为什么在TomEE上远程调用EJB时​​会出现AuthenticationException？

Question

I have a ejb running on a TomEE 7.0.3 server. btw, all this was working in Tomee 1.7.4. I have setup a set of users using the tomcat-users.xml file

<tomcat-users>
    <role rolename="admin" />
    <role rolename="admin-gui" />
    <role rolename="admin-script" />
    <role rolename="manager" />
    <role rolename="manager-gui" />
    <role rolename="manager-script" />
    <role rolename="manager-jmx" />
    <role rolename="manager-status" />
    <role rolename="tomee-admin" />
    <user
        name="admin"
        password="admin"
        roles="admin,manager,admin-gui,admin-script,manager-gui,manager-script,manager-jmx,manager-status,tomee-admin" />
    <role rolename="tomcat" />
    <user
        name="tomcat"
        password="tomcat"
        roles="tomcat" />
    <user
        name="manager"
        password="manager"
        roles="manager" />
</tomcat-users>

I am able able to access the url http://127.0.0.1/tomee/ejb by providing the credentials for user 'admin'. My server.xml file has the following entries

<Resource auth="Container" description="User database that can be updated and saved"
    factory="org.apache.catalina.users.MemoryUserDatabaseFactory" name="UserDatabase"
    pathname="conf/tomcat-users.xml" type="org.apache.catalina.UserDatabase" />

and

    <Realm className="org.apache.catalina.realm.LockOutRealm">
        <!-- This Realm uses the UserDatabase configured in the global JNDI resources 
            under the key "UserDatabase". Any edits that are performed against this UserDatabase 
            are immediately available for use by the Realm. -->
        <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
            resourceName="UserDatabase" />
    </Realm>

The problem is when I try to invoke the ejb remotely, my JNDI InitialContext uses the following properties.

java.naming.factory.initial=org.apache.openejb.client.RemoteInitialContextFactory
java.naming.provider.url=http://127.0.0.1:8082/tomee/ejb
java.naming.security.principal=admin
java.naming.security.credentials=admin

Following is the code for calling the ejb.

public static Object locateService(String serviceName) throws NamingException, IOException {
    InputStream in = ServiceLocator.class.getClassLoader().getResourceAsStream("servicelocator.properties");
    Properties p = new Properties();
    p.load(in);
    InitialContext ctx = new InitialContext(p);
    return ctx.lookup("PaymentManagerRemote");
}

As you can see I am supplying the correct username and password but I get the following exception

Apr 27, 2017 12:39:07 PM org.apache.openejb.client.EventLogger log
INFO: RemoteInitialContextCreated{providerUri=http://127.0.0.1:8082/tomee/ejb}
Exception in thread "main" javax.naming.AuthenticationException: Error while communicating with server: ; nested exception is: 
    javax.naming.AuthenticationException
    at org.apache.openejb.client.JNDIContext.authenticate(JNDIContext.java:381)
    at org.apache.openejb.client.JNDIContext.getInitialContext(JNDIContext.java:289)
    at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684)
    at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:313)
    at javax.naming.InitialContext.init(InitialContext.java:244)
    at javax.naming.InitialContext.<init>(InitialContext.java:216)
    at co.uk.meghdoot.core.util.ServiceLocator.locateService(ServiceLocator.java:20)
    at co.uk.meghdoot.core.test.DeviceLocationTest.setUp(DeviceLocationTest.java:53)
    at co.uk.meghdoot.core.test.DeviceLocationTest.main(DeviceLocationTest.java:109)

Can anyone shed some light on this?

Answer 1

using tomcat-users.xml assumes you used UserDatabaseRealm as realm in server.xml which is maybe not the case (not written in your question). This also assume the authentication is done through servlet/tomcat backbone. This is not the case by default until you added in tomee webapp (you can create it physically and define the ejbd servlet - see http://tomee.apache.org/ejbd-transport.html - a filter doing a request.login().

Using ejbd protocol tomee will automatically log in using tomee security service which will rely on the first realm of the server.xml by default.