title: Standalone Connection to JBoss EJB with Custom Login Module
body: <p>I have a custom login module defined in JBoss EAP 6.4.0.GA (AS 7.5.0.Final-redhat-21).</p>
  
  <pre><code>&lt;login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag="required"&gt;
      &lt;module-option name="dsJndiName" value="java:jboss/datasources/MySQLDS"/&gt;
      &lt;module-option name="principalsQuery" value="SELECT password FROM xxx.User WHERE name=?"/&gt;
      &lt;module-option name="rolesQuery" value="SELECT r.name, 'Roles' FROM xxx.Role r JOIN xxx.User_Roles ur ON r.id=ur.role_id JOIN xxx.User u ON ur.user_id=u.id WHERE u.name=?"/&gt;
      &lt;module-option name="hashAlgorithm" value="SHA-256"/&gt;
      &lt;module-option name="hashEncoding" value="hex"/&gt;
      &lt;module-option name="password-stacking" value="useFirstPass"/&gt;
  </code></pre>
  
  <p>
      </p>
  
  <p>It (successfully) connects to MySQL to retrieve the username, password and role. The EJB is annotated with @RolesAllowed(value = "Administrator")
  @SecurityDomain(value = "xxx"). When I connect to the EJB using a web application or using a Web Service with basic authentication it connects fine (still now). The user is properly authenticated. However, using the following "standalone" code I cannot authenticate the user:</p>
  
  <pre><code>final EJBClientConfiguration ejbClientConfiguration = new PropertiesBasedEJBClientConfiguration(
                  this.properties);
  final ConfigBasedEJBClientContextSelector selector = new ConfigBasedEJBClientContextSelector(
                  ejbClientConfiguration);
  
  EJBClientContext.setSelector(selector);
  
  final Context context = new InitialContext(this.properties);
  final String ejbConnectionString = ejbConnectionInformation.getEJBConnectionString();
  final T ejbInterface = (T) context.lookup(ejbConnectionString);
  
  ejbConnection = new EJBConnection&lt;T&gt;(context, ejbInterface);
  ...
  </code></pre>
  
  <p>The ejb properties are as follows:</p>
  
  <pre><code>remote.connections = default
  remote.connection.default.host = localhost
  remote.connection.default.port = 4447
  remote.connection.default.username = &lt;username&gt;
  remote.connection.default.password = &lt;plain text password&gt;
  remote.connectionprovider.create.options.org.xnio.Options.SSL_ENABLED = false
  java.naming.factory.url.pkgs = org.jboss.ejb.client.naming
  </code></pre>
  
  <p>I've also tried various combinations of:</p>
  
  <pre><code>#remote.connection.default.protocol=http-remoting
  #jboss.naming.client.connect.options.org.xnio.Options.SASL_DISALLOWED_MECHANISMS=JBOSS-LOCAL-USER
  #remote.connection.connect.options.org.xnio.Options.SASL_POLICY_NOPLAINTEXT=false
  #remote.connection.connect.options.org.xnio.Options.SASL_POLICY_NOANONYMOUS=false
  #jboss.naming.client.connect.options.org.xnio.Options.SASL_POLICY_NOANONYMOUS=true
  #jboss.naming.client.connect.options.org.xnio.Options.SASL_DISALLOWED_MECHANISMS=JBOSS-LOCAL-USER
  #jboss.naming.client.connect.options.org.xnio.Options.SASL_POLICY_NOPLAINTEXT=false
  </code></pre>
  
  <p>After turning on JBoss logging I see it fails because the password is incorrect, namely:</p>
  
  <pre><code>TRACE [org.jboss.security] (EJB default - 2) PBOX000236: Begin initialize method
  DEBUG [org.jboss.security] (EJB default - 2) PBOX000281: Password hashing activated, algorithm: SHA-256, encoding: hex, charset: null, callback: null, storeCallBack: null
  TRACE [org.jboss.security] (EJB default - 2) PBOX000262: Module options [dsJndiName: java:jboss/datasources/MySQLDS, principalsQuery: SELECT password FROM xxx.User WHERE name=?, rolesQuery: SELECT r.name, 'Roles' FROM xxx.Role r JOIN xxx.User_Roles ur ON r.id=ur.role_id JOIN xxx.User u ON ur.user_id=u.id WHERE u.name=?, suspendResume: true]
  TRACE [org.jboss.security] (EJB default - 2) PBOX000240: Begin login method
  TRACE [org.jboss.security] (EJB default - 2) PBOX000263: Executing query SELECT password FROM xxx.User WHERE name=? with username &lt;username&gt;
  DEBUG [org.jboss.security] (EJB default - 2) PBOX000283: Bad password for username &lt;username&gt;
  TRACE [org.jboss.security] (EJB default - 2) PBOX000244: Begin abort method
  DEBUG [org.jboss.security] (EJB default - 2) PBOX000206: Login failure: javax.security.auth.login.FailedLoginException: PBOX000070: Password invalid/Password required
  at org.jboss.security.auth.spi.UsernamePasswordLoginModule.login(UsernamePasswordLoginModule.java:286) [picketbox-4.1.1.Final-redhat-1.jar:4.1.1.Final-redhat-1]
  </code></pre>
  
  <p>I should mention that the same exact code properly connected to the EJB before I added the JBoss login module and the security annotations on the EJB.</p>
  
  <p>It should also be noted that if I change the username to one that is not stored in the database I get a different error, so this proves that it is getting to the database, but that the problem really is one where the password is not correctly matched somehow, even though it perfectly matches the 'hashed' version in the database. I've also tried adding the 'hashed' version to the ejb properties without success.</p>
  
  <pre><code>DEBUG [org.jboss.security] (EJB default - 1) PBOX000206: Login failure: javax.security.auth.login.FailedLoginException: PBOX000062: No matching username found found in principals
  </code></pre>
  
  <p>I've also tried upping the versions of jboss-remote-naming from 2.0.3.Final to 2.0.4.Final, xnio-nio from 3.3.0.Final to 3.3.2.Final, and jboss-ejb-client from 1.0.28.Final to 1.0.31.Final, but I get the same result, "Password invalid/password required".</p>
  
  <p>I'll be very happy for any ideas because I've tried just about everything the Internet has to say on the subject.</p>