javax.ejb。EJBAccessException使用CustomAuthMechanism登录后用户无效,但我有权访问page.xhtml

环境

• Jboss 7.2
• Java 11

在我通过CustomAuthenticationMechanism登录后,我试图用@RolesAllowed调用CompanyService.findFirst()方法,但EJBContainer似乎不知道我的权限。 我加载了login-private.html页面,该页面显示我具有角色AF_ADMIN,但当我调用findFirst()时,我得到了javax.ejb。EJBAccessException:WFLYSEC0027:无效用户

我应该授予或告知EJB有关身份验证权限的信息吗?

我遗漏了什么吗?

jboss-web.xml

<?xml version="1.0" encoding="UTF-8"?>
<jboss-app>
    <security-domain>jaspitest</security-domain>
</jboss-app>

公司服务

@Stateless
@RolesAllowed("**")
public class CompanyService extends BusinessService<Company> implements CompanyServiceable {

    public CompanyService() {
        super(Company.class);
    }

    @Override
    public List<Company> findFirst() throws AppException {
        ...
    }
    ...

自定义身份验证机制

@AutoApplySession
@LoginToContinue
@ApplicationScoped
public class CustomAuthenticationMechanism implements HttpAuthenticationMechanism {

    @Inject
    private IdentityStoreHandler idStoreHandler;

    //@Override
    public AuthenticationStatus validateRequest(HttpServletRequest request, HttpServletResponse response, HttpMessageContext httpMessageContext) throws AuthenticationException {
        final String ticket = request.getParameter("ticket");

        if (ticket != null) {

            CredentialValidationResult result = idStoreHandler.validate(new UsernamePasswordCredential(ticket, Arrays.toString("LOGIN_PASSWORD")));

            if (result.getStatus() == VALID) {
                return httpMessageContext.notifyContainerAboutLogin(result);
            } else {
                return httpMessageContext.responseUnauthorized();
            }
        }

        return httpMessageContext.doNothing();
    }

}

登录私人.xhtml 显示我有AF_ADMIN

    ...
    <h1>Public</h1>
    <div class="alert alert-danger" role="alert">
        #{myBean.initBean()}
        <h:outputText value="inRole(AF_ADMIN): #{request.isUserInRole('AF_ADMIN')}"/><br/>
        <h:outputText value="requestURL: #{request.requestURL}"/><br/>
        <h:outputText value="headerNames: #{request.headerNames}"/><br/>
        #{requestScope['javax.servlet.error.status_code']}
        #{requestScope['javax.servlet.error.message']}<br/>
        #{messages['error.inesperat']}
    </div>
    ...