Identity propagation with EJB

Question

How to propagation identity to Remote EJB if client application is not deployed on WLS, but just standalone application.
I found some document on the web in regards to identity propagation with remote EJB ( EJB security mechanisms)
I follow it and have the following code:
package oracle.bpel.services.workflow.samples;
import java.security.Principal;
import java.security.PrivilegedExceptionAction;
import java.util.List;
import javax.security.auth.Subject;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.NameCallback;
import javax.security.auth.callback.PasswordCallback;
import javax.security.auth.callback.UnsupportedCallbackException;
import javax.security.auth.login.LoginContext;
import weblogic.security.auth.callback.URLCallback;
import oracle.bpel.services.workflow.client.WorkflowServiceClientFactory;
import oracle.security.jps.util.SubjectUtil;
public class RemoteWFClientWithIdentityPropagationSample {
public void runRemoteClient() {
try {
PrivilegedExceptionAction<List> privilegedExceptionAction = new PrivilegedExceptionAction<List>() {
public List run() throws Exception {
for (Principal pr : SubjectUtil.getCurrentSubject().getPrincipals()) {
System.out.println("Current Principals: " + pr.getName());
return RemoteWFClientSample.runWithUserPropagation(WorkflowServiceClientFactory.REMOTE_CLIENT); // it calls Remote EJB
SampleCallbackHandler handler = new SampleCallbackHandler("jcooper", "welcome1", "t3://stapj73.us.oracle.com:7001");
LoginContext loginContext = new LoginContext("Sample",handler);
loginContext.login();
Subject subject = loginContext.getSubject();
List result = (List) Subject.doAs(subject, privilegedExceptionAction);
System.out.println("runRemoteClient is " + result);
} catch (Exception e) {
System.out.println("Error occur");
e.printStackTrace();
class SampleCallbackHandler implements CallbackHandler {
private String uname = null;
private String passwd = null;
private String url = null;
public SampleCallbackHandler(String uname, String passwd, String url) {
this.uname = uname;
this.passwd = passwd;
this.url = url;
public void handle(Callback[] callbacks) throws
java.io.IOException, UnsupportedCallbackException {
for (int i = 0; i < callbacks.length; i++) {
if (callbacks[i] instanceof NameCallback) {
NameCallback nc = (NameCallback) callbacks;
nc.setName(uname);
} else if (callbacks[i] instanceof URLCallback) {
URLCallback uc = (URLCallback) callbacks[i];
uc.setURL(url);
} else if (callbacks[i] instanceof PasswordCallback) {
PasswordCallback pc = (PasswordCallback) callbacks[i];
pc.setPassword(passwd.toCharArray());
} // for
} // handle()
public static void main(String args[]) {
RemoteWFClientWithIdentityPropagationSample sample = new RemoteWFClientWithIdentityPropagationSample();
sample.runRemoteClient();
I run test with JVM system option : -Djava.security.auth.login.config=C:\Work\JavaTry\login.conf
where C:\Work\JavaTry\login.conf has the following lines:
Sample {
weblogic.security.auth.login.UsernamePasswordLoginModule required
debug=false;
Client shows pincipals in the Subject:
But still, on server side sessionContext.getCallerPrincipal() returns '<anonymous>' instead of 'jcooper'
What is wrong now?

Answer 1

OK I have got a little further.
code snippetString contextServiceURL = "corbaloc:iiop:10.230.180.69:7002/NameService";
Hashtable table = new Hashtable();
table.put(InitialContext.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.cosnaming.CNCtxFactory");
table.put(InitialContext.PROVIDER_URL, contextServiceURL);
InitialContext context = new InitialContext(table);
Object ref = context.lookup("ejb.myejbRemoteHome");
myejbRemoteHome home = (myejbRemoteHome)PortableRemoteObject.narrow(ref, myejbRemoteHome.class);
myejbRemote obj = home.create();
obj.testUnsecureMethod();
obj.testSecureMethod();
<<<<<<<<
The unsecure call works fine, the secure call gives me:
java.rmi.AccessException: CORBA NO_PERMISSION 0 Maybe; nested exception is:
     org.omg.CORBA.NO_PERMISSION: vmcid: 0x0 minor code: 0 completed: Maybe
If i set defaultiiop username and password in WebLogic under Environment -> Server -> protocals -> IIOP to weblogic/password then the secure call works. This makes me think that the Subject is not propagating properly.
In the request in Tomcat I have a GenericPrincipal with user and group info. In the Session i have a Subject with only WLSUserImpl, but not the WLSGroupImpl's that I expect. They are there when the login happes, I see the weblogic Authenticate method populate the subject with the groups okay.
Any help much appreicated.
Edited by lnoton at 04/24/2008 2:56 AM
Edited by lnoton at 04/24/2008 2:57 AM