Enterprise Java Development@TOPIC@
No caller context
Elevate access
Run-as role-name and identity
security-identity of bean defaults to caller identity
import javax.annotation.security.RunAs;
@Stateless
@PermitAll
@RunAs("admin")
public class SecurePingClientEJB
implements SecurePingClientRemote, SecurePingClientLocal {
@EJB(lookup="ejb:securePingEAR/securePingEJB/SecurePingEJB!info.ejava.examples.secureping.ejb.SecurePingRemote")
SecurePingRemote securePingServer;
EJB can discard caller's identity/roles and run-as a specific role
Provide the roleName (e.g., "admin") you wish the method to execute with and *not* the userName (e.g., "admin1") when using the @RunAs annotation.
# jboss-web.xml
<assembly-descriptor>
<sec:security>
<ejb-name>*</ejb-name>
<sec:security-domain>other</sec:security-domain>
<sec:run-as-principal>admin1</sec:run-as-principal>
</sec:security>
</assembly-descriptor>
Specifies specific user-identity to run-as
Vendor-specific
Use jboss-ejb3.xml elements to define caller identity if overriding or supplying caller identity. Otherwise caller identity will be blank.
Method invoked as "user1" with role "user"
runAs(userLogin);
logger.info(securePing.pingAdmin());
Method configured to execute with "admin" role
@RunAs("admin")
public String pingAdmin() {
return securePingServer.pingAdmin();
}
Method successfully invokes second EJB method requiring "admin" role
-looking up jndi.name=ejb:securePingClientEAR/securePingClientEJB/SecurePingClientEJB
!info.ejava.examples.secureping.ejb.SecurePingClientRemote as user1
-found=Proxy for remote EJB StatelessEJBLocator for
"securePingClientEAR/securePingClientEJB/SecurePingClientEJB",
view is interface info.ejava.examples.secureping.ejb.SecurePingClientRemote, affinity is None
-login=[user1, password1!], whoAmI=user1
-securePingClient called pingAdmin, principal=user1, <== output from EJB
isUser=true, invoked by client
isAdmin=false,
isInternalRole=false:
securePing=called pingAdmin, principal=admin1, <== output from EJB
isUser=false, invoked by @RunAs EJB
isAdmin=true,
isInternalRole=true
user1 is allowed to call method restricted to admin when proxied by run-as EJB
proxy EJB sees caller as user1 and having user1 assigned roles
proxied EJB sees caller as admin1 and only having assigned admin role