JAAS and stateless bean

Question

i have a very simple stateless bean with a single "hello" method running in WL 8.1 sp3. to test out Weblogic's behavior, i ran 2 seaparate scenarios on 2 separate occasions. in the first one, i secured all bean methods. in the 2nd one, i secured only the home's "create" mthod, while explicitely denoting all remote methods as "unchecked". next, i wrote a standalone client class where the aforemention bean's EJBHome.create() is called from within a PrivilegedAction-inherited class, while hello() method is called straight up without the use of PrivilegedAction. moreover, the hello() method also prints out the SessionContext.getCallerPrincipal().getName(). finally, an UNsecured servlet utilizing that class was deployed in Tomcat5 and another instance of Weblogic. this is where is gets interesting. when executing the standalone class or the Tomcat's servlet in both scenarios, the results are the same: both create() and hello() get called without a problem, while the latter method prints out correct principal name. however, Weblogic hosting the unsecured servlet behaves differently (and undesirably). in the first scenario where all methods are secured, create() is allowed to be executed, but calling hello() results in an insufficient privileges error. in the 2nd scenario, where only create() method is secured, Weblogic allows hello() to be called without a problem. however, the principal that it returns is "anonymous". my question is how is it possible for not only Tomcat, but even a standalone class to call a secured method without the use of PrivilegedAction and get back a correct principal? yet when absolutely identical code is called from another Weblogic instance, i cannot even obtain a correct principal despite the use of PrivilegedAction!!!
thanks!

Answer 1

Hi "werwer" (or is that "wer" :-),
I haven't checked the forum archives, so I may have already mentioned
this to you (or I may have already mentioned it to someone else
on this forum), but there are many resources available on the
Internet that can answer nearly all your J2EE related questions!
I would like to mention two. (If you already know about them, then
I suggest you study them. If you have already studied them and
still don't know the difference between a stateful and a stateless
session bean, then perhaps you can be a bit more specific about
what, in particular, you are having difficulty with.)
1. "Mastering Enterprise JavaBeans" by Ed Roman
A book that you can download as a PDF file.
http://www.theserverside.com/books/masteringEJB/index.jsp
(Also look for the companion book -- at the same URL -- "EJB
Design Patterns")
Note that you need to become a "member" in order to download
these books -- but registration is free.
2. "Enterprise Java Beans, 3rd Edition" by Richard Monson-Haefel
This is an online book -- that you cannot download!
http://safari.informit.com/main.asp?bookname=entjbeans3
Note that "Safari" (at "InformIT") are offering a free, two-week
trial subscription.
Hope this helps you.
Good Luck,
Avi.