Re: JOnAS 5.2 / EJB3 Security - sessionContext.isCallerInRole always returns false?

Hans J. Prueller wrote:
> this is missing now as there is no ejb-jar.xml existent any more. are 
> the missing role-refs the problem why the SLSB does not "see" them
> in sessionContext.isCallerInRole ?  
Yes it is see § 17.2.5.2 chapter of EJB 3.0
If the DeclareRoles annotation is not used, the Bean Provider must use 
the secu-
rity-role-ref elements of the deployment descriptor to declare the 
security roles referenced in the
code. The security-role-ref elements are defined as follows:
     • Declare the name of the security role using the role-name 
element. The name must be the
        security role name that is used as a parameter to the 
isCallerInRole(String role-
        Name) method.
     • Optionally provide a description of the security role in the 
description element.

If you don't want to use anymore the XML, use the @DeclareRoles annotation

Regards,

Florent