Re: Re: JOnAS 5.2 / EJB3 Security - sessionContext.isCallerInRole always returns false?

Thank you Florent,

I assumed something like that but somehow I was too stupid to find out
about the @DeclareRoles annotation. I will try that.

BTW: is the EJB3 TimerService/TimedObject already implemented/supported
by JOnAS 5.2 too? We have some timed batch jobs currently
based on Quartz jobs,would be nice if we could remove them completely
and only use EJB timer service ...

regards,
Hans



Am Dienstag, den 08.02.2011, 09:28 +0100 schrieb Florent BENOIT:

> Hans J. Prueller wrote: 
> 
> > this is missing now as there is no ejb-jar.xml existent any more.
> > are the missing role-refs the problem why the SLSB does not "see"
> > them
> > in sessionContext.isCallerInRole ?   
> 
> Yes it is see § 17.2.5.2 chapter of EJB 3.0
> If the DeclareRoles annotation is not used, the Bean Provider must use
> the secu-
> rity-role-ref elements of the deployment descriptor to declare the
> security roles referenced in the
> code. The security-role-ref elements are defined as follows:
>      • Declare the name of the security role using the role-name
> element. The name must be the
>         security role name that is used as a parameter to the
> isCallerInRole(String role-
>         Name) method.
>      • Optionally provide a description of the security role in the
> description element.
> 
> If you don't want to use anymore the XML, use the @DeclareRoles
> annotation
> 
> Regards,
> 
> Florent