Brtdku

I want to get the caller principal in an singleton from the logged in user. the user is authenticating against the rest service with username/password

the security domain is in the jboss-web.xml in the war

<security-domain>application-security</security-domain>

The endpoint in the war is:

@Path("/message/{message}")

public class MyRessource

{  

   @EJB

   MySingleton singletonBean;



   @GET

   public Response resource(@PathParam("message") String message)

   {        

        singletonBean.printText(message);

        System.out.println("called from: " + ctx.getUserPrincipal().getName());

}

the singleton is in an own project, and is provided as dependency at the war.

@Stateless

public class MySingletonBean implements MySingleton

{



    @Resource

    EJBContext context;



    @Resource

    SessionContext ctx;



  public void printText(String text) {

      System.out.println(text + ":: EJBContext: " + context.getCallerPrincipal().getName() + "  SessionContext: " + ctx.getCallerPrincipal().getName());      

  }



}

my web.xml:

<web-app>

    <security-role>

        <role-name>Admin</role-name>

    </security-role>



    <security-constraint>

        <web-resource-collection>

            <url-pattern>/*</url-pattern>

            <http-method-omission>OPTIONS</http-method-omission>

        </web-resource-collection>

        <auth-constraint>

            <role-name>Admin</role-name>

        </auth-constraint>

    </security-constraint>

    <login-config>

        <auth-method>BASIC</auth-method>

    </login-config>

</web-app>

standalone-full-ha.xml

<subsystem xmlns="urn:wildfly:elytron:5.0" ...>

   [...]

   <security-domain name="application-security" default-realm="application-properties" permission-mapper="default-permission-mapper">

      <realm name="application-properties"/>

   </security-domain>

   [...]

</subsystem>

   [...]



<http-authentication-factory name="application-security-http" security-domain="application-security" http-server-mechanism-factory="global">

   <mechanism-configuration>

      <mechanism mechanism-name="BASIC"/>

   </mechanism-configuration>

</http-authentication-factory>

[...]



<security-domains>

   <security-domain name="application-security" default-realm="application-properties" permission-mapper="default-permission-mapper">

      <realm name="application-properties"/>

    </security-domain>

   [...]

</security-domains>

[...]



<subsystem xmlns="urn:jboss:domain:security:2.0">

   <security-domains>

      <security-domain name="application-security">

         <authentication>

            <login-module code="UsersRoles" flag="required">

               <module-option name="usersProperties" value="file://${jboss.server.config.dir}/context-users.properties"/>

                <module-option name="rolesProperties" value="file://${jboss.server.config.dir}/context-roles.properties"/>

             </login-module>

          </authentication>

     </security-domain>

     [...]

</subsystem>

[...]



<subsystem xmlns="urn:boss:domain:undertow"...>

    <application-security-domains>

        <application-security-domain name="application-security" http-authentication-factory="application-security-http"/>

    </application-security-domains>

    [...]

</subsystem>

But i always get anonymous as principals.

What did i do wrong?

You have at least three problems here:

1. <subsystem xmlns="urn:jboss:domain:security:2.0"> is a legacy configuration element that does not link up with elytron;




2. You are completely missing the ejb3 security configuration;




3. Your EJB method is not protected with @RolesAllowed(...).

I got a similar example working:

1. 
   

   Create an elytron properties realm:

   
   
   

   /subsystem=elytron/properties-realm=DemoPropsRealm:add(groups-attribute=groups,
   
      groups-properties={
   
        path=demo-roles.properties,relative-to=jboss.server.config.dir},
   
      users-properties={
   
        path=demo-users.properties,relative-to=jboss.server.config.dir,plain-text=true})
   
   

   
   


2. 
   

   Create an elytron security domain:

   
   
   

   /subsystem=elytron/security-domain=DemoDomain:add(
   
      realms=[{realm=DemoPropsRealm,role-decoder=groups-to-roles}],
   
      default-realm=DemoPropsRealm,permission-mapper=default-permission-mapper)
   
   

   
   


3. 
   

   Create an elytron http-authentication factory that is mapped to our DemoDomain:

   
   
   

   /subsystem=elytron/http-authentication-factory=demo-http-auth:add(
   
      http-server-mechanism-factory=global,
   
      security-domain=DemoDomain,
   
      mechanism-configurations=[{
   
        mechanism-name=BASIC,
   
        mechanism-realm-configurations=[{
   
          realm-name=DemoApplicationDomain
   
        }]
   
      }])
   
   

   
   


4. 
   

   Map an ejb3 subsystem application security domain to our DemoDomain

   
   
   

   /subsystem=ejb3/application-security-domain=
   
       DemoApplicationDomain:add(security-domain=DemoDomain)
   
   

   
   


5. 
   

   Link an undertow subsystem application security domain to our http-authentication-factory:

   
   
   

   /subsystem=undertow/application-security-domain=
   
       DemoApplicationDomain:add(http-authentication-factory=demo-http-auth)
   
   

   
   
   

   "DemoApplicationDomain" will be the realm name in the login-config element of the web.xml and the security-domain in the jboss-web.xml file.

   
   


6. 
   

   Declare the permitted roles on your EJB method:

   
   
   

   @RolesAllowed("Admin")
   
   public void printText(String text) {
   
       System.out.println(text + ":: EJBContext: " + context.getCallerPrincipal().getName()
   
        + "  SessionContext: " + ctx.getCallerPrincipal().getName());      
   
   }
   
   

   
   

Example source is in GitHub at jax-rs-basic-auth.