Security probs upg from 2.4.100 to 2.5.107

Hi all,

Having a little problem getting the new 2.5 codeline up and running.

My current setup is:
JBoss 4.2
Java 1.6.0_02
Win 2K Server
jspwiki 2.4.100
jdbc page and attachment provider.


I use container managed security...I have JBoss authenticating against
ldap on the server, and if that fails jboss tries to authenticate
against a jdbc database. (But this is JBoss, not jspwiki jdbc security).

I'm also using jdbc users and groups in jspwiki.

I have a locked-down configuration, ie. you have to authenticate to be
able to view anything.

This has been working fine for some time.

So now I'm trying out 2.5.107.

What I'm finding is that the security policy is not working properly.
I'm using a global rather than local policy file, but once I login I'm
getting the error:

"Forbidden

Sorry, but you are not allowed to do that. "... etc

So authentication is working OK, but it doesn't look like it's picking
up the role memberships from the container, or perhaps the page
permissions aren't being loaded properly.

With the "out of the box" policy, i.e. where all users can view pages 
regardless of authentication status, I can see the pages fine. When I 
move that policy line to the Authenticated policy, it doesn't work.

One thing I wasn't sure what to do with was the additional policy
entries from jspwiki-container.policy? I added them to global 
jspwiki.policy, but it didn't make any difference.

 From log:
Initialized local security policy: 
F:\....\4.2\jboss\server\default\conf\jspwiki.policy

So the policy is being loaded, but something not working right.

I raised the log level to Debug but couldn't see anything that I could
put my finger on.

Any advice?

Cheers,
Milt