JMS Wrappers can't cache JNDI lookups when using secured queues

Question

Hi All!
We are working on a jms client, inside a webapp(servlets), using Weblogic 9.2 and Weblogic 10.3.
As we want to use secured queues and keep being efficient we tryed to use Weblogic JMS Wrappers, that should work according to the docs:
Enhanced Support for Using WebLogic JMS with EJBs and Servlets
http://download.oracle.com/docs/cd/E12840_01/wls/docs103/jms/j2ee.html
But we are facing a problem:
When we define a JMS Wrapper and try to cache JNDI lookups for the QueueConnectionFactory and Queue, as the docs recommend for efficiency, the connection to the queue is ignoring the user/pwd.
The JMS Wrapper is using <res-auth>Application</res-auth>.
We are creating the connection using createQueueConnection(user, pwd) from QueueConnectionFactory and after several tests it seems that the user and password are ingored unless a jndi lookup is made in the same thread, as if when there are not any thread credentials present user and password are ignored for the connection...
so the question is:
That behaviour goes against Weblogic JMS Wrapper documentation, doesn't it?
Is there then any other way to access efficiently secured queues using a servlet as a client? (iit's not an option for us to use mdbs, or ejbs).
If it helps, this seems related to this still opened spring-weblogic issue: SPR-2941 --> http://jira.springframework.org/browse/SPR-2941 and SPR-4720 --> http://jira.springframework.org/browse/SPR-4720
Thanxs
And here goes our DDs and code to reproduce:
First in pretty format:
web.xml --> http://pastebin.com/f5f85e8d4
weblogic.xml --> http://pastebin.com/f2fbe10cc
Client code --> http://pastebin.com/f586d32d9
And now emmebded in the msg:
web.xml
<?xml version="1.0" encoding="UTF-8"?>
<weblogic-web-app
  xmlns="http://www.bea.com/ns/weblogic/90"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.bea.com/ns/weblogic/90
  http://www.bea.com/ns/weblogic/90/weblogic-web-app.xsd">
    <description>WebLogic Descriptor</description>
    <resource-description>
        <res-ref-name>jms/QCF</res-ref-name>
        <jndi-name>weblogic.jms.ConnectionFactory</jndi-name>
    </resource-description>
</weblogic-web-app>weblogic.xml
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
      <display-name> QCFWrapperCredentialsTest </display-name>
      <description> QCFWrapperCredentialsTest  </description>
      <servlet id="Servlet_1">
         <servlet-name>QCFWrapperCredentialsTest</servlet-name>
         <servlet-class>QCFWrapperCredentialsTest</servlet-class>
         <load-on-startup>1</load-on-startup>
      </servlet>
      <servlet-mapping id="ServletMapping_1">
         <servlet-name>QCFWrapperCredentialsTest</servlet-name>
         <url-pattern>/Test</url-pattern>
      </servlet-mapping>
     <resource-ref>
        <res-ref-name>jms/QCF</res-ref-name>
        <res-type>javax.jms.QueueConnectionFactory</res-type>
        <res-auth>Application</res-auth>
        <res-sharing-scope>Shareable</res-sharing-scope>
    </resource-ref>
</web-app>And our test client:
import java.io.*;
import java.util.Properties;
import javax.jms.*;
import javax.naming.*;
import javax.servlet.http.*;
public class QCFWrapperCredentialsTest extends HttpServlet {
    QueueConnectionFactory factory = null;
    Queue queue = null;
    String jndiName = "java:comp/env/jms/QCF";
    String queueName= "jms/ColaEntradaConsultas";
    String user = "usuarioColas";
    String pwd = "12345678";
    String userjndi = "usuarioColas";
    String pwdjndi = "12345678";
    String serverT3URL="t3://127.0.0.1:7007";
    public void init() {
        setupJNDIResources();
    private void setupJNDIResources(){
        try {
            Properties props = new Properties();
            props.put("java.naming.factory.initial",
                    "weblogic.jndi.WLInitialContextFactory");
            props.put("java.naming.provider.url",serverT3URL );
            props.put("java.naming.security.principal", userjndi);// usr
            props.put("java.naming.security.credentials", pwdjndi);// pwd
            InitialContext ic = new InitialContext(props);
            factory = (QueueConnectionFactory) ic.lookup(jndiName);
            queue = (Queue) ic.lookup(queueName);
        } catch (NamingException e) {
            e.printStackTrace();
    public void service(HttpServletRequest req, HttpServletResponse res) {
        res.setContentType("text/html");
        Writer wr = null;
        try {
            wr = res.getWriter();
            //Comment this out, do a lookup for each request and it will work
            //setupJNDIResources();
            String user = this.user;
            String pwd = this.pwd;
            //read users and passwords from the request in case they are present
            if (req.getParameter("user") != null) {
                user = req.getParameter("user");
            if (req.getParameter("pwd") != null) {
                pwd = req.getParameter("pwd");
            wr.write("JNDI  User: *" + userjndi + "* y pwd: *" + pwdjndi + "*<p>");
            wr.write("Queue User: *" + user + "* y pwd: *" + pwd + "*<p>");
            //Obtain a connection using user/pwd
            QueueConnection conn = factory.createQueueConnection(user, pwd);
            QueueSession ses = conn.createQueueSession(true,
                    Session.SESSION_TRANSACTED);
            QueueSender sender = ses.createSender(queue);
            TextMessage msg = ses.createTextMessage();
            msg.setText("Hi there!");
            conn.start();
            sender.send(msg);
            ses.commit();
            sender.close();
            ses.close();
            conn.close();
        } catch (Exception e) {
            e.printStackTrace();
            try {
                wr.write(e.toString());
            } catch (Exception e2) {
                e2.printStackTrace();
        finally{
            try {
                wr.close();
            } catch (IOException e) {
                e.printStackTrace();
}Edited by: user2525402 on Feb 9, 2010 7:14 PM

