Roles Based Security for EJB deployed on Weblogic

Question

I am working on an EJB application. I have to apply role based security on session bean(EJB3) methods, for which I tried annotating the session bean method with "@RolesAllowed" as below,

For creating User, groups and roles i am using jazn-data.xml as below,

After the deploying the EJB and running the application, security does get applied and throws an exception [EJB:010160]Security Violation: User: 'XXX' has insufficient permission to access EJB

After Adding the weblogic ejb deployment descriptor as below,

<?xml version = '1.0' encoding = 'windows-1252'?>
<weblogic-ejb-jar xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                  xsi:schemaLocation="http://xmlns.oracle.com/weblogic/weblogic-ejb-jar http://xmlns.oracle.com/weblogic/weblogic-ejb-jar/1.1/weblogic-ejb-jar.xsd"
                  xmlns="http://xmlns.oracle.com/weblogic/weblogic-ejb-jar">
    <weblogic-enterprise-bean>
        <ejb-name>ApplicationFacade</ejb-name>
        <stateless-session-descriptor/>
        <enable-call-by-reference>true</enable-call-by-reference>
    </weblogic-enterprise-bean>
    <security-role-assignment>
        <role-name>PVUser</role-name>
        <principal-name>pv</principal-name>
    </security-role-assignment>
    <security-role-assignment>
        <role-name>PRUser</role-name>
        <principal-name>pr</principal-name>

    </security-role-assignment>
</weblogic-ejb-jar>

It starts working as expected.

My question is related to weblogic ejb deployment descriptor(weblogic-ejb-jar.xml), do I have to make an entry for each user (pricipal-name), each time I am adding a new user or is there a way by which i can map a user-groups?

Also let me know if I have missed any other configuration required to add permissions.

You can also configure the roles at the realm and configure weblogic with: <security-role-assignment> <role-name>RoleName</role-name> <externally-defined /> </security-role-assignment> — pablosaraiva

BobCC BobCC · Accepted Answer · 2013-10-26T03:58:10

The Answer is yes,

and what you need to do is creating a group named xxx by login to the weblogic console( modify within the Security Realms panel)
then adding all of the user to the group named xxx
lastly in the weblogic ejb deployment descriptor you just need to
specify the group name as

< principal-name >xxxgroup name < / principal-name >

as a result, every member within the group would share the permission.

Roles Based Security for EJB deployed on Weblogic

1 Answers