Security exceptions when injecting an EJB in wildf

2019-06-10 11:42发布

站内文章 / Java
8 0 0

问题:

I try to migrate from JBoss AS 7 to Wildfly 8.2. and from Java 1.6 to Java 1.7. and I get some security exceptions when injecting an ejb bean to my batch job.

Here is my scheduler: (runs every minute)

@Startup
@Singleton
public class MyBatchScheduler {

    @Inject
    MyBatch myBatch;

    @Schedule(second = "30", minute = "*/1", hour = "*", persistent = false)
    public void runBackgroundTasks() {
        myBatch.runBackgroundTasksAsync();
    }
}

Here is my batch: (called by scheduler every minute)

 @Stateless
 public class MyBatch {

    @Inject
    MyTestbean myTestbean;

    @Asynchronous
    public void runBackgroundTasksAsync() {
        myTestbean.doSomething();
        System.out.println("Batch");
    }
 }

Here is my stateless bean which makes problem: (just an empty methode)

public class MyTestbean implements Serializable {

    private static final long serialVersionUID = 1L;

    public void doSomething() {

    }
}

My jboss-ejb3.xml with security-domain:

<?xml version="1.1" encoding="UTF-8"?>
<jboss:ejb-jar
    xmlns:jboss="http://www.jboss.com/xml/ns/javaee"
    xmlns="http://xmlns.jcp.org/xml/ns/javaee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:s="urn:security"
    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/ejb-jar_3_2.xsd"
    version="3.2">
    <assembly-descriptor>
        <s:security>
            <ejb-name>*</ejb-name>
            <s:security-domain>myXXXRealm</s:security-domain>
        </s:security>
    </assembly-descriptor>
</jboss:ejb-jar>

My jboss-web.xml with my security-domain:

<?xml version="1.1" encoding="UTF-8"?>
<jboss-web>
    <security-domain>myXXXRealm</security-domain>
    <context-root>/</context-root>
</jboss-web>

In my standalone.xml I also defined the myXXXRealm as security-domain: 

<subsystem xmlns="urn:jboss:domain:security:1.2">
   <security-domains>
       <security-domain name="other" cache-type="default">
           <authentication>
               <login-module code="Remoting" flag="optional">
                   <module-option name="password-stacking" value="useFirstPass"/>
               </login-module>
               <login-module code="RealmUsersRoles" flag="required">
                   <module-option name="usersProperties" value="${jboss.server.config.dir}/application-users.properties"/>
                   <module-option name="rolesProperties" value="${jboss.server.config.dir}/application-roles.properties"/>
                   <module-option name="realm" value="ApplicationRealm"/>
                   <module-option name="password-stacking" value="useFirstPass"/>
               </login-module>
           </authentication>
       </security-domain>
       <security-domain name="jboss-web-policy" cache-type="default">
           <authorization>
               <policy-module code="Delegating" flag="required"/>
           </authorization>
       </security-domain>
       <security-domain name="jboss-ejb-policy" cache-type="default">
           <authorization>
               <policy-module code="Delegating" flag="required"/>
           </authorization>
       </security-domain>
       <security-domain name="myXXXRealm">
           <authentication>
               <login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag="required">
                   <module-option name="dsJndiName" value="java:/db/auraDS"/>
                   <module-option name="principalsQuery" value="select &quot;PASSWORD&quot; from aura.&quot;USER&quot; where &quot;USERNAME&quot;=?"/>
                   <module-option name="rolesQuery" value="SELECT r.&quot;NAME&quot;, 'Roles' FROM aura.&quot;ROLE&quot; r, aura.&quot;USER_ROLE&quot; ur, aura.&quot;USER&quot; u WHERE u.&quot;USERNAME&quot;=? AND u.&quot;ID&quot;=ur.&quot;USER_ID&quot; AND ur.&quot;ROLE_ID&quot;=r.&quot;ID&quot;"/>
                   <module-option name="hashAlgorithm" value="MD5"/>
                   <module-option name="hashEncoding" value="hex"/>
               </login-module>
           </authentication>
       </security-domain>
   </security-domains>
</subsystem>

But I get always the exceptions "Insufficient method permissions" and "JBAS014134: EJB Invocation failed on component":

