EJB Session Bean Security in Weblogic

With Weblogic it is relative easy to protect your deployed EJB's by adding roles. These roles are mapped to WLS groups or users. In this blog I will show you, how you can protect for example the EJB Session beans.
I will start with securing an EJB3 Session Bean and later on in this article I will do the same only then in 2.1 way ( ejb-jar ).

First we create the Remote interface ( JDeveloper can create the EJB Session bean and remote or local interface for you )

package nl.whitehorses.ejb.security.services;

import java.util.List;
import javax.ejb.Remote;

import nl.whitehorses.ejb.security.entities.Departments;

@Remote
public interface HrModelSessionEJB {
  Departments mergeDepartments(Departments departments);

  List<Departments> getDepartmentsFindAll();
}

Create the EJB Session Bean. First we can optional add the @Resource annotation ( SessionContext ctx ) so we can retrieve the principal ( ctx.getCallerPrincipal) or check if the principal has the right role ( ctx.isCallerInRole )
To protect the Session bean methods we can add the @RolesAllowed or @PermitAll annotation ( @RolesAllowed({"adminsEJB"}) )

package nl.whitehorses.ejb.security.services;

import java.security.Principal;

import java.util.List;

import javax.annotation.Resource;

import javax.annotation.security.RolesAllowed;

import javax.ejb.Remote;
import javax.ejb.SessionContext;
import javax.ejb.Stateless;

import javax.persistence.EntityManager;
import javax.persistence.PersistenceContext;

import nl.whitehorses.ejb.security.entities.Departments;


@Stateless(name = "HrModelSessionEJB", mappedName = "EJB_Security-HrModel-HrModelSessionEJB")
@Remote
public class HrModelSessionEJBBean implements HrModelSessionEJB {
  @PersistenceContext(unitName="HrModel")
  private EntityManager em;

  public HrModelSessionEJBBean() {
  }

  @Resource SessionContext ctx;

  @RolesAllowed({"adminsEJB"})
  public Departments mergeDepartments(Departments departments) {
      return em.merge(departments);
  }

  @RolesAllowed({"adminsEJB","usersEJB"})
  public List<Departments> getDepartmentsFindAll() {
      Principal cp = ctx.getCallerPrincipal();
      System.out.println("getname:" + cp.getName());
      if ( ctx.isCallerInRole("adminsEJB")) {
          System.out.println("user has admins role");
      }
      return em.createNamedQuery("Departments.findAll").getResultList();
  }
}

The last thing we need to do is to add the weblogic ejb deployment descriptor ( weblogic-ejb-jar ) , This maps the EJB roles to users or groups in Weblogic Security Realm ( myrealm ). Do manually or use JDeveloper 11g R1 PS1, this version has a nice visual editor for the weblogic descriptors files.
The role-name must match with the roles names used in RolesAllowed annotation and the principal-name must match with a user or role in Weblogic Security Realm.

<?xml version = '1.0' encoding = 'windows-1252'?>
<weblogic-ejb-jar xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                xsi:schemaLocation="http://www.bea.com/ns/weblogic/weblogic-ejb-jar http://www.bea.com/ns/weblogic/weblogic-ejb-jar/1.0/weblogic-ejb-jar.xsd"
                xmlns="http://www.bea.com/ns/weblogic/weblogic-ejb-jar">
<weblogic-enterprise-bean>
  <ejb-name>HrModelSessionEJB</ejb-name>
  <stateless-session-descriptor/>
  <enable-call-by-reference>true</enable-call-by-reference>
</weblogic-enterprise-bean>
<security-role-assignment>
  <role-name>usersEJB</role-name>
  <principal-name>scott</principal-name>
</security-role-assignment>
<security-role-assignment>
  <role-name>adminsEJB</role-name>
  <principal-name>edwin</principal-name>
</security-role-assignment>
</weblogic-ejb-jar>

Deploy your Session Bean to the Weblogicserver. In the Weblogic console we can check the permissions by going to the EJB deployment.
Check the EJB roles
Which WLS users or groups are connected to the EJB role


check the permissions of the Session methods.

