Bug 1111017

Created attachment 910244 [details]
EJB in a WAR with security annotations

Description of problem:

The resteasy documentation about EJB exposed as JAX-RS resources warn us the following about the boolean paramenter "resteasy.role.based.security":

"Do not turn on this switch if you are using EJBs. The EJB container will provide this functionality instead of Resteasy. "

This rule, however, seems not to be true for EJB that are in WARs. It seems I need to turn this on parameter.


It, however, is not needed when we uses an EJB in a JAR and lookup it from war using RESTEasy to expose it as a JAX-RS resource.


How reproducible:

Easy. There are two reproducers ready to be used.

Steps to Reproduce:

Find attached two examples:

1) helloworld-rs-ejb-secured: An example that shows the security on an EJB using annotations and using only WAR packaging (EJB 3.1 or EJB Lite);
2) rs-ejb-ear-secured: contains EJBs in a separated EAR and a web application to lookup these EJBs.

In 1, we have an EJB in a WAR("EJB Lite") packaged and exposed as a JAX-RS resource. However, you will also see the parameter "resteasy.role.based.security" set as true in web.xml. In 2, it doesn't have the resteasy.role.based.security set as true, but the EJB is on a JAR and in an EAR deployment.

Actual results:

need to set the parameter to true in reproducer 1.

Expected results:

Reproducer 1 shouldn't require us to set the parameter as true, since it's an EJB.

Additional info:

If this is an expected behaviour, not fix is needed, just an update in the documentation.

Mentioned documentation: https://access.redhat.com/site/documentation/en-US/JBoss_Enterprise_Application_Platform/6.2/html/Development_Guide/sect-JAX-RS_Application_Security.html#Enable_Role-Based_Security_for_a_RESTEasy_JAX-RS_Web_Service1-1