14:09:30,005 DEBUG [org.jboss.security] (EJB default - 8) PBOX000291: Method: runBackgroundTasksAsync, interface: Local, required roles: Roles(<NOBODY>,)
14:09:30,005 DEBUG [org.jboss.security] (EJB default - 8) PBOX000292: Insufficient method permissions [principal: null, EJB name: MyBatch, method: runBackgroundTasksAsync, interface: Local, required roles: Roles(<NOBODY>,), principal roles: Roles(), run-as roles: null]
14:09:30,005 DEBUG [org.jboss.security] (EJB default - 8) PBOX000299: Required module org.jboss.security.authorization.modules.DelegatingAuthorizationModule failed
14:09:30,005 DEBUG [org.jboss.security] (EJB default - 8) PBOX000325: Authorization processing error: org.jboss.security.authorization.AuthorizationException: PBOX000017: Acces denied: authorization failed 
    at org.jboss.security.plugins.authorization.JBossAuthorizationContext.invokeAuthorize(JBossAuthorizationContext.java:268) [picketbox-4.0.21.Final.jar:4.0.21.Final]
    at org.jboss.security.plugins.authorization.JBossAuthorizationContext.access$000(JBossAuthorizationContext.java:71) [picketbox-4.0.21.Final.jar:4.0.21.Final]
    at org.jboss.security.plugins.authorization.JBossAuthorizationContext$1.run(JBossAuthorizationContext.java:147) [picketbox-4.0.21.Final.jar:4.0.21.Final]
    at java.security.AccessController.doPrivileged(Native Method) [rt.jar:1.7.0_65]
    at org.jboss.security.plugins.authorization.JBossAuthorizationContext.authorize(JBossAuthorizationContext.java:143) [picketbox-4.0.21.Final.jar:4.0.21.Final]
    at org.jboss.security.plugins.JBossAuthorizationManager.internalAuthorization(JBossAuthorizationManager.java:429) [picketbox-4.0.21.Final.jar:4.0.21.Final]
    at org.jboss.security.plugins.JBossAuthorizationManager.authorize(JBossAuthorizationManager.java:115) [picketbox-4.0.21.Final.jar:4.0.21.Final]
    at org.jboss.security.plugins.javaee.EJBAuthorizationHelper.authorize(EJBAuthorizationHelper.java:318) [picketbox-4.0.21.Final.jar:4.0.21.Final]
    at org.jboss.as.security.service.SimpleSecurityManager.authorize(SimpleSecurityManager.java:303) [wildfly-security-8.2.0.Final.jar:8.2.0.Final]
    at org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:133) [wildfly-ejb3-8.2.0.Final.jar:8.2.0.Final]
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:95) [wildfly-ejb3-8.2.0.Final.jar:8.2.0.Final]
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.as.ejb3.component.interceptors.ShutDownInterceptorFactory$1.processInvocation(ShutDownInterceptorFactory.java:64) [wildfly-ejb3-8.2.0.Final.jar:8.2.0.Final]
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:59) [wildfly-ejb3-8.2.0.Final.jar:8.2.0.Final]
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.as.ejb3.component.interceptors.AdditionalSetupInterceptor.processInvocation(AdditionalSetupInterceptor.java:55) [wildfly-ejb3-8.2.0.Final.jar:8.2.0.Final]
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.invocation.ContextClassLoaderInterceptor.processInvocation(ContextClassLoaderInterceptor.java:64)
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.invocation.InterceptorContext.run(InterceptorContext.java:326)
    at org.wildfly.security.manager.WildFlySecurityManager.doChecked(WildFlySecurityManager.java:439)
    at org.jboss.invocation.AccessCheckingInterceptor.processInvocation(AccessCheckingInterceptor.java:61)
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.invocation.InterceptorContext.run(InterceptorContext.java:326)
    at org.jboss.invocation.PrivilegedWithCombinerInterceptor.processInvocation(PrivilegedWithCombinerInterceptor.java:80)
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
    at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:185)
    at org.jboss.as.ee.component.ViewDescription$1.processInvocation(ViewDescription.java:182)
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.as.ejb3.component.interceptors.LogDiagnosticContextRecoveryInterceptor.processInvocation(LogDiagnosticContextRecoveryInterceptor.java:79) [wildfly-ejb3-8.2.0.Final.jar:8.2.0.Final]
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.as.ejb3.component.interceptors.AsyncFutureInterceptorFactory$1$2.runInvocation(AsyncFutureInterceptorFactory.java:97) [wildfly-ejb3-8.2.0.Final.jar:8.2.0.Final]
    at org.jboss.as.ejb3.component.interceptors.AsyncInvocationTask.run(AsyncInvocationTask.java:73) [wildfly-ejb3-8.2.0.Final.jar:8.2.0.Final]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) [rt.jar:1.7.0_65]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) [rt.jar:1.7.0_65]
    at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_65]
    at org.jboss.threads.JBossThread.run(JBossThread.java:122)

