EJB @Asynchronous security issue

herb Feb 8, 2013 3:54 PM

JBoss-AS-7.1.1.Final:

I've an ejb method "x" annotated with @Asynchronous and I've activated login module "RealmUsersRoles".

Asyncronous Pool is set to 10.

Method x is called from a jsf backing bean.

User-A logs in and calls method x 9 times. GetCallerPrincipal always returns "User-A". Thread 1 to 9 will be used.

User-B logs in and calls method x. EJB container assigns thread 10 and getCallerPrincipal returns "User-B".

That's OK so far.

Then User-B calls method x again. EJB container assigns thread 1 and getCallerPrincipal returns "User-A" (not "User-B")!!

getCallerPrincipal() seams to store the user principal the first time the thread is used. In all subsequent calls the user principal isn't updated. The originally user principal is always used?!

Any suggestions?

1. Re: EJB @Asynchronous security issue

sfcoy Feb 8, 2013 10:07 PM (in response to herb)

This sounds like AS7-4686 which was fixed in 7.1.2.Final.

There's no download for it, but it is really quite easy to build for yourself.

But, if you'e going to do that you may as well go straight to 7.1.3.Final ...
Actions
2. Re: EJB @Asynchronous security issue

herb Feb 11, 2013 9:41 AM (in response to sfcoy)

It works perfectly in 7.1.3 - many thanks!
Actions
3. Re: EJB @Asynchronous security issue

matlach Apr 12, 2013 2:02 PM (in response to sfcoy)

I have the exact same problem, do you know the components involved in this fix ?
We have a big release soon and we would like to mitigate the risk from passing from 7.1.1 to 7.1.3 or 7.2.0.

Big thanks,
Actions

Go to original post