Now we only have to make a test client and change the java.naming.security.principal property.

package nl.whitehorses.ejb.security.test;

import java.util.List;

import java.util.Properties;

import javax.naming.Context;
import javax.naming.InitialContext;

import nl.whitehorses.ejb.security.entities.Departments;
import nl.whitehorses.ejb.security.services.HrModelSessionEJB;

public class HrClient {
   public HrClient() {
       try {
           Properties parm = new Properties();
           parm.setProperty("java.naming.factory.initial","weblogic.jndi.WLInitialContextFactory");
           parm.setProperty("java.naming.provider.url","t3://localhost:7101");
           parm.setProperty("java.naming.security.principal","edwin");
           parm.setProperty("java.naming.security.credentials","weblogic1");
           final Context context =  new InitialContext(parm);

           HrModelSessionEJB hr = (HrModelSessionEJB)context.lookup("EJB_Security-HrModel-HrModelSessionEJB#nl.whitehorses.ejb.security.services.HrModelSessionEJB");

           for (Departments departments : (List<Departments>)hr.getDepartmentsFindAll()) {
               System.out.println( "departmentId = " + departments.getDepartmentId() );
               System.out.println( "departmentName = " + departments.getDepartmentName() );
               System.out.println( "locationId = " + departments.getLocationId() );
           }
       } catch (Exception ex) {
           ex.printStackTrace();
       }
   }

   public static void main(String[] args) {
       HrClient hrClient = new HrClient();
   }
}

The EJB 2.1 way is a bit different, now we need the use the ebj-jar.xml and this requires an remote home interface. So first we need to create this.

package nl.whitehorses.ejb.security.services;

import java.rmi.RemoteException;

import javax.ejb.CreateException;
import javax.ejb.EJBHome;

public interface HrModelSessionEJBHome extends EJBHome {
  HrModelSessionEJB create() throws RemoteException, CreateException;
}

The remote interface is also different then its 3.0 version.

package nl.whitehorses.ejb.security.services;

import java.rmi.RemoteException;
import java.util.List;
import javax.ejb.EJBObject;

import nl.whitehorses.ejb.security.entities.Departments;

public interface HrModelSessionEJB extends EJBObject {
    Departments mergeDepartments(Departments departments) throws RemoteException;

    List<Departments> getDepartmentsFindAll() throws RemoteException;
}

The EJB Session Bean

package nl.whitehorses.ejb.security.services;

import java.security.Principal;

import java.util.List;
import javax.annotation.Resource;

import javax.ejb.EJBHome;
import javax.ejb.EJBObject;
import javax.ejb.Handle;
import javax.ejb.Init;
import javax.ejb.Remote;
import javax.ejb.RemoteHome;
import javax.ejb.Remove;
import javax.ejb.SessionContext;
import javax.ejb.Stateless;

import javax.persistence.EntityManager;
import javax.persistence.PersistenceContext;


import nl.whitehorses.ejb.security.entities.Departments;

@Stateless(name = "HrModelSessionEJB", mappedName = "EJB_Security-HrModel-HrModelSessionEJB")
@Remote({HrModelSessionEJB.class})
@RemoteHome(HrModelSessionEJBHome.class)
public class HrModelSessionEJBBean implements HrModelSessionEJB {
    @PersistenceContext(unitName="HrModel")
    private EntityManager em;

    public HrModelSessionEJBBean() {
    }

    @Resource SessionContext ctx;


    public Departments mergeDepartments(Departments departments) {
        return em.merge(departments);
    }

    /** <code>select o from Departments o</code> */
    public List<Departments> getDepartmentsFindAll() {
        Principal cp = ctx.getCallerPrincipal();
        System.out.println("getname:" + cp.getName());
        if ( ctx.isCallerInRole("adminsEJB")) {
            System.out.println("user has admins role");
        }
        return em.createNamedQuery("Departments.findAll").getResultList();
    }

