users@glassfish.java.net

EJB Security Problem

From: <glassfish_at_javadesktop.org>
Date: Mon, 16 Feb 2009 03:34:00 PST

Hello,
I have an EJB security problem. My EJB component has the following structure (in my real EJB application, all this interfaces makes sense but here I simplified the structure to get right into the point)

public interface IGeneric<T> {
&nbsp;&nbsp;&nbsp;&nbsp;T aMethod();
}

public interface SimpleEjb extends IGeneric<String> {
}

@Remote
public interface SimpleEjbRemote extends SimpleEjb {
}

@Local
public interface SimpleEjbLocal extends SimpleEjb {
}

@Stateless
@DeclareRoles(“admin”)
public class SimpleEjbImpl implements SimpleEjbLocal, SimpleEjbRemote {
&nbsp;&nbsp;&nbsp;&nbsp;@RolesAllowed(“admin”)
&nbsp;&nbsp;&nbsp;&nbsp;public String aMethod() {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return “a string”;
&nbsp;&nbsp;&nbsp;&nbsp;}
}

Although aMethod is restricted to admins, every user can call it. The problem goes away when I remove the IGeneric<T> interface and declare aMethod in SimpleEjb interface:

public interface SimpleEjb {
&nbsp;&nbsp;&nbsp;&nbsp;String aMethod();
}


@Remote
public interface SimpleEjbRemote extends SimpleEjb {
}

@Local
public interface SimpleEjbLocal extends SimpleEjb {
}

@Stateless
@DeclareRoles(“admin”)
public class SimpleEjbImpl implements SimpleEjbLocal, SimpleEjbRemote {
&nbsp;&nbsp;&nbsp;&nbsp;@RolesAllowed(“admin”)
&nbsp;&nbsp;&nbsp;&nbsp;public String aMethod() {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return “a string”;
&nbsp;&nbsp;&nbsp;&nbsp;}
}

But this is not what I want because in my real EJB component I need that parameterized interface to prevent code repetition. So is this normal or a bug of GlassFish?
[Message sent by forum member 'bsevindi' (bsevindi)]

http://forums.java.net/jive/thread.jspa?messageID=332043