@RolesAllowed 在jboss6.0中不起作用

freeworklife 2010-10-22 09:00:59

package com.jaas;
public interface SecurityAccess {
public String AdminUserMethod();
public String DepartmentUserMethod();
public String AnonymousUserMethod();
}

package com.jaas;

import javax.annotation.security.PermitAll;
import javax.annotation.security.RolesAllowed;
import javax.ejb.Remote;
import javax.ejb.Stateless;

@Stateless
@Remote ({SecurityAccess.class})

public class SecurityAccessBean implements SecurityAccess{

@RolesAllowed({"AdminUser","DepartmentUser"})
public String AdminUserMethod() {
return "管理员角色访问AdminUserMethod()方法";
}
@RolesAllowed({"DepartmentUser"})
public String DepartmentUserMethod() {
return "事业部门角色的用户访问DepartmentUserMethod()方法";
}
@PermitAll
public String AnonymousUserMethod() {
return "任何角色的用户都可以访问AnonymousUserMethod()方法";
}
}
//jboss.xml
<?xml version="1.0" encoding="UTF-8"?>
<jboss>
<security-domain>other</security-domain>
<unauthenticated-principal>AnonymousUser</unauthenticated-principal>
</jboss>
//roles.properties
lisi=AdminUser,DepartmentUser
wangwu=DepartmentUser

//users.properties
lisi=123456
wangwu=123456
//jsp页面
<%@ page contentType="text/html; charset=GBK"%>
<%@ page import="com.jaas.SecurityAccess,
javax.naming.*,
org.jboss.security.*,
java.util.*"%>
<%
Properties props = new Properties();
props.setProperty("java.naming.factory.initial",
"org.jnp.interfaces.NamingContextFactory");
props.setProperty("java.naming.provider.url", "localhost:1099");
props.setProperty("java.naming.factory.url.pkgs", "org.jboss.naming");
InitialContext ctx = new InitialContext(props);
String user = request.getParameter("user");
String pwd = request.getParameter("pwd");
if (user!=null && !"".equals(user.trim())){
SecurityAssociation.setPrincipal(new SimplePrincipal(user.trim()));
SecurityAssociation.setCredential(pwd.trim().toCharArray());
}
SecurityAccess securityaccess = (SecurityAccess)
ctx.lookup("SecurityAccessBean/remote");
try{
out.println("调用结果:"+
securityaccess.AdminUserMethod()+ " ");
}catch(Exception e){
out.println(user+ "没有权限访问AdminUserMethod方法 ");
}
out.println("========================== ");
try{
out.println("调用结果:"+
securityaccess.DepartmentUserMethod()+ " ");
}catch(Exception e){
out.println(user+ "没有权限访问DepartmentUserMethod方法 ");
}
out.println("========================== ");
try{
out.println("调用结果:"+
securityaccess.AnonymousUserMethod()+ " ");
}catch(Exception e){
out.println(user+ "没有权限访问AnonymousUserMethod方法 ");
}
SecurityAssociation.clear();
%>

为什么@RolesAllowed({"AdminUser","DepartmentUser"}) 不起作用？

...全文