Bug 1005093 - Security context associated with EJB asynchronous invocations can potentially be corrupted over time by the caller thread
Security context associated with EJB asynchronous invocations can potentially...
Product: JBoss Enterprise Application Platform 6
Classification: JBoss
Component: EJB, Security (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: ER1
: EAP 6.2.0
Assigned To: David M. Lloyd
Jan Martiska
Russell Dickenson
: 1032188 (view as bug list)
Depends On:
  Show dependency treegraph
Reported: 2013-09-06 04:22 EDT by Jaikiran Pai
Modified: 2014-05-26 21:28 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
An EJB that is called asynchronously from a servlet can potentially lose its security context if the servlet invocation completes first. This occurred when security context of the servlet was cleared because both the servlet and the EJB threads share the same SecurityContext instance. Now the SecurityContext attributes are copied from the instance on the servlet thread to a new instance of the SecurityContext object on the EJB thread. Updates to SecurityContext instances on one thread no longer affect instances on other threads as expected.
Story Points: ---
Clone Of:
Last Closed: 2013-12-15 11:21:03 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Jaikiran Pai 2013-09-06 04:22:15 EDT
Consider a servlet "S" which invokes on a asynchronous EJB "A". Let's assume "S" runs with a "foo" run-as role. Now when S invokes on "A", the run-as "foo" role is correctly propagated to the asynchronous EJB invocation. However, when the "S" invocation completes and potentially clears the security context (of any run-as role), the invocation(s) within the asynchronous EJB "A" too lose the corresponding security context role association. This is because the 2 threads (the servlet invocation one and the async EJB invocation one) literally share the same object instance of the SecurityContext.

The expected behaviour is that the original security context (attributes) are copied over to the async invocation and updates to that security context later on in a separate thread shouldn't affect the ongoing async EJB invocation.
Comment 3 Jan Martiska 2013-09-19 08:01:33 EDT
Verified in EAP 6.2.0.ER1.
Comment 9 Dimitris Andreadis 2013-10-24 14:27:01 EDT
Assigning jpai@redhat.com EJB issues to david.lloyd@redhat.com. Please re-assign to Cheng or others as needed.
Comment 10 wfink 2013-11-19 12:38:15 EST
*** Bug 1032188 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.