EJB protection and SPIs in WLS 9.1 ?

Question

I am trying to port an Authorization provider to WLS 9.1 which was working fine in WLS 7 and WLS 8.1 to perform EJB protection.
I have the
<b>isAccessAllowed(Subject subject, Map roles, Resource resource, ContextHandler handler,Direction direction)</b>
method in my Authorization provider impl class.
In WLS 7 and WLS 8.1 the Resource object was getting filled correctly with the type of resource.
But when I was testing this on WLS 9.1 by accessing an EJB method (remotely and locally) the Resource object type was <jndi> instead of <ejb>
Did anybody encounter this problem. Basically I am trying to get hold of the details of the EJB being accessed in the custom authorization SPI provider and check permission for the EJB method and act accordingly.
But the <b>Resource </b> object of <b>isAccessAllowed </b>is not filling the <ejb> type and details. It is always filling in it with <jndi> lookup details.
Thanks
Prem

Answer 1

hi
Currently I am using
req.getHeader("WL-Proxy-Client-Cert")
to get the client certificate and then i do the following to get the X509 cert format
     if (pemCert != null && pemCert.length() > 0 ){
          pemCertBuff.append("-----BEGIN CERTIFICATE-----");
          pemCertBuff.append(pemCert);
          pemCertBuff.append("-----END CERTIFICATE-----");
     System.out.println("CertificateUtil:getFingerPrint: pemCertBuff --"+pemCertBuff.toString());
     X509Certificate certs = null;
     try {
          CertificateFactory cf = CertificateFactory.getInstance("X.509");
          ByteArrayInputStream bis = new ByteArrayInputStream(pemCertBuff.toString().getBytes());
          weblogic.security.PEMInputStream pemIs = new weblogic.security.PEMInputStream(bis);
          BufferedInputStream bufis = new BufferedInputStream(pemIs);
          certs = (X509Certificate)cf.generateCertificate(bufis);
     } catch (CertificateException e) {
          // TODO Auto-generated catch block
          e.printStackTrace();
     } catch (IOException e) {
          // TODO Auto-generated catch block
          e.printStackTrace();
And I am able to get the certificate, but I need to know is there any other elegant way to get the certificate as we did using weblogic.security.X509 class?
Please help!!
Message was edited by:
rmkandan