call remote ejb returns Invalid User using Wildfly 9.0.1

Question

I can successfully call a remote EJB if I am using a default security domain set-up in wildfly. I guest this security domain is not checking any user credentials at all. I encounter the exception below after implementing or using a security domain that checks username and password in database.

I cannot figure out what I am missing. I hope someone here can point me in a right direction.

Exception:

Exception in thread "main" javax.ejb.EJBAccessException: WFLYSEC0027: Invalid User
at org.jboss.as.ejb3.security.SecurityContextInterceptor$1.run(SecurityContextInterceptor.java:69)
at org.jboss.as.ejb3.security.SecurityContextInterceptor$1.run(SecurityContextInterceptor.java:49)
at org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:97)
...

jboss-ejb3.xml:

<jboss:jboss
    xmlns="http://java.sun.com/xml/ns/javaee"
    xmlns:jboss="http://www.jboss.com/xml/ns/javaee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:s="urn:security:1.1"
    version="3.1" impl-version="2.0">

<assembly-descriptor>
    <s:security>
        <!-- Even wildcard * is supported -->
        <ejb-name>*</ejb-name>
        <!-- Name of the security domain which is configured in the EJB3 subsystem -->
        <s:security-domain>ejb-database-policy</s:security-domain>
    </s:security>
</assembly-descriptor>

standalone.xml

<security-domain name="ejb-database-policy" cache-type="default">
    <authentication>
        <login-module code="Database" flag="required">
            <module-option name="dsJndiName" value="java:/jdbc/mysqlds"/>
            <module-option name="principalsQuery" value="SELECT user_password FROM app_user WHERE username=?"/>
            <module-option name="rolesQuery" value="SELECT role, 'Roles' FROM user_role WHERE username=?"/>
            <module-option name="hashAlgorithm" value="SHA-256"/>
            <module-option name="hashEncoding" value="base64"/>
            <module-option name="unauthenticatedIdentity" value="guest"/>
        </login-module>
    </authentication>
</security-domain>

TestRemote.java

public class TestRemote {
public static void main(String[] args) {
    new TestRemote().exec();
}

public void exec() {
    try {
        Hashtable prop = new Hashtable();
        prop.put(Context.INITIAL_CONTEXT_FACTORY, "org.jboss.naming.remote.client.InitialContextFactory");
        prop.put(Context.PROVIDER_URL, "http-remoting://127.0.0.1:8080");
        prop.put(Context.SECURITY_PRINCIPAL, "anonymous");
        prop.put(Context.SECURITY_CREDENTIALS, "admin");

        prop.put("jboss.naming.client.ejb.context", true);

        Context context = new InitialContext(prop);

        final String ejb = "/MyAppEar/MyAppEjb//UserBean!com.test.controller.UserBeanRemote";
        UserBeanRemote bean = (UserBeanRemote)context.lookup(ejb);


        List<AppUser> users = bean.getUserList(null, 0, 0);
        if(users != null) {
            for(AppUser user: users) {
                System.out.println("UserID: " + user.getUserId() + ", username:" + user.getUsername());
            }               
        } else {
            System.out.println("User list is empty");
        }

    } catch(NamingException e) {
        e.printStackTrace();
    }
}
}

Thanks, Bell

bell bell · Accepted Answer · 2016-08-31T00:00:55

Problem solved.

Here are the additional step/set-up that I did.

1) In standalone.xml, I change ApplicationRealm authentication to JAAS.

    <security-realm name="ApplicationRealm">
    <authentication>
        <jaas name="ejb-database-policy"/>
    </authentication>
    <authorization>
        <properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
    </authorization>
</security-realm>

2) In TestRemote.java, I add prop.put("jboss.naming.client.connect.options.org.xnio.Options.SASL_POLICY_NOPLAINTEXT", "false");

Thats it.

Thanks, Bell

call remote ejb returns Invalid User using Wildfly 9.0.1

1 Answers