SecurityException: "Reserve" errors when obtaining jdbc connections

Question

Hi,
We've seen an interesting issue come up with Weblogic 6.1 SP3. Not sure why this
is happening now.
I am using the MBean approach to creating Connection Pools dynamically. This still
works. The main thing I had to change for SP3 was to add a user/password when
I grab the Admin MBean. So this is all working fine.
The problem I get is when I try to make a connection. I end up getting a Pool
connect failed: java.lang.SecurityException: User "guest" does not have Per
mission "reserve" based on ACL "dynaPool". There were two ways I saw to solve
this, and I was wondering which was the best.
1) Add an acl that looks like "acl.reserve.dynaPool=everyone", and that seems
to work.
2) User the Driver.connect(String url, Properties aProps) where I include a "user"
and "password" key for the properties file. I use the same user/password that
I used to grab the Admin MBean. Problem is, I can't find any doc on this, or why
it works. Maybe you can enlighten me on why this works.
Anyway, I was curious on why 2) works, as well as which approach is the recommended.
We didn't see this reserve error until we tried to utilize SP3. Thanks in advance
for your assistance.
Michael Dolbear

Answer 1

Hi Michael,
When there is no user provided, user "guest" is used.
AFAIR in SP2 in ACL was not defined on a pool, this effectively
allowed making connection to everyone, including guest.
I haven't worked on SP3, but it looks like the approach changed.
Speaking about the preferable way of making a connection,
the second one is better as the principal is clearly specified.
The first method can be harmful from security point of
view.
Hope it helps,
Regards,
Slava Imeshev
"Michael Dolbear" <[email protected]> wrote in message
news:[email protected]...
>
Hi Slava,
1) Getting the connection:
Properties tempProperties = new Properties();
tempProperties.setProperty(USER,
aUserName);
tempProperties.setProperty(PASSWORD,
aPassword);
tempDriver =(Driver)Class.forName(this.getJDBCDriverClassName()).newInstance();
tempConnection = tempDriver.connect(this.getJDBCDriverURL(),
aProperties);
2) My test case deletes the connection pool after its done, but
the main things to be know are
that I am using the weblogic.jdbc.jts.Driver and the url is
"jdbc:weblogic:jts:someName".
If that's not enough, I will get you the definition. The connection poolruns
on top of a two tier driver that is the Oracle thin driver.
3)Here is the stack trace. The is no weblogoic code in it (just ours), soI don't
think it will tell you much other than the message:
com.thc.ids.inf.framework.opf.DatabaseConnectionFailure:RDBMSDataStore:::failure
to get c
onnection-Pool connect failed: java.lang.SecurityException: User "guest"does
not have Per
mission "reserve" based on ACL "dynaPool".
atcom.thc.ids.inf.framework.opf.rdbms.datastore.RDBMSDataStore.getConnection(R
DBM
SDataStore.java:74)
atcom.thc.ids.inf.framework.opf.rdbms.query.RDBMSObjectQuery.getConnection(RDB
MSO
bjectQuery.java:104)
atcom.thc.ids.inf.util.persistence.content.queries.DrugsForNameQuery.findDrugs
For
Name(DrugsForNameQuery.java:88)
atcom.thc.ids.inf.util.persistence.content.queries.DrugsForNameQuery.runQuery(
Dru
gsForNameQuery.java:69)
atcom.thc.ids.inf.services.business.css.spi.oracle.OracleSearchProvider.basicR
unQ
uery(OracleSearchProvider.java:251)
atcom.thc.ids.inf.services.business.css.spi.oracle.OracleSearchProvider.basicE
xec
uteSearch(OracleSearchProvider.java:169)
atcom.thc.ids.inf.services.business.css.spi.oracle.OracleSearchProvider.execut
eSe
arch(OracleSearchProvider.java:65)
atcom.thc.ids.inf.services.business.css.ContentSearchService.executeSearch(Con
ten
tSearchService.java:89)
at java.lang.reflect.Method.invoke(Native Method)
atcom.thc.ids.inf.util.reflection.MethodDescription.invokeMethod(MethodDescrip
tio
n.java:181)
atcom.thc.ids.inf.util.reflection.MethodInvocation.invoke(MethodInvocation.jav
a:7
9)
atcom.thc.ids.inf.framework.service.internal.ServerObject.invoke(ServerObject.
jav
a:141)
atcom.thc.ids.inf.framework.service.J2EE.ejb.ServiceBean_nd24gc_EOImpl.invoke(
Ser
viceBean_nd24gc_EOImpl.java:37)
atcom.thc.ids.inf.framework.service.J2EE.ejb.ServiceBean_nd24gc_EOImpl_WLSkel.
inv
oke(Unknown Source)
atweblogic.rmi.internal.BasicServerRef.invoke(BasicServerRef.java:305)
atweblogic.rmi.cluster.ReplicaAwareServerRef.invoke(ReplicaAwareServerRef.java
:93
atweblogic.rmi.internal.BasicServerRef.handleRequest(BasicServerRef.java:274)
atweblogic.rmi.internal.BasicExecuteRequest.execute(BasicExecuteRequest.java:2
2)
at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:139)
at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:120)
"Slava Imeshev" <[email protected]> wrote:
Hi Michael,
A couple of questions:
1. Could you show me how exactly how you obtain a connection?
2. Could you persist dynamic pool definition and post it here?
3. Well, three questions :) Could you post the stacktrace you get?
Regards,
Slava Imeshev
"Michael Dolbear" <[email protected]> wrote in message
news:[email protected]...
Hi,
We've seen an interesting issue come up with Weblogic 6.1 SP3. Notsure
why this
is happening now.
I am using the MBean approach to creating Connection Pools dynamically.This still
works. The main thing I had to change for SP3 was to add a
user/password
when
I grab the Admin MBean. So this is all working fine.
The problem I get is when I try to make a connection. I end up gettinga
Pool
connect failed: java.lang.SecurityException: User "guest" does nothave
Per
mission "reserve" based on ACL "dynaPool". There were two ways I sawto
solve
this, and I was wondering which was the best.
1) Add an acl that looks like "acl.reserve.dynaPool=everyone", andthat
seems
to work.
2) User the Driver.connect(String url, Properties aProps) where I
include
a "user"
and "password" key for the properties file. I use the same
user/password
that
I used to grab the Admin MBean. Problem is, I can't find any doc onthis,
or why
it works. Maybe you can enlighten me on why this works.
Anyway, I was curious on why 2) works, as well as which approach isthe
recommended.
We didn't see this reserve error until we tried to utilize SP3. Thanksin
advance
for your assistance.
Michael Dolbear