MDB connecting to Foreign JMS server in WL8.1

Question

Hello,
          I have this problem that I am hoping someone can help me with. There is a
          MDB deployed in a local WL8.1 that is trying to connect to a Foreign JMS
          Server which is also a WL8.1 running in a remote server. This MDB is
          attempting to subscribe to a topic hosted by that foreign server. In the
          local WL8.1 I created a Foreign JMS Server via the adminconsole and mapped
          the connection factory as well as destinations to the Foreign JMS Server.
          The MDB (via its deployment descriptor) only refers to the local JNDI names
          of the ConnectionFactory and Topic. Here are the scenarios concerning
          security:
          1) When security is turned off (user is in group everyone) everything works
          fine. Messages published to the foreign Topic are received by the MDB in
          the local WL8.1 server and processed.
          2) When a security policy is applied to the Topic (via the remote
          adminconsole), the MDB in the local server gets a 'permission denied'. I
          now have to get around this by defining a principle for the MDB to run as
          and to map the credentials of this principle to that of the user in the
          remote environment with access permissions to the Topic.
          3) When I specify the security identity of my MDB, its JNDI lookup of the
          Topic fails with 'not found'.
          4) Even when the security policy in the remote server is reverted back to
          'everyone' (effectively turning security off) but leaving the MDB running as
          the security principle, it still cannot find the Topic.
          I hope this is something that people have seen and dealt with before.
          Thanks for any and all help anyone can provide. I have also included the
          deployment descriptors for this MDB:
          <ejb-jar>
          <enterprise-beans>
          <message-driven>
          <ejb-name>MDB</ejb-name>
          <ejb-class>sample.class.MDB</ejb-class>
          <transaction-type>Container</transaction-type>
          <message-driven-destination>
          <destination-type>javax.jms.Topic</destination-type>
          </message-driven-destination>
          <security-identity>
          <run-as>
          <role-name>OutsideJMSUser</role-name>
          </run-as>
          </security-identity>
          </message-driven>
          </enterprise-beans>
          <assembly-descriptor>
          <security-role>
          <role-name>OutsideJMSUser</role-name>
          </security-role>
          </assembly-descriptor>
          </ejb-jar>
          <weblogic-ejb-jar>
          <weblogic-enterprise-bean>
          <ejb-name>MDB</ejb-name>
          <message-driven-descriptor>
          <pool>
          <initial-beans-in-free-pool>1</initial-beans-in-free-pool>
          </pool>
          <destination-jndi-name>ForeignTopic</destination-jndi-name>
          <connection-factory-jndi-name>ForeignConnectionFactory</connection-factory-j
          ndi-name>
          </message-driven-descriptor>
          <jndi-name>MDB</jndi-name>
          </weblogic-enterprise-bean>
          <security-role-assignment>
          <role-name>OutsideJMSUser</role-name>
          <principal-name>OutsideJMSUser</principal-name>
          </security-role-assignment>
          </weblogic-ejb-jar>
          

Answer 1

Thanks for the suggestion Greg. I have enabled trust between the two
          domains and that has certainly cut down the variations of SecurityExceptions
          that I get. Now I am consistently only getting a JMSSecurityException with
          a access denied to the topic. I believe I have the credential mapped
          correctly between the run-as local user and the remote authorized user.
          Unfortunately the exception does not specify what username was rejected, it
          would have been useful in determining the next debugging step to take.
          I think you're right, I should engage the security forum for this. Thanks
          again for the help.
          "Greg Brail" <[email protected]> wrote in message
          news:[email protected]...
          > Hmm. The security people (on weblogic.developer.interest.security) might
          > have to help you here, too. When you set the "runAs" identity for the MDB,
          > it's doing everything, including the JNDI lookup, under that identity. So
          if
          > that identity is one that's recognized by the remote domain, then you
          should
          > be OK. One way to make your local identity recognized by the remote domain
          > is to make your domains trusted, but you may wish not to do that.
          >
          > greg
          >
          > "Steve Chan" <[email protected]> wrote in message
          > news:[email protected]...
          > > Hello,
          > >
          > > I have this problem that I am hoping someone can help me with. There is
          a
          > > MDB deployed in a local WL8.1 that is trying to connect to a Foreign JMS
          > > Server which is also a WL8.1 running in a remote server. This MDB is
          > > attempting to subscribe to a topic hosted by that foreign server. In
          the
          > > local WL8.1 I created a Foreign JMS Server via the adminconsole and
          mapped
          > > the connection factory as well as destinations to the Foreign JMS
          Server.
          > > The MDB (via its deployment descriptor) only refers to the local JNDI
          > names
          > > of the ConnectionFactory and Topic. Here are the scenarios concerning
          > > security:
          > >
          > > 1) When security is turned off (user is in group everyone) everything
          > works
          > > fine. Messages published to the foreign Topic are received by the MDB
          in
          > > the local WL8.1 server and processed.
          > >
          > > 2) When a security policy is applied to the Topic (via the remote
          > > adminconsole), the MDB in the local server gets a 'permission denied'.
          I
          > > now have to get around this by defining a principle for the MDB to run
          as
          > > and to map the credentials of this principle to that of the user in the
          > > remote environment with access permissions to the Topic.
          > >
          > > 3) When I specify the security identity of my MDB, its JNDI lookup of
          the
          > > Topic fails with 'not found'.
          > >
          > > 4) Even when the security policy in the remote server is reverted back
          to
          > > 'everyone' (effectively turning security off) but leaving the MDB
          running
          > as
          > > the security principle, it still cannot find the Topic.
          > >
          > > I hope this is something that people have seen and dealt with before.
          > > Thanks for any and all help anyone can provide. I have also included
          the
          > > deployment descriptors for this MDB:
          > >
          > > <ejb-jar>
          > > <enterprise-beans>
          > > <message-driven>
          > > <ejb-name>MDB</ejb-name>
          > > <ejb-class>sample.class.MDB</ejb-class>
          > > <transaction-type>Container</transaction-type>
          > > <message-driven-destination>
          > > <destination-type>javax.jms.Topic</destination-type>
          > > </message-driven-destination>
          > > <security-identity>
          > > <run-as>
          > > <role-name>OutsideJMSUser</role-name>
          > > </run-as>
          > > </security-identity>
          > > </message-driven>
          > > </enterprise-beans>
          > >
          > > <assembly-descriptor>
          > > <security-role>
          > > <role-name>OutsideJMSUser</role-name>
          > > </security-role>
          > > </assembly-descriptor>
          > >
          > > </ejb-jar>
          > >
          > > <weblogic-ejb-jar>
          > > <weblogic-enterprise-bean>
          > > <ejb-name>MDB</ejb-name>
          > > <message-driven-descriptor>
          > > <pool>
          > > <initial-beans-in-free-pool>1</initial-beans-in-free-pool>
          > > </pool>
          > > <destination-jndi-name>ForeignTopic</destination-jndi-name>
          > >
          > >
          >
          <connection-factory-jndi-name>ForeignConnectionFactory</connection-factory-j
          > > ndi-name>
          > > </message-driven-descriptor>
          > > <jndi-name>MDB</jndi-name>
          > > </weblogic-enterprise-bean>
          > >
          > > <security-role-assignment>
          > > <role-name>OutsideJMSUser</role-name>
          > > <principal-name>OutsideJMSUser</principal-name>
          > > </security-role-assignment>
          > >
          > > </weblogic-ejb-jar>
          > >
          > >
          >
          >