Fixed broken isCallerInRole when using Tomcat JAASRealm with the TomcatSecurityService

• Key: OPENEJB-901
• Type: Bug
• Status: Resolved
• Resolution: Fixed
• Priority: Major
• Assignee: Dain Sundstrom
• Reporter: Luis Fernando Planella Gonzalez
• Component/s: tomcat
• Affects Version/s: 3.0
• Fix Version/s: 3.1

Description

TomcatSecurityService currently uses only the default container Realm to authenticate users, ignoring a context-defined Realm.
So, an user is correctly authenticated on the web application (for example, through j_security_check), but is not correctly authenticated in EJBs.
Attached, is a war file and a jaas configuration file, which should have the system property java.security.auth.login.config set to it.
To test, first authenticate by visiting http://localhost:8080/test/protected.jsp. Any username / password is validated, and the "user" role is granted. Then browse to http://localhost:8080/test/test, and a permission denied exception is thrown, because the role "user" is not granted.
Another test is comment the @RolesAllowed("user") in TestServiceBean.sayHello() method. In this case, the isCallerInRole("user") is alwais false.