Using #RunAs between a servlet and an EJB - authentication

Question

I have the following servlet.
#DeclareRoles("remote-guest")
#RunAs("remote-guest")
public class GuestServlet extends HttpServlet {
#EJB
private Test test;
#Override
protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
test.guest();
}
}
The servlet is mapped such that only users with role guest can call it.
<servlet>
<servlet-name>guest-servlet</servlet-name>
<servlet-class>test.web.GuestServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>guest-servlet</servlet-name>
<url-pattern>/guest</url-pattern>
</servlet-mapping>
<security-role>
<role-name>guest</role-name>
</security-role>
<security-constraint>
<web-resource-collection>
<web-resource-name>guest-resources</web-resource-name>
<url-pattern>/guest</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>guest</role-name>
</auth-constraint>
</security-constraint>
The Test EJB is implemented by the following TestBean class.
#Stateless
#DeclareRoles("remote-guest")
public class TestBean implements Test {
#RolesAllowed("remote-guest")
public void guest() {
System.out.println("TestBean.guest()");
}
}
Problem: when I call the GuestServlet using a user that is mapped only to the guest role, the EJB throws an javax.ejb.EJBAccessException despite of the presence of the #RunAs annotation on the servlet. Should I also map the user to the remote-guest role? If the user has to be mapped both to guest and remote-guest, what's the real purpose of #RunAs?

Answer 1

Yes, a user needs to be mapped to the role. Although it might be a different user from the one that has the "guest" role. As stated in the EJB 3.1 specification 17.3.4.1:
Because the Bean Provider and Application Assembler do not, in
general, know the security environment of the operational
environment, the run-as identity is designated by a logical role-name,
which corresponds to one of the security roles defined by the Bean
Provider or Application Assembler in the metadata annotations or
deployment descriptor.
The Deployer then assigns a security principal defined in the
operational environment to be used as the principal for the run-as
identity. The security principal assigned by the Deployer should be a
principal that has been assigned to the security role specified by
RunAs annotation or by the role-name element of the run-as deployment
descriptor element.
And oracle jee6 tutorial:
http://docs.oracle.com/cd/E19226-01/820-7627/bnbyr/index.html
The role of #RunAs is to allow communication between 2 containers with different sets of roles and users (as in the link above) or to provide security identity for components that don't have security contexts: for example a Message Driven Bean needs to call another bean that requires the caller to have some roles.