptor>org.jboss.ejb.plugins.LogInterceptor</interceptor> | <!-- <interceptor>org.jboss.ejb.plugins.SecurityInterceptor</interceptor>--> | <!-- CMT --> | <interceptor transaction="Container">org.jboss.ejb.plugins.TxInterceptorCMT</interceptor> | <interceptor transaction="Container" metricsEnabled="true">org.jboss.ejb.plugins.MetricsInterceptor</interceptor> | <interceptor transaction="Container">org.jboss.ejb.plugins.StatelessSessionInstanceInterceptor</interceptor> | <!-- BMT --> | <interceptor transaction="Bean">org.jboss.ejb.plugins.StatelessSessionInstanceInterceptor</interceptor> | <interceptor transaction="Bean">org.jboss.ejb.plugins.TxInterceptorBMT</interceptor> | <interceptor transaction="Bean" metricsEnabled="true">org.jboss.ejb.plugins.MetricsInterceptor</interceptor> | <interceptor>org.jboss.resource.connectionmanager.CachedConnectionInterceptor</interceptor> | </container-interceptors> | <instance-pool>org.jboss.ejb.plugins.StatelessSessionInstancePool</instance-pool> | <instance-cache></instance-cache> | <persistence-manager></persistence-manager> | <container-pool-conf> | <MaximumSize>100</MaximumSize> | </container-pool-conf> | </container-configuration> | However, I still get the following exception: java.security.AccessControlException: access denied (java.lang.RuntimePermission org.jboss.security.SecurityAssociation.getPrincipalInfo) | Secury seems still to stay enabled. I'm going to tweak settings to try to make things work, has anybody advices for making this working? When making it working by changing the applet security, I also had to add the following permission: | permission java.io.SerializablePermission "enableSubstitution"; | Is it possible to fix this problem server-side also? Thanks in advance for your time. documentation: - http://jboss.sourceforge.net/doc-24/ch07s09.html JBoss Security documentation - http://jboss.sourceforge.net/doc-24/ch11s21.html An example of applets, ejb and jboss (which doesn't describe anything about this problem) View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=3823775#3823775 Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=3823775 ------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click _______________________________________________ JBoss-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-user
