在WebLogic 12c中阻止对远程EJB访问的匿名访问

Question

I have a WAR containing EJB deployed in WebLogic 12c. I find that I can access EJB from a standalone client with no username/password specified in my InitialContext. Is there a way to prevent anonymous access to all EJB in a WAR?

What puzzles me is that I need to provide the correct username/password to authenticate (a wrong password will fail authentication). But I can omit the username/password (in my InitialContext properties) and it lets me access the EJB.

So I looking to configure Weblogic so that it always requires a username/password to access any EJB. And if I omit the username/password it should not let me access my EJB.

I am looking for container support for this security rather than try to implement something on my own.

Answer 1

You could define a default interceptor and do some role checking there.

The interceptor would be something like this:

public class LoginCheckInterceptor {
  @Resource
  private EJBContext ejbContext;

  @AroundInvoke
  public Object checkLogin(final InvocationContext context) throws Exception {
    if (userAuthenticated()) {
      return context.proceed();
    } else {
      throw new SecurityException("User not authorized");        
    }
  }

  private boolean userAuthenticated() {
    // do role checking as needed
    // use this.ejbContext.isCallerInRole(...)
    // or this.ejbContext.getCallerPrincipal()
  }
}

To make it work as a default interceptor (for all EJBs), customize deployment descriptor ejb-jar.xml :

<?xml version="1.0" encoding="UTF-8"?>
<ejb-jar>
  <interceptors>
    <interceptor>
      <interceptor-class>your.package.LoginCheckInterceptor</interceptor-class>
    </interceptor>
  </interceptors>
  <assembly-descriptor>
    <interceptor-binding>
      <ejb-name>*</ejb-name>
      <interceptor-class>your.package.LoginCheckInterceptor</interceptor-class>
    </interceptor-binding>
  </assembly-descriptor>
</ejb-jar>