Autherization problem WL6.1

Question

I have the following requirement:-
Create a stateless session bean (SLSB) that performs the following:-
1. Acts like a factory.
2. Is created only once during a web applications lifetime.
3. Is authenticated by a unique security unique role (let us assume it is
called EJBROLE)
Create a servlet that
1. Is authenticated by a security role that is different from the ejb
security role(assume it is called SERVLETROLE).
2. The above SLSB is created only once in the servlet's init method using
the normal authentication for ejb (works fine).
3. Is responsible for calling the SLSB.
The Problem
When a client logs in using the SERVLETROLE, the servlet calls the ejb bean
method . The call fails with an "insufficient privileges" message. How do we
solve this problem keeping the roles different.

Answer 1

Hi Anurag,
Thanks for your reply.
The "SERVLETROLE" is mutually exclusive from the "EJBROLE". For example the
"EJBROLE" can have access to a connection pool resource where as the
"SERVLETROLE" will not be provided this access. This way we can provide
direct database access to the EJBs and not to the servlets.
The SLSB acts like a factory for creating stateful session beans(SFSB).
This way we do not have to do an expensive lookup each time a servlet needs
a SFSB.
Regards,
Arjuna.
"Anurag Pareek" <[email protected]> wrote in message
news:[email protected]..
Hi,
If the requirement is such that anybody having the "SERVLETROLE" can havethe
"EJBROLE", then you could just create the InitialContext required for theEJB
lookup by passing the SECURITY_PRINCIPAL(username) and
SECURITY_CREDENTIALS(password) of the EJBROLE in the init() method of the
servlet.
Please do let me know if this satisfies your requirement.
Regards,
Anurag
Arjuna Chala wrote:
I have the following requirement:-
Create a stateless session bean (SLSB) that performs the following:-
1. Acts like a factory.
2. Is created only once during a web applications lifetime.
3. Is authenticated by a unique security unique role (let us assume it
is
called EJBROLE)
Create a servlet that
1. Is authenticated by a security role that is different from the ejb
security role(assume it is called SERVLETROLE).
2. The above SLSB is created only once in the servlet's init methodusing
the normal authentication for ejb (works fine).
3. Is responsible for calling the SLSB.
The Problem
When a client logs in using the SERVLETROLE, the servlet calls the ejbbean
method . The call fails with an "insufficient privileges" message. Howdo we
solve this problem keeping the roles different.