Details
-
Bug
-
Resolution: Done
-
Blocker
-
26.0.1.Final
-
None
Description
In a highly concurrent system, we noticed that the name of the caller principal retrieved from the session context of a stateless session bean is somewhat random. Sometimes we receive the correct principal of the client, sometimes anonymous and sometimes the principal of a totally independent, concurrent client.
This strange behavior started when switching from Legacy Security to Elytron Security. With Legacy Security (WildFly 24.0.1.Final or older), the caller principal from the session context always matched the one provided by the client for authentication.
To reproduce this strange behavior, we put together a simple project consisting of the following two stateless session beans:
@Stateless
@Remote(SecuredEJBRemote.class)
@RolesAllowed({"guest"})
@RunAs("system")
@SecurityDomain("other")
public class SecuredEJB implements SecuredEJBRemote {
@Resource
private SessionContext ctx;
@EJB
private AnotherSecuredEJBLocal anotherEjb;
public String getCallerPrincipal() {
anotherEjb.ping();
Principal principal = ctx.getCallerPrincipal();
return principal.toString();
}
}
@Stateless
@RolesAllowed({"system"})
@SecurityDomain("other")
public class AnotherSecuredEJB implements AnotherSecuredEJBLocal {
public String ping() {
return "pong";
}
}
When a client calls the function getCallerPrincipal() on the SecuredEJB, first the function ping() gets called on AnotherSecuredEJB and then getCallerPrincipal() returns the name of the principal retrieved from the session context. As stated above, the caller principal does not always match the user name provided by the client for authentication.