Answer 1

Thanks Tom,
Quite a useful response .-)
Leaving aside the fact that weblogic behaviour with jms wrappers and secured queues seems to not be working as the docs says...
Talking about workarounds:
Both workarounds you suggest works, but as you already noted, creating a new JNDI context just to inject credentials into the threads is overkill when high performance is needed.
I also found more information about the same issue here: http://sleeplessinslc.blogspot.com/2009/04/weblogic-jms-standalone-multi-threaded.html
And he suggest the same workaround, injecting credentials
So I tried the second approach, successfully, injecting credentials into the thread using the security API.
This way, using JMS wrappers and injecting credentials into the thread we get the best performance available, caching resource using wrappers and using credentials in a somewhat efficient way.
Now the test snippet looks like this:
import java.io.*;
import java.security.PrivilegedAction;
import java.util.Properties;
import javax.jms.*;
import javax.naming.*;
import javax.security.auth.Subject;
import javax.security.auth.login.LoginException;
import javax.servlet.http.*;
import weblogic.jndi.Environment;
import weblogic.security.auth.Authenticate;
public class JMSWrapperCredentialsTest extends HttpServlet {
    QueueConnectionFactory factory = null;
    Queue queue = null;
    String jndiName = "java:comp/env/jms/QCF";
    String queueName= "jms/ColaEntradaConsultas";
    String user = "usuarioColas";
    String pwd = "12345678";
    String userjndi = "usuarioColas";
    String pwdjndi = "12345678";
    String serverT3URL="t3://127.0.0.1:7007";
    public void init() {
        setupJNDIResources();
    private void setupJNDIResources(){
        try {
            Properties props = new Properties();
            props.put("java.naming.factory.initial",
                    "weblogic.jndi.WLInitialContextFactory");
            props.put("java.naming.provider.url",serverT3URL );
            props.put("java.naming.security.principal", userjndi);// usr
            props.put("java.naming.security.credentials", pwdjndi);// pwd
            InitialContext ic = new InitialContext(props);
            factory = (QueueConnectionFactory) ic.lookup(jndiName);
            queue = (Queue) ic.lookup(queueName);
        } catch (NamingException e) {
            e.printStackTrace();
    public void service(HttpServletRequest req, HttpServletResponse res) {
        final HttpServletRequest fReq=req;
        final HttpServletResponse fRes=res;
        PrivilegedAction action = new java.security.PrivilegedAction() {
            public java.lang.Object run() {
                performRequest(fReq,fRes);
                return null;
        try {
            Subject subject=createSingleSubject(serverT3URL,user,pwd);
            weblogic.security.Security.runAs(subject, action);
        } catch (Exception e) {
            e.printStackTrace();
    public void performRequest(HttpServletRequest req, HttpServletResponse res) {
        res.setContentType("text/html");
        Writer wr = null;
        try {
            wr = res.getWriter();
            //Comment this out, do a lookup for each request and it will work
            //setupJNDIResources();
            String user = this.user;
            String pwd = this.pwd;
            //read users and passwords from the request in case they are present
            if (req.getParameter("user") != null) {
                user = req.getParameter("user");
            if (req.getParameter("pwd") != null) {
                pwd = req.getParameter("pwd");
            wr.write("JNDI  User: *" + userjndi + "* y pwd: *" + pwdjndi + "*<p>");
            wr.write("Queue User: *" + user + "* y pwd: *" + pwd + "*<p>");
            //Obtain a connection using user/pwd
            QueueConnection conn = factory.createQueueConnection(user, pwd);
            QueueSession ses = conn.createQueueSession(true,
                    Session.SESSION_TRANSACTED);
            QueueSender sender = ses.createSender(queue);
            TextMessage msg = ses.createTextMessage();
            msg.setText("Hi there!");
            conn.start();
            sender.send(msg);
            ses.commit();
            sender.close();
            ses.close();
            conn.close();
        } catch (Exception e) {
            e.printStackTrace();
            try {
                wr.write(e.toString());
            } catch (Exception e2) {
                e2.printStackTrace();
        finally{
            try {
                wr.close();
            } catch (IOException e) {
                e.printStackTrace();
    private Subject createSingleSubject(String providerUrl, String userName, String password) {
        Subject subject = new Subject();
        // Weblogic env class
        Environment env = new Environment();
        if(providerUrl!=null)
            env.setProviderUrl(providerUrl);
        env.setSecurityPrincipal(userName);
        env.setSecurityCredentials(password);
        try {
          // Weblogic Authenticate class will populate and Seal the subject
          Authenticate.authenticate(env, subject);
          return subject;
        catch (LoginException e) {
          throw new RuntimeException("Unable to Authenticate User", e);
        catch (Exception e) {
          throw new RuntimeException("Error authenticating user", e);
}Thanks a lot for the help