Uploaded image for project: 'WildFly'
  1. WildFly
  2. WFLY-8917

EJB run-as identity gets lost if an unsecured ejb in the call stack

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Major Major
    • 11.0.0.Beta1
    • 11.0.0.Alpha1
    • EJB, Security
    • None

      Having an unsecured EJB in the call stack will cause the RunAs identity to get lost.

      An example might look like this:

      unsecured web app (RunAs: JBossAdmin) -> unsecured HelloBean EJB -> secured GoodBye EJB (RolesAllowed: JBossAdmin)

      This will fail as the unsecured ejb causes the RunAs identity to get dropped/lost.

        1. SimpleEAR_EJB3.ear
          10 kB

            darran.lofthouse@redhat.com Darran Lofthouse
            rhn-support-dehort Derek Horton
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: