Is the WLS subject global across clients ??

Question

I have the following setup running on WLS 7.0 - one web app and one
EJB app.
My web app has 2 servlets say servlet-A and servlet-B.
Servlet-A calls into an EJB app that has one EJB. This EJB is
protected by method level permissions i.e. only users of role
"TestRole" can access this EJB's methods (and this role is mapped to
the group "TestGroup" in the weblogic-ejb-jar XML file). Servlet-A
takes in a username/password (say username is "testuser")and checks an
external LDAP server for authentication of the same. If successful,
the servlet sets the current subject with the principals of this user
by calling weblogic.security.Security.getCurentUser().add(some_principal).
The principals include the user name as well as the "TestGroup" group.
The servlet then calls the EJB method. The EJB method passes since
"testuser" is in the "TestGroup" group.
Now, Servlet-B simply calls into the EJB without performing any
authentication. So when I next call servlet-B from within the SAME
browser instance, this servlet is also able to successfully call the
EJB method (as it sees the same subject set earlier by servlet-A).
NOW, i access servlet-B from another browser instance thus starting
a new session. This servlet is STILL able to call the EJB method
successfully. I print out the subject that this servlet sees, and it
is the SAME subject that was set by servlet-A in the earlier session.
I thus concluded that the subject set by the first session is a
"global" subject that is not linked to a session or client (as it
should be).
So my question is - It seems that the subject returned by
getCurrentUser() should be linked to a client or a HttpSession rather
than being "global", otherwise it seems to be a security breach since
malicious clients can access the server and perform actions in the
context of a subject that has already been set by another client. is
there some step I am missing here (ie should I clear the global
subject each time when returning from servlet-A) to achieve this
behavior? Or am I interpreting this behavior incorrectly?

Answer 1

Probably not....if I have an app where EJBs are protected by standard method level
permissions to specific roles, and use BASIC authentication for my servlets, this
is working fine....its only when I move from the "container managed" security
(ie BASIC authentication) to a more programmatic approach that I see this problem
of a "sticky" subject....
"Quantos Quattro" <[email protected]> wrote:
Hi,
Ehm, I think you are seeing that the EJB method is not protected.
There appears to be a bug in WL about this - I saw this:
" 075219 Fixed problem that roles and policies were not enforced on
EJBs."
here
http://e-docs.bea.com/wls/docs70/pre_rel_notes/resolved.html
Perhaps that is why you are observing your problem?
Regards,
Jon