Who can give me a clear picture on getCalllerPrincipal in EJB

Question

We keep on encountering some problems which are related with security issues. So
I hope can get a clear picture on how it is handled inside WebLogic.
Currently what we did is we create a common login function. Inside this function,
we declare a local InitialContext variable and initiate the variable by passing
in userid and password. After this program finished, the InitialContext object
will be removed by java garbage collection.
Our login function (JSP or Servlet) will trigger this common function to login
a particular user. Then the function will create other InitialContext object without
passing in any parameter. This InitialContext object will be cached in a class’
static variable. The rest of function will use this object to look EJBs. For getting
the best performance, we also cache the remote home interface for stateless Session
EJB and catch home interface for Entity EJB.
In one of our EJB function, we want to get current login user id. We use sessionContext.getCallerPrincipal()
to get current login user id from WebLogic Realm. This is working fine in our
in-house environment. But when we deploy our product into other project environment,
it doesn’t work. The error scenario is
User A login first, everything working fine. After that user A logout and User
B login using the same browser. Then the getCallerPrincipal always return UserA.
We try a lot of different way, but still cannot resolve this problem.
Is it because we cached InitialContext or EJB interface? I hope some body can
give me a clear picture on how the Web tier and EJB tier is linked by WebLogic;
Why EJB can share the same user principal with JSP or Servlet and never confuse
between other Web session.

Answer 1

Yes, it's because you cache the InitialContext. You need to refresh the context with
the current user's principal+credentials on each HTTP request.
regards,
-Ade
"James Zhang" <[email protected]> wrote in message news:3d36975b$[email protected]..
>
We keep on encountering some problems which are related with security issues. So
I hope can get a clear picture on how it is handled inside WebLogic.
Currently what we did is we create a common login function. Inside this function,
we declare a local InitialContext variable and initiate the variable by passing
in userid and password. After this program finished, the InitialContext object
will be removed by java garbage collection.
Our login function (JSP or Servlet) will trigger this common function to login
a particular user. Then the function will create other InitialContext object without
passing in any parameter. This InitialContext object will be cached in a class'
static variable. The rest of function will use this object to look EJBs. For getting
the best performance, we also cache the remote home interface for stateless Session
EJB and catch home interface for Entity EJB.
In one of our EJB function, we want to get current login user id. We use sessionContext.getCallerPrincipal()
to get current login user id from WebLogic Realm. This is working fine in our
in-house environment. But when we deploy our product into other project environment,
it doesn't work. The error scenario is
User A login first, everything working fine. After that user A logout and User
B login using the same browser. Then the getCallerPrincipal always return UserA.
We try a lot of different way, but still cannot resolve this problem.
Is it because we cached InitialContext or EJB interface? I hope some body can
give me a clear picture on how the Web tier and EJB tier is linked by WebLogic;
Why EJB can share the same user principal with JSP or Servlet and never confuse
between other Web session.