title: Jboss 5.1.0 EJB Security (unauthenticated principal via JNDI)
body: <p>How do you secure remote EJBs from unauthenticated principal in JBoss-5.1.0.GA application server? After configuring my ejb security I can still access the remote EJBs with a JNDI lookup without principal and credentials passed in? This is a security risk. Essentially I want to disable all unauthenticated JNDI lookup on remote EJBs.</p>
  
  <p><strong>Here is my <em>server/conf/login-config.xml</em> configruation:</strong></p>
  
  <pre><code>       &lt;application-policy name="&lt;my security domain name&gt;"&gt;
      &lt;authentication&gt;
          &lt;login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag="required"&gt;         
              &lt;module-option name="dsJndiName"&gt;**java:jdbc/&lt;my datasource name&gt;**&lt;/module-option&gt;
              &lt;module-option name="principalsQuery"&gt;&lt;my users query&gt;&lt;/module-option&gt;
              &lt;module-option name="rolesQuery"&gt;&lt;my roles query&gt;&lt;/module-option&gt;
              &lt;module-option name="debug"&gt;true&lt;/module-option&gt;
          &lt;/login-module&gt;
      &lt;/authentication&gt;
    &lt;/application-policy&gt;
  </code></pre>
  
  <p><strong>Here is my <em>jboss.xml</em> configruation in my ejb jar:</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;!DOCTYPE jboss PUBLIC
  "-//JBoss//DTD JBOSS 5.0//EN"
  "http://www.jboss.org/j2ee/dtd/jboss_5_0.dtd"&gt;
    &lt;jboss&gt;
   &lt;security-domain&gt;&lt;my security domain name from login-config&gt;&lt;/security-domain&gt;
    &lt;/jboss&gt;
  </code></pre>
  
  <p><strong>Here is how i do a a JNDI lookup to access my beans as a client</strong>
  <em>Note the principal and credentials are not being passed in to the context</em> </p>
  
  <pre><code>    Hashtable&lt;String, String&gt; props = new Hashtable&lt;String, String&gt;();
       props.put(Context.INITIAL_CONTEXT_FACTORY,"org.jnp.interfaces.NamingContextFactory");      
      props.put(Context.URL_PKG_PREFIXES,"org.jboss.naming:org.jnp.interfaces");      
  
      props.put(Context.PROVIDER_URL,"jnp://localhost:1099"); 
      //props.put(Context.SECURITY_PRINCIPAL,""); 
      //props.put(Context.SECURITY_CREDENTIALS,"");   
      ctx = new InitialContext(props);
      ctx.lookup("&lt;earname&gt;/&lt;ejb interface definition&gt;/remote"&gt;
  </code></pre>
  
  <p><strong>What is the issue?</strong>
  When no/wrong principal/credentials are passed the user is authenticated as an anonymous principal and has full access to the remote EJBs via JNDI</p>
  
  <p><strong>What I tried already to fix the issue:</strong></p>
  
  <ul>
  <li><p>i deleted the following line from all login modules in my <em>server/conf/login-config.xml</em> but it had no effect</p>
  
  <pre><code>&lt;module-option name="unauthenticatedIdentity"&gt;anonymous&lt;/module-option&gt;
  </code></pre></li>
  <li><p>i deleted following line from <em>server/conf/jboss-service.xml</em> thinking it will resolve the issue, but it had no effect</p>
  
  <pre><code> &lt;attribute name="DefaultUnauthenticatedPrincipal"&gt;anonymous&lt;/attribute&gt;
  </code></pre></li>
  <li><p>i deleted application policy "client-login" from login-config.xml that is in there by default since i am using a DatabaseLoginModule </p></li>
  <li><p>My <strong>jboss-ejb-policy</strong> and <strong>jboss-web-policy</strong> in <em>server/depoly/security/security-policies-jboss-beans.xml</em> are extending my DatabaseLoginModule policy in login-config.xml</p></li>
  <li><p>I have no security related annotations in my ejb classes/interfaces  </p></li>
  </ul>
  
  <p><strong>Other things to note</strong></p>
  
  <ul>
  <li><p>I tested this scenario in Jboss-as-7.1.1.final and i get <strong>EjbAccessException: invalid User</strong> which is correct (you add this to the jboss-ejb3.xml it will secure all EJBs via the security domain)</p>
  
  <pre><code>&lt;assembly-descriptor&gt;
     &lt;s:security&gt;
       &lt;ejb-name&gt;*&lt;/ejb-name&gt;
       &lt;s:security-domain&gt;&lt;security domain name here&gt;&lt;/s:security-domain&gt;
     &lt;/s:security&gt;
   &lt;/assembly-descriptor&gt;
  </code></pre></li>
  <li><p>the issue here is NOT authorization but authentications all ejb security annotations do not help</p></li>
  <li><p>what i want to do is prevent the anonymous principal completely from making JNDI call </p></li>
  <li><p>I have enabled TRACE logging on org.jboss.security and i can see that when ever i call the JNDI i get the following hit in the logs</p>
  
  <pre><code>Principal: anonymous:callerRunAs=null:callerRunAs=null:ejbRestrictionEnforcement=false:ejbVersion=null];    policyRegistration=org.jboss.security.plugins.JBossPolicyRegistration@1f51a2f;
  </code></pre></li>
  <li><p>I have verified all my configurations work and the DatabaseLoginModule works when i use the programmatic login through WebAuthetication </p></li>
  <li><p>Even when passing the initial context a valid principal/credential from database the anonymous principal is used indicating that the principal/credential is not even processed by the context </p></li>
  <li><p>I can probably secure my EJBs through @RolesAllowed @DeclareRoles ... but like i mentioned this would be an authorization concern not authentication and also if I have many roles and EJBs this would not be good as far as maintainability </p></li>
  </ul>
  
  <p>How can I disable/prevent unauthenticated anonymous JNDI lookup for the entire application like it automatically does in JBoss 7.1.1? I know I can upgrade my application server as one solution but I don't have the option to do so.  This should be possible and easy to do in Jboss 5.1.0. but i have looked for the answer everywhere and I can't find it? Thanks for your help.</p>