1 Reply Latest reply: Sep 15, 2011 1:51 PM by Marcus Moyses RSS

    SecurityDomain Annotation

    Ramon Molossi Newbie

      I'm creating a WebApplication using Jboss AS 7 and trying to use a Form Based Authentication using a DatabaseServerLoginModule.


      My authentication and roles are ok.


      I had a problem to protect a EJB class.


      I configured my EJB methods with @RolesAllowed("Admin") as I wanted.


      But nothing is getting blocked, even who don't have the "Admin" Role....

      Then I tried to configure the @org.jboss.security.annotation.SecurityDomain("myDomain") at class type definition. Nothing gets blocked yet.



      Then I tried to use @org.jboss.ejb3.annotation.SecurityDomain("myDomain") and things starts work.


      I just want to know why. If I am not supposed to use de org.jboss.security annotation or if I missed some configuration.


      My configuration is really simple:


                     <security-domain name="myDomain" cache-type="default">


                              <login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag="required">

                                  <module-option name="dsJndiName" value="java:jboss/datasources/myDS"/>

                                  <module-option name="principalsQuery" value="mySQL1"/>

                                  <module-option name="rolesQuery" value=mySQL2"/>

                                  <module-option name="hashAlgorithm" value="MD5"/>

                                  <module-option name="hashEncoding" value="HEX"/>





      ps: At this moment I just trying authentication configs wich are really ok, I'm having some troubles with authorization configs inside this security-domain, but I will create a new discussion to that.