[OPENEJB-716] Security with LocalInitialContextFactory

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0-beta-1
• Fix Version/s: 3.0-beta-2
• Component/s: security
• Assignee: David Blevins
• Reporter: Jarek Gawor
• Created: 07/Nov/07 18:22
• Updated: 28/Nov/07 02:41
• Resolved: 28/Nov/07 02:41

Description

We ran into two issues with LocalInitialContextFactory:

1) It does not support security realms like RemotelInitialContextFactory does.

2) Because LocalInitialContextFactory caches the InitialContext (context obtained from org.apache.openejb.core.ivm.naming.InitContextFactory.getInitialContext()) the security authentication is done only once per JVM instead of per access (or instance of LocalInitialContextFactory). That means, that once a user uses LocalInitialContextFactory to access some EJB without security, all other subsequent users of LocalInitialContextFactory will not be able to access EJBs with security.