14:09:30,008 TRACE [org.jboss.security.audit] (EJB default - 8) [Failure]Source=org.jboss.security.plugins.javaee.EJBAuthorizationHelper;Action=authorization;Resource:=[org.jboss.security.authorization.resources.EJBResource:contextMap={policyRegistration=null}:method=public void hugo.MyBatch.runBackgroundTasksAsync():ejbMethodInterface=Local:ejbName=MyBatch:ejbPrincipal=null:MethodRoles=Roles(<NOBODY>,):securityRoleReferences=null:callerSubject=Subject:
    Principal: anonymous
:callerRunAs=null:callerRunAs=null:ejbRestrictionEnforcement=false:ejbVersion=2.0];Exception:=PBOX000017: Acces denied: authorization failed ;policyRegistration=null;
14:09:30,008 TRACE [org.jboss.security] (EJB default - 8) PBOX000354: Setting security roles ThreadLocal: null
14:09:30,008 ERROR [org.jboss.as.ejb3.invocation] (EJB default - 8) JBAS014134: EJB Invocation failed on component MyBatch for method public void hugo.MyBatch.runBackgroundTasksAsync(): javax.ejb.EJBAccessException: JBAS014502: Invocation on method: public void hugo.MyBatch.runBackgroundTasksAsync() of bean: MyBatch is not allowed
    at org.jboss.as.ejb3.security.AuthorizationInterceptor.processInvocation(AuthorizationInterceptor.java:135) [wildfly-ejb3-8.2.0.Final.jar:8.2.0.Final]
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:95) [wildfly-ejb3-8.2.0.Final.jar:8.2.0.Final]
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.as.ejb3.component.interceptors.ShutDownInterceptorFactory$1.processInvocation(ShutDownInterceptorFactory.java:64) [wildfly-ejb3-8.2.0.Final.jar:8.2.0.Final]
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:59) [wildfly-ejb3-8.2.0.Final.jar:8.2.0.Final]
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.as.ejb3.component.interceptors.AdditionalSetupInterceptor.processInvocation(AdditionalSetupInterceptor.java:55) [wildfly-ejb3-8.2.0.Final.jar:8.2.0.Final]
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.invocation.ContextClassLoaderInterceptor.processInvocation(ContextClassLoaderInterceptor.java:64)
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.invocation.InterceptorContext.run(InterceptorContext.java:326)
    at org.wildfly.security.manager.WildFlySecurityManager.doChecked(WildFlySecurityManager.java:439)
    at org.jboss.invocation.AccessCheckingInterceptor.processInvocation(AccessCheckingInterceptor.java:61)
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.invocation.InterceptorContext.run(InterceptorContext.java:326)
    at org.jboss.invocation.PrivilegedWithCombinerInterceptor.processInvocation(PrivilegedWithCombinerInterceptor.java:80)
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
    at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:185)
    at org.jboss.as.ee.component.ViewDescription$1.processInvocation(ViewDescription.java:182)
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.as.ejb3.component.interceptors.LogDiagnosticContextRecoveryInterceptor.processInvocation(LogDiagnosticContextRecoveryInterceptor.java:79) [wildfly-ejb3-8.2.0.Final.jar:8.2.0.Final]
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:309)
    at org.jboss.as.ejb3.component.interceptors.AsyncFutureInterceptorFactory$1$2.runInvocation(AsyncFutureInterceptorFactory.java:97) [wildfly-ejb3-8.2.0.Final.jar:8.2.0.Final]
    at org.jboss.as.ejb3.component.interceptors.AsyncInvocationTask.run(AsyncInvocationTask.java:73) [wildfly-ejb3-8.2.0.Final.jar:8.2.0.Final]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) [rt.jar:1.7.0_65]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) [rt.jar:1.7.0_65]
    at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_65]
    at org.jboss.threads.JBossThread.run(JBossThread.java:122)

What the hell am I doing wrong?

回答1:

With JBoss 7.2 the behavior at calling EJB methods has become more restricted. Thus if there is a security domain every call to a EJB without security restriction (PermitAll, RolesAllowed or similar annotations/descriptor entries) will be rejected without explicit permission.

To change this behavior you can add in jboss-ejb3.xml descriptor the following option:

<jboss:jboss
        xmlns="http://java.sun.com/xml/ns/javaee"
        xmlns:jboss="http://www.jboss.com/xml/ns/javaee"
        xmlns:s="urn:security:1.1"
        version="3.1" impl-version="2.0">

    <assembly-descriptor>
        <s:security>
            <ejb-name>*</ejb-name>
            <s:missing-method-permissions-deny-access>false</s:missing-method-permissions-deny-access>
        </s:security>
    </assembly-descriptor>
</jboss:jboss>
  • jboss-ejb3.xml Reference


标签： java java-ee jboss wildfly
举报

收藏的人(0)

Ta的文章 更多文章
登录 后发表评论
0条评论
还没有人评论过~