Thank you for the reply.
Following your suggestion I changed the ear's directory tree so my application context is contained in a single file (context.xml):
my-app.ear
---web-client.war
------WEB-INF
---------web.xml
---------...
---ejb-modules.jar
------beanRefContext.xml
------context.xml
------some/path/ClientAPI
------some/path/ClientAPIBean
------...
---...
Here is a snippet of my web.xml:
Code:
...
<context-param>
<param-name>parentContextKey</param-name>
<param-value>context</param-value>
</context-param>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value></param-value>
</context-param>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<listener>
<listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
</listener>
...
This has the effect looking for the beanRefContext.xml file in the ejb-modules.jar which contains the ejb to secure. Here is the content of beanRefContext.xml:
Code:
...
<bean id="context" class="org.springframework.context.support.ClassPathXmlApplicationContext">
<constructor-arg>
<list>
<value>context.xml</value>
</list>
</constructor-arg>
</bean>
...
context.xml, which contains all bean and security entries, is now getting used as the spring application context.
Following your other suggestion, I added a proxy that uses my security method interceptor. Here is a snippet from context.xml:
Code:
...
<jee:local-slsb id="clientAPIBean"
jndi-name="clientAPIBean#some.path.ClientAPI"
business-interface="some.path.ClientAPI" />
<bean id="methodSecurityMetadataSourceAdvisor"
class="org.springframework.security.access.intercept.aopalliance.MethodSecurityMetadataSourceAdvisor">
<constructor-arg ref="methodSecurityInterceptor" />
</bean>
<bean
class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
id="defaultAdvisorAutoProxyCreator">
<property name="beanName" value="methodSecurityMetadataSourceAdvisor" />
</bean>
<bean id="methodSecurityInterceptor"
class="org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor">
<property name="authenticationManager">
<ref bean="authenticationManager" />
</property>
<property name="accessDecisionManager">
<ref local="businessAccessDecisionManager" />
</property>
<property name="afterInvocationManager">
<ref local="afterInvocationManager" />
</property>
<property name="securityMetadataSource">
<value>
some.path.ClientAPI.retrieveAllItems=AFTER_ACL_COLLECTION_READ
</value>
</property>
</bean>
<bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter" />
<bean id="businessAccessDecisionManager"
class="org.springframework.security.access.vote.AffirmativeBased">
<property name="allowIfAllAbstainDecisions" value="true" />
<property name="decisionVoters">
<list>
<ref local="roleVoter" />
</list>
</property>
</bean>
<security:global-method-security
access-decision-manager-ref="businessAccessDecisionManager">
</security:global-method-security>
...
When I deployed the ear to Weblogic, the log4j log still looks ok:
Code:
...
[org.springframework.ejb.access.LocalStatelessSessionProxyFactoryBean] Located object with JNDI name [java:comp/env/ClientAPIBean#some.path.ClientAPI]
[org.springframework.aop.framework.JdkDynamicAopProxy] Creating JDK dynamic proxy: target source is EmptyTargetSource: no target class, static
[org.springframework.beans.factory.support.DefaultListableBeanFactory] Finished creating instance of bean 'clientAPIBean'
...
[org.springframework.web.context.ContextLoader] Root WebApplicationContext: initialization completed in 4141 ms
...
If I used my web UI to go through the use case where the some.path.ClientAPI.retrieveAllItems method is called, the log4j log does not show any other messages. I would expect to see method security interceptor related messages. Once again, it is not getting called.
Is there anything else I can try?
Thank you!
PS: About your suggestion on using namespace style configuration, I did not find an application context descriptor in samples/examples that uses that style to declare method security interceptors and its dependencies. Do you know about any sample/example that would do such a thing?
Also, I had a look at this page. How would I use the global-method-security to declare my interceptor?
After Invocation Collection Filtering From an EJB (Stateless Session Bean)
Reply With Quote
