panga / jboss-security-extended Goto Github PK

Hi. Big thanks for this WA.
I use it? but found some problem after logout. If i call

org.jboss.security.SecurityContextAssociation#clearSecurityContext

for thread with original Subject, webscoket still provide Principal and Roles about user that was already logout. In case with backgroud repetable tasks it not so good. I can't find any WA for it. May be have any idea?

Hi,

We are using jboss 6.4.7 and a standard MessageListener with the following configuration using your JmsSecurityInterceptor:

@MessageDriven(name = "ExportMDB", activationConfig =
{ @ActivationConfigProperty(propertyName = "destinationType", propertyValue = "javax.jms.Queue"),
@ActivationConfigProperty(propertyName = "destination", propertyValue = "java:/jms/queue/ExportRequestQ") })
@singleton
@startup
@TransactionAttribute(TransactionAttributeType.REQUIRED)
@interceptors(JmsSecurityInterceptor.class)

While executing onMessage on the JMS MDB the SecurityActions class/setSubjectInfo method is called and the following line returns securityContext null and later we get NullPointerException error when the securityContext is referenced:

final SecurityContext securityContext = SecurityContextAssociation.getSecurityContext();

Can you recommend a solution to this issue?

Does it make sense to create a SecurityContext if non exists for the MDB? This the solution we are using and I can create a patch with that change and add it to the project if you agree to this solution.

Thanks.