Elytron security identity is not being propagated to EJB.
Elia Zaides
We are trying to migrate from Wildfly 24 to Wildfly 26, where we are migrating to Elyton security subsystem.
We were successfully able to migrate our JAAS configurations to JAAS Elytron Realm, the login modules are being successfully executed.
Yet when we create an ejb call, the EJBContext#getCallerPrincipal() is always anonymous,
Any help with identifying what could be the possible reasons for the security identity not bening propagated to the EJB?
relevant configurations, structure of our ear file, and code samples are below:
Configuration in our standalone.xml:
<subsystem xmlns="urn:jboss:domain:ejb3:9.0">
<application-security-domains>
<application-security-domain name="company_security" security-domain="company_security-domain"/>
</application-security-domains>
</subsystem>
<subsystem xmlns="urn:wildfly:elytron:15.1" final-providers="combined-providers" disallowed-providers="OracleUcrypto">
<security-domains>
<security-domain name="company_security-domain" default-realm="company_security-realm" permission-mapper="default-permission-mapper">
<realm name="company_security-realm"/>
</security-domain>
</security-domains>
<security-realms>
<jaas-realm name="company_security-realm" entry="indicee-jaas-dummy" module="indicee-jaas">
<file path="jaas.conf"/>
</jaas-realm>
</security-realms>
<http>
<http-authentication-factory name="company_security-http-auth" security-domain="company_security-domain" http-server-mechanism-factory="global">
<mechanism-configuration>
<mechanism mechanism-name="FORM">
<mechanism-realm realm-name="FSRealmUsers"/>
</mechanism>
<mechanism mechanism-name="FORM"/>
</mechanism-configuration>
</http-authentication-factory>
</http>
</subsystem>
<subsystem xmlns="urn:jboss:domain:undertow:12.0">
<application-security-domains>
<application-security-domain name="company_security" http-authentication-factory="company_security-http-auth"/>
</application-security-domains>
</subsystem>
<subsystem xmlns="urn:jboss:domain:ee:6.0">
<ear-subdeployments-isolated>false</ear-subdeployments-isolated>
</subsystem>
Our Project structure:
myapp.ear
|
------- web.war
------- webadmin.war
| ------ services.jar (EJB Services)
web.war configuration:
--- jboss-web.xml
<jboss-web>
<security-domain>company_security</security-domain>
</jboss-web>
--- web.xml
...
<filter>
<filter-name>AuthenticationFilter</filter-name>
....
</filter>
...
webadmin.war configuration:
--- jboss-web.xml
<jboss-web>
<security-domain>company_security</security-domain>
</jboss-web>
--- web.xml
...
<filter>
<filter-name>AuthenticationFilter</filter-name>
....
</filter>
...
services.jar configuration:
--- ejb-jar.xml
<ejb-jar xmlns....>
<description>Deployment descriptor</description>
<display-name>EJB Services</display-name>
</ejb-jar>
Code inside AuthenticationFilter:
public void doFilter(ServletRequest req, ServletResponse res, ... ) {
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletRequest) res;
try {
request.login() ---> Invokes the elytron JAAS authentication process ....
// At this point the security domain is set, and not anonymous.
// Invoking service enpoint that is an EJB, this will fail due to anonymous principal.
Account account = accountService.getAccount();
} catch(LoginException e) {
response.sendError(403);
}
}
Code inside AccontService (EJB):
@stateless
@Local({AccountService.class})
public class AccountServiceImpl implements AccountService {
@Resource
private EJBContext context;
public Account getAccount() {
// Principal is always anonymouse here
Principal principal = context.getCallerPrincipal()
// .. rest of the code logic
}
}
Miha Štemberger
Currently, with the elytron-oidc-client subsystem, it's only possible to propagate the identity from the web layer to the EJB layer when the EJB is contained in the same WAR. If the EJB is located outside the WAR, the identity won't be propagated.
Elia Zaides
Elia Zaides
Diana Krepinska
Elia Zaides
Elia Zaides
Diana Krepinska
Elia Zaides
--
You received this message because you are subscribed to a topic in the Google Groups "WildFly" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/wildfly/EsB4sTZZa7I/unsubscribe.
To unsubscribe from this group and all its topics, send an email to wildfly+u...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wildfly/865ecafa-e7b3-4372-9de3-262a643534fcn%40googlegroups.com.
Elia Zaides
SecurityDomain.getCurrent().getCurrentSecurityIdentity().runAsFunction(
(x) -> accountService.getAccount(), null);