HTTP BasicAuthentication doesn't immediately realize, when a user's role changes. What can I do about it? - jboss

Question

I have deployed a Webservice on JBossAS 5.1 GA. To use HTTP Basic Authentication, The SBC class is annotated the following way:
#Stateless
#SecurityDomain(value = "MyWSSecurity")
#RolesAllowed(value = "WebserviceUser")
#WebContext(contextRoot="/MyWS", urlPattern="/*", authMethod="BASIC", transportGuarantee="NONE", secureWSDLAccess=true)
#WebService(endpointInterface = "MyWS")
public class MyWSImpl implements MyWS {
public String doSomething() {
return "something";
}
}
Generally this works fine. But the following szenario bothers me.
User who is in role WebserviceUser calls the service.
The role Webservice is now taken AWAY from the user.
Problem: He still can call the service.
I guess this happens, because user credentials and roles are stored in HttpSession object on the server side. After server restart the user is denied from calling the service.
What can I do about that?
Regards
EDIT: The problem does not apply only to JBOSSWS EJB3 webservices, but to anything using JAAS authentication.

Answer 1

Found 2 solutions that are appropriate for me.
Solution 1) Change the Default timeout for the JAAS Cache
You can do this by editing $JBOSS_HOME/server/default/conf/jboss-service.conf. Locate the part of the file, where JaasSecurityManager MBean is configured and change the attribute DefaultCacheTimeout to an acceptable small value (60 seconds is fine for me). If you want to disable caching of security credentials entirely, set the value to 0.
<!-- JAAS security manager and realm mapping -->
<mbean code="org.jboss.security.plugins.JaasSecurityManagerService"
<!--
skipped some configuration
-->
<!-- DefaultCacheTimeout: Specifies the default timed cache policy timeout
in seconds.
If you want to disable caching of security credentials, set this to 0 to
force authentication to occur every time. This has no affect if the
AuthenticationCacheJndiName has been changed from the default value.
-->
<attribute name="DefaultCacheTimeout">60</attribute>
<!-- DefaultCacheResolution: Specifies the default timed cache policy
resolution in seconds. This controls the interval at which the cache
current timestamp is updated and should be less than the DefaultCacheTimeout
in order for the timeout to be meaningful. This has no affect if the
AuthenticationCacheJndiName has been changed from the default value.
-->
<attribute name="DefaultCacheResolution">30</attribute>
<!--
skipped some configuration
-->
</mbean>
Solution 2: Call method flushAuthenticationCache("MyWSSecurity") on JaasSecurityManager MBean, whenever a user's role changes.
Regards