Security Propogation in MDB

Question

Hi all,
I have a doubt :
Now the requirement is like below :
A user logins with his credentials and he belongs to a Role ABC.
Does a UI Action -> This in turn posts a message to a Queue -> MDB reiceves the message and posts the message to a Topic( Security is set on this topic to use Role ABC )
How can the MDB get the user context with Role ABC ?
If we use Run-as with a principal for MDB , then it should be a hardcoded user name. And we loose track of user who initiated the UI Action(Because Different users with the same Role ABC can login to UI and start the UI Action )
Is there any other way ?
Regards,
Harsha

Answer 1

I don't think there's a public WebLogic API for applications to assume any security credential if all they have is a username without a password. You can try posting to a security newsgroup to find out for sure.
If you need to pass the security credential of a sender, the following might work:
(1) Call "weblogic.security.Security.getCurrentSubject()” on the producer prior to calling send. This returns a validated credential if there is one on the current thread.
(2) Somehow store this validated credential in the message. For example, serialize it into a byte array, convert the byte array into a base 64 encoded string, and store the string as a message property. Make absolutely sure the network, queue, message paging, and message storage are all well protected - for example use SSL connections, as anyone with access to these resources will have access to the full validated credential.
(3) On the receiving server: convert the credential back into an Object, and then try the following:
{code}
import weblogic.security.Security;
import weblogic.security.subject.AbstractSubject;
import weblogic.security.subject.SubjectManager;
class MyClass {
void doSomethingAsSubject(javax.security.auth.Subject subject) {
if (subject == null)
subject = weblogic.security.Security.getCurrentSubject();
try {
weblogic.security.Security.runAs(subject,
new java.security.PrivilegedExceptionAction() {
public java.lang.Object run() throws Exception {
// do something;
return null; // or return some Object
} catch (java.security.PrivilegedActionException e) {
// handle exception;
{code}
Regards,
Tom
Edited by: TomB on May 27, 2011 2:13 PM