    @Init
    public void create(){};
    
    @Remove
    public void remove(){};


    public EJBHome getEJBHome() {
        return null;
    }

    public Object getPrimaryKey() {
        return null;
    }

    public Handle getHandle() {
        return null;
    }

    public boolean isIdentical(EJBObject ejbObject) {
        return false;
    }
}

We can use the same weblogic-ejb-jar.xml, now we only need to create ebj-jar.xml descriptor. This descriptor does the same as the RolesAllowed annotation

<?xml version = '1.0' encoding = 'windows-1252'?>
<ejb-jar xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee/ejb-jar_3_0.xsd"
         version="3.0" xmlns="http://java.sun.com/xml/ns/javaee">
  <enterprise-beans>
    <session>
      <ejb-name>HrModelSessionEJB</ejb-name>
      <home>nl.whitehorses.ejb.security.services.HrModelSessionEJBHome</home>
      <remote>nl.whitehorses.ejb.security.services.HrModelSessionEJB</remote>
      <ejb-class>nl.whitehorses.ejb.security.services.HrModelSessionEJBBean</ejb-class>
      <session-type>Stateless</session-type>
      <transaction-type>Container</transaction-type>
      <security-role-ref>
        <role-name>usersEJB</role-name>
      </security-role-ref>
      <security-role-ref>
        <role-name>adminsEJB</role-name>
      </security-role-ref>
    </session>
  </enterprise-beans>
  <assembly-descriptor>
    <security-role>
      <role-name>usersEJB</role-name>
    </security-role>
    <security-role>
      <role-name>adminsEJB</role-name>
    </security-role>
    <method-permission>
      <role-name>usersEJB</role-name>
      <role-name>adminsEJB</role-name>
      <method>
        <ejb-name>HrModelSessionEJB</ejb-name>
        <method-name>getDepartmentsFindAll</method-name>
      </method>
    </method-permission>
    <method-permission>
      <role-name>adminsEJB</role-name>
      <method>
        <ejb-name>HrModelSessionEJB</ejb-name>
        <method-name>mergeDepartments</method-name>
      </method>
    </method-permission>
  </assembly-descriptor>
</ejb-jar>

And the test client.

package nl.whitehorses.ejb.security.test;

import java.util.List;

import java.util.Properties;

import javax.naming.Context;
import javax.naming.InitialContext;

import nl.whitehorses.ejb.security.entities.Departments;
import nl.whitehorses.ejb.security.services.HrModelSessionEJB;
import nl.whitehorses.ejb.security.services.HrModelSessionEJBHome;

public class HrClient {
    public HrClient() {
        try {
            Properties parm = new Properties();
            parm.setProperty("java.naming.factory.initial","weblogic.jndi.WLInitialContextFactory");
            parm.setProperty("java.naming.provider.url","t3://localhost:7101");
            parm.setProperty("java.naming.security.principal","edwin");
            parm.setProperty("java.naming.security.credentials","weblogic1");
            final Context context =  new InitialContext(parm);

            HrModelSessionEJBHome hRSessionEJB = (HrModelSessionEJBHome)context.lookup("EJB_Security-HrModel-HrModelSessionEJB#nl.whitehorses.ejb.security.services.HrModelSessionEJBHome");
            HrModelSessionEJB hr = hRSessionEJB.create();

            for (Departments departments : (List<Departments>)hr.getDepartmentsFindAll()) {
                System.out.println( "departmentId = " + departments.getDepartmentId() );
                System.out.println( "departmentName = " + departments.getDepartmentName() );
                System.out.println( "locationId = " + departments.getLocationId() );
            }


        } catch (Exception ex) {
            ex.printStackTrace();
        }
    }

    public static void main(String[] args) {
        HrClient hrClient = new HrClient();
    }

}

Here is the example workspace