title: Wildfly, JAAS and SecurityContext
body: <p>I'm still playin with Wildfly-9.0.1.Final and JAAS (see my previous question <a href="https://stackoverflow.com/questions/33203277/wildfly-and-jaas-login-module">Wildfly and JAAS login module</a>) in a web application that use a <code>BASIC auth-method</code>. While my custom login module works I got some problems about authorization. I use a RESTeasy RESTFul web service with annotation to test, here is the code:</p>
  
  <pre><code>package it.bytebear.web.mongo;
  
  import it.bytebear.web.mongo.jaas.MongoModuleCallbackHandler;
  import it.bytebear.web.mongo.model.User;
  
  import java.security.Principal;
  import java.util.ArrayList;
  import java.util.List;
  
  import javax.annotation.security.PermitAll;
  import javax.annotation.security.RolesAllowed;
  import javax.ejb.Stateless;
  import javax.security.auth.Subject;
  import javax.security.auth.login.LoginContext;
  import javax.ws.rs.Consumes;
  import javax.ws.rs.GET;
  import javax.ws.rs.POST;
  import javax.ws.rs.Path;
  import javax.ws.rs.core.Context;
  import javax.ws.rs.core.MediaType;
  import javax.ws.rs.core.Request;
  import javax.ws.rs.core.Response;
  import javax.ws.rs.core.Response.Status;
  import javax.ws.rs.core.SecurityContext;
  
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  
  Path("/service")
  Stateless
  ublic class UserServices {
  
      private Logger log = LoggerFactory.getLogger(UserServices.class);
  
      @GET
      @Path("/userA")
      @RolesAllowed({ "userA" })
      public Response postUserA() {
          return Response.ok("You're user A.", MediaType.TEXT_HTML).build();
      }
  
      @GET
      @Path("/userB")
      @RolesAllowed({ "userB" })
      public Response postUserB() {
          return Response.ok("You're user B.", MediaType.TEXT_HTML).build();
      }
  
      @GET
      @Path("/userC")
      @RolesAllowed({ "userC" })
      public Response postUserC() {
          return Response.ok("You're user C.", MediaType.TEXT_HTML).build();
      }
  
      @POST
      @Path("/login")
      @PermitAll
      @Consumes(MediaType.APPLICATION_JSON)
      // @Consumes("application/x-authc-username-password+json")
      public Response login(User userCredentials) {
          log.info("logging in.");
          try {
              MongoModuleCallbackHandler handler = new MongoModuleCallbackHandler();
              handler.setUsername(userCredentials.getUserName());
              handler.setPassword(userCredentials.getPassword().toCharArray());
              LoginContext loginContext = new LoginContext("MongoLoginRealm", handler);
              loginContext.login();
              Subject subject = loginContext.getSubject();
              List&lt;String&gt; roles = new ArrayList&lt;String&gt;();
              for (Principal p : subject.getPrincipals()) {
                  roles.add(p.getName());
              }
              String[] userCredentialsRoles = new String[roles.size()];
              roles.toArray(userCredentialsRoles);
              userCredentials.setRoles(userCredentialsRoles);
              return Response.ok().entity(userCredentials)
                      .type(MediaType.APPLICATION_JSON_TYPE).build();
          } catch (Exception e) {
              log.error("login fails.", e);
              return Response.status(Status.FORBIDDEN).entity("Not logged")
                      .type(MediaType.APPLICATION_JSON_TYPE).build();
          }
      }
  
      @GET
      @Path("/logout")
      @PermitAll
      public Response logout(Request req) {
          return Response.ok().build();
      }
  
      @POST
      @Path("/test")
      @PermitAll
      public Response test(@Context SecurityContext ctx) {
          Principal p = ctx.getUserPrincipal();
          return Response.status(Status.OK).entity(p).build();
      }
  }
  </code></pre>
  
  <p>My login module is correctly invoked and generate a subjec with a <code>Group</code> named <code>Roles</code> containing a <code>Principal</code> named <code>userA</code>, but when I try to access <code>.../service/userA</code> I always get a <code>403</code> error. I use <code>test</code> method to check <code>subject</code> but <code>ctx.getUserPrincipal()</code> always return <code>null</code>. I miss how <code>LoginModule</code> and <code>SecurityContext</code> works, how <code>SecurityContext</code> knows about a Subject? More important: I'd like to learn more, link to resources and docs will be appreciated.</p>
  
  <p>UPDATE:
  In my <code>web.xml</code> I'm using RESTEasy security:</p>
  
  <pre><code>...
  &lt;context-param&gt;
  &lt;param-name&gt;resteasy.role.based.security&lt;/param-name&gt;
  &lt;param-value&gt;true&lt;/param-value&gt;
  &lt;/context-param&gt;
  ...
  </code></pre>
  
  <p>Am I messing up EJB security with RESTEasy security?</p>