Home/ Questions/Q 6781141
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T16:35:21+00:00

I am trying to implement security for the following architecture: Web tier: Tomcat 7

  • 0

I am trying to implement security for the following architecture:

  • Web tier: Tomcat 7 app server using GWT.
  • Back end: JBoss 7.1 app server using EJBs and JPA to persist data. EJBs are consumed remotely by the web tier.

I am thinking of using JBoss security, which involves:

  • Creating a security domain in JBoss via login-config.xml
  • The security domain uses a DatabaseServerLoginModule to retrieve data from a MySQL db in terms of username/password and roles.
  • Authorization: EJB based security by annotating my EJB methods with @RolesAllowed.

I made this working before in a single JBoss and configuring web.xml in JBoss’ Tomcat. Then jboss-web.xml to bind my web application to the security domain that I have created in JBoss.

My concern is now how all this works using two separate servers: a Tomcat web container that makes remote calls to a back-end JBoss. My questions:

  • How can I make my Tomcat aware of the security domain defined in the remote JBoss (if possible at all) so that it delegates to JBoss the task of looking up for the credentials in the DB?
  • If my GWT components call the remote EJBs, how can I propagate the security credentials from Tomcat to the remote JBoss (principal, password) in a way that I don’t have to specify those in each call?
  • Is this feasible at all? Are there other alternatives out there that can make my life easier in this scenario?
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    1. There’s no standard way to access a LoginModule remotely. So if you want to use your backend’s loginmodule as a JAAS loginmodule in your front-end, you’d have to expose the logic from your backend e.g. as a REST or WS service, and create a custom loginmodule in Tomcat to call it remotely.

    2. In theory, the JAAS security context should be propagated if you lookup your backend EJBs via JNDI and execute secured method calls on it. In practice, every AS handles this differently, and I never saw it working between different AS.

    3. There is an alternative, which is to use Spring Security. See the package org.springframework.security.remoting.httpinvoker and org.springframework.security.remoting.rmi. But this requires that you use Spring Remoting and Spring Security all the way.

    • 0