Search code examples
ejbjax-wsbasic-authentication

EJB JAX-WS Web Service authentication and authorization

How can I authenticate with HTTP Basic, via the application server domain/secure realm, using a Session Bean published as a @WebService?

In a Web project one could use web.xml to map Roles to Groups, but I have no idea how to do it in a EJB-JAR project. I don't think it can be done with ejb-jar.xml.

Sample code, which works fine without the roles annotations:

@Stateless
@WebService(portName="RestrictedServicePort")
@DeclareRoles(value = "Administrators")
public class RestrictedServiceBean {

    @RolesAllowed(value = "Administrators")
    public String restrictedOperation() {
        return "Secret information";        
    }

}

Error:

<faultstring>[EJB:010160]Security Violation: User: '&lt;anonymous>' has insufficient permission to access EJB: type=&lt;ejb>

Basic Credentials Header:

Authorization: Basic d2VibG9naWM6d2VsY29tZTE=

I suspect it must be done via vendor-specific configuration. I am using WebLogic 10.3.6, Java EE 5 / EJB 3.0.

Solution

  • Solved adding the role mapping as it is done in any web module, but using the proprietary weblogic-ejb-jar.xml, as follows:

    <wls:security-role-assignment>
    <wls:role-name>Administrators</wls:role-name>
    <wls:principal-name>myweblogicgroup</wls:principal-name>
</wls:security-role-assignment>

    The "myweblogicgroup" is the group created in the WebLogic security realm for which the system user used to authenticated to the web service is associated.

    This link helped me.