Roles in deployment descrip v. admin console

Question

In the weblogic-ejb-jar.xml of my EJB I assign a role 'Employees' to a principal
'joe'. My client code
calls the EJB successfully using the supplied LoginModule, supplying username
'joe' and a password.
If I remove the assignment in the deployment descriptor and redeploy, my client
is prevented from
invoking on the EJB. So far so good.
'joe' is, I assume, known to the server because it's the name and password with
which the server
is started.
If the delpoyment descriptor doesn't have the role assignment, I expected I could
use the admin
console to assign the role to the user. Specifically, under Security -> Realms
-> myrealm -> Roles
-> Employees I set a Condition "If the user name of the caller is joe". The client
isn't allowed to
invoke on the EJB.
What am I missing?

Answer 1

Hi William,
Do you know if a <ROLE-NAME> has to be defined in the web.xml or weblogic.xml
or the console in order for me to be able to check the isCallerInRole() and have
it return true? Is there a way to drive the list of valid roles from my own database
behind one of the Security Providers?
Thanks,
Jerry
William Kemp <[email protected]> wrote:
The Console defined role and the DD defined role are not the same thing.
The WLS
Security Role is not an application defined Role, that is created in
the deployment
descriptors. In 7.0sp1, there has been a new weblogic.xml/weblogic-ejb-jar.xml
tag,
<global-role> that has been created to allow the mapping of an application
defined
role, to a WLS role, without the assingment of a Principal in the DD.
Please see:
http://edocs.bea.com/wls/docs70/security/cli_apps.html#1090734
Bill
Stephen Maturin wrote:
In the weblogic-ejb-jar.xml of my EJB I assign a role 'Employees' toa principal
'joe'. My client code
calls the EJB successfully using the supplied LoginModule, supplyingusername
'joe' and a password.
If I remove the assignment in the deployment descriptor and redeploy,my client
is prevented from
invoking on the EJB. So far so good.
'joe' is, I assume, known to the server because it's the name and passwordwith
which the server
is started.
If the delpoyment descriptor doesn't have the role assignment, I expectedI could
use the admin
console to assign the role to the user. Specifically, under Security-> Realms
-> myrealm -> Roles
-> Employees I set a Condition "If the user name of the caller is joe".The client
isn't allowed to
invoke on the EJB.
What am I missing?