Not able to access a secured method of a session bean from a servlet's init() method..

[Suni]

Hi!
The error trace is as follows... Please look on for my scenario..I
would be glad to provide further details..

java.rmi.AccessException: [EJB:010160]Security Violation: User:
'<anonymous>' has insufficient permission to access EJB: type=<ejb>,
application=metro, module=metro.jar, ejb=MySessionBean,
method=create, methodInterface=Home, signature={}.
at
weblogic.ejb20.internal.Method­Descriptor.checkMethodPermissi­onsRemote(MethodDescriptor.jav­a:550)

at
weblogic.ejb20.internal.Statel­essEJBHome.create(StatelessEJB­Home.java:157)

at
com.sunny.metro.server.ejb.MyS­essionBean_tc67pu_HomeImpl.cre­ate(MySessionBean_tc67pu_HomeI­mpl.java:66)

at
com.sunny.metro.timer.StartTim­erServlet.init(StartTimerServl­et.java:35)

The scenario is as follows..

I have a servlet. In its init() method, I am accessing a session
bean(MySessionBean) to perform some functionaity..
public void init(ServletConfig config) throws ServletException {
super.init(config);
System.out.println("%%%%%% This is invoking the servlet %%%%%%");
mySessionHome = Session.getMySessionHome();
try {
mySession = mySessionHome.create();
mySession.createTimer();
} catch (RemoteException e) {
e.printStackTrace();
} catch (CreateException e) {
e.printStackTrace();
}
}

I put some method permissions for this session bean for the method
create in ejb-jar.xml.

The ejb-jar.xml excerpt for the MySessionBean..
<session id="MySessionBean">
<display-name>MySessionBean</d­isplay-name>
<ejb-name>MySessionBean</ejb-n­ame>
<home>com.sunny.metro.server.e­jb.MySessionHome</home>
<remote>com.sunny.metro.server­.ejb.MySession</remote>

<ejb-class>com.sunny.metro.ser­ver.ejb.MySessionBean</ejb-cla­ss>
<session-type>Stateless</sessi­on-type>
<transaction-type>Container</t­ransaction-type>
<security-role-ref>
<role-name>MetroAdmin</role-na­me>
<role-link>AWSAdmin</role-link­>
<!--Comment the above line and uncomment the following
line for "All Users are Admin" mode
<role-link>AWSUser</role-link>
-->
</security-role-ref>
<security-role-ref>
<role-name>MetroDesigner</role­-name>
<role-link>AWSDesigner</role-l­ink>
</security-role-ref>
</session>

...
<method-permission>
<role-name>AWSAdmin</role-name­>
<role-name>AWSDesigner</role-n­ame>
<!-- Uncomment the following line for "All Users are Admin"
mode
<role-name>AWSUser</role-name>
-->
<method>
<ejb-name>MySessionBean</ejb-n­ame>
<method-name>create</method-na­me>
</method>
</method-permission>
The servlet's web.xml...
<web-app>
<servlet>
<servlet-name>StartTimerServle­t</servlet-name>
<display-name>Timer</display-n­ame>
<description>This is to Start the Timer</description>

<servlet-class>com.sunny.metro­.timer.StartTimerServlet</serv­let-class>

<load-on-startup>1</load-on-st­artup>
<run-as>
<role-name>AWSAdmin</role-name­>
</run-as>
</servlet>
<servlet-mapping>
<servlet-name>StartTimerServle­t</servlet-name>
<url-pattern>/servlets/JMetroT­imer</url-pattern>
</servlet-mapping>
<security-role>
<description>Administrator</de­scription>
<role-name>AWSAdmin</role-name­>
</security-role>
</web-app>

And weblogic.xml is ...

<weblogic-web-app>

<security-role-assignment>
<role-name>AWSAdmin</role-name­>
<principal-name>system</princi­pal-name>
</security-role-assignment>

<run-as-role-assignment>
<role-name>AWSAdmin</role-name­>
<run-as-principal-name>system<­/run-as-principal-name>
</run-as-role-assignment>

</weblogic-web-app>

Please let me know if this is a known issue in weblogic or I am missing

something. BTW I am using weblogic90b.

Thanks,
Suni.