title: wildfly 10 database login module
body: <p>I am trying to get the database login module to work with my project in the Wildfly 10 container.</p>
  
  <p>I have followed this tutorial: <a href="https://www.examsmyantra.com/article/119/javaee/form-based-login-authentication-in-javaee7-with-wildfly-and-mysql" rel="nofollow noreferrer">https://www.examsmyantra.com/article/119/javaee/form-based-login-authentication-in-javaee7-with-wildfly-and-mysql</a></p>
  
  <p>And it's kinda working.</p>
  
  <p>I have an EAR project with an EJB module and a Web module (war). The war is not containing the EJB it's accessing it using the remote lookup.</p>
  
  <p>So when I acces an restricted part of the WAR I am correctly send to the login form (<code>j_security_check</code>).</p>
  
  <p>When I login, I can see the restricted part.<br>
  Even when I log in a servet which user I am and check if I have a specif role it works.
  Servlet code:</p>
  
  <pre><code>final String username = request.getUserPrincipal().getName();
  logger.info("Current username acourding to the WEB: {}", request.getUserPrincipal().getName());
  logger.info("User has Role user acourding to the WEB: {}", request.isUserInRole("user"));
  logger.info("User has Role admin acourding to the WEB: {}", request.isUserInRole("admin"));
  </code></pre>
  
  <p>Log:</p>
  
  <pre><code>INFO  [com.example.web.servlet.DatasetServlet] (default task-5) Current username acourding to the WEB: user
  INFO  [com.example.web.servlet.DatasetServlet] (default task-5) User has Role user acourding to the WEB: true
  INFO  [com.example.web.servlet.DatasetServlet] (default task-5) User has Role admin acourding to the WEB: true
  INFO [com.example.business.remote.DatasetEJB] (default task-5) Get active dataset for the user: user
  </code></pre>
  
  <p>but when I enter the EJB bean like this:</p>
  
  <pre><code>final String dataset = remote.getActiveDataset(); // this is still the servlet (WAR)
  </code></pre>
  
  <p>EJB:</p>
  
  <pre><code>final String username = this.ejbContext.getCallerPrincipal().getName();
  
  logger.info("Get active dataset for the user: " + username);
  logger.info("User has role 'user' {}", this.ejbContext.isCallerInRole("user"));
  logger.info("User has role 'admin' {}", this.ejbContext.isCallerInRole("admin"));
  </code></pre>
  
  <p>I get:</p>
  
  <pre><code>Exception caught: javax.naming.NameNotFoundException: policyRegistration -- service jboss.naming.context.java.policyRegistration
  
  PBOX00326: isCallerInRole processing failed: java.lang.IllegalStateException: PBOX00071: Failed to instantiate interface org.jboss.security.authorization.AuthorizationModule class
  
  Exception:=PBOX00071: Failed to instantiate interface org.jboss.security.authorization.AuthorizationModule 
  </code></pre>
  
  <p>The Full log shows this:</p>
  
  <pre><code>TRACE [org.jboss.security] (default task-5) PBOX00354: Setting security roles ThreadLocal: {}
  INFO  [com.example.business.remote.DatasetEJB] (default task-5) Get active dataset for the user: user
  TRACE [org.jboss.security] (default task-5) PBOX00354: Setting security roles ThreadLocal: {}
  2016-09-16 22:53:52,724 DEBUG [org.jboss.security] (default task-5) PBOX00293: Exception caught: javax.naming.NameNotFoundException: policyRegistration -- service jboss.naming.context.java.policyRegistration
      at org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:106)
      at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:207)
      at org.jboss.as.naming.InitialContext$DefaultInitialContext.lookup(InitialContext.java:235)
      at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:193)
      at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:189)
      at javax.naming.InitialContext.lookup(InitialContext.java:417)
      at javax.naming.InitialContext.lookup(InitialContext.java:417)
      at org.jboss.security.plugins.javaee.EJBAuthorizationHelper.getPolicyRegistrationFromJNDI(EJBAuthorizationHelper.java:353)
      at org.jboss.security.plugins.javaee.EJBAuthorizationHelper.isCallerInRole(EJBAuthorizationHelper.java:170)
      at org.jboss.as.security.service.SimpleSecurityManager.isCallerInRole(SimpleSecurityManager.java:229)
      at org.jboss.as.ejb3.component.EJBComponent.isCallerInRole(EJBComponent.java:400)
      at org.jboss.as.ejb3.context.EJBContextImpl.isCallerInRole(EJBContextImpl.java:115)
      at com.example.business.remote.DatasetEJB.getActiveDataset(DatasetEJB.java:225)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:497)
      ...
      at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
      at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
      at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
      at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
      at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
      at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
      at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
      at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
      at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
      at java.lang.Thread.run(Thread.java:745)
  
  2016-09-16 22:53:52,727 DEBUG [org.jboss.security] (default task-5) PBOX00282: Failed to instantiate class Database: java.lang.ClassNotFoundException: Database from [Module "deployment.ear.ear.business-ejb-assignment-SNAPSHOT.jar:main" from Service Module Loader]
      at org.jboss.modules.ModuleClassLoader.findClass(ModuleClassLoader.java:198)
      at org.jboss.modules.ConcurrentClassLoader.performLoadClassUnchecked(ConcurrentClassLoader.java:363)
      at org.jboss.modules.ConcurrentClassLoader.performLoadClass(ConcurrentClassLoader.java:351)
      at org.jboss.modules.ConcurrentClassLoader.loadClass(ConcurrentClassLoader.java:93)
      at org.jboss.security.plugins.authorization.JBossAuthorizationContext.instantiateModule(JBossAuthorizationContext.java:326)
      at org.jboss.security.plugins.authorization.JBossAuthorizationContext.initializeModules(JBossAuthorizationContext.java:205)
      at org.jboss.security.plugins.authorization.JBossAuthorizationContext.authorize(JBossAuthorizationContext.java:141)
      at org.jboss.security.plugins.JBossAuthorizationManager.internalAuthorization(JBossAuthorizationManager.java:438)
      at org.jboss.security.plugins.JBossAuthorizationManager.authorize(JBossAuthorizationManager.java:115)
      at org.jboss.security.plugins.javaee.EJBAuthorizationHelper.isCallerInRole(EJBAuthorizationHelper.java:187)
      at org.jboss.as.security.service.SimpleSecurityManager.isCallerInRole(SimpleSecurityManager.java:229)
      at org.jboss.as.ejb3.component.EJBComponent.isCallerInRole(EJBComponent.java:400)
      at org.jboss.as.ejb3.context.EJBContextImpl.isCallerInRole(EJBContextImpl.java:115)
      at com.example.business.remote.DatasetEJB.getActiveDataset(DatasetEJB.java:225)
      ...
      at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
      at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
      at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
      at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
      at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
      at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
      at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
      at java.lang.Thread.run(Thread.java:745)
  
  2016-09-16 22:53:52,728 DEBUG [org.jboss.security] (default task-5) PBOX00326: isCallerInRole processing failed: java.lang.IllegalStateException: PBOX00071: Failed to instantiate interface org.jboss.security.authorization.AuthorizationModule class
      at org.jboss.security.plugins.authorization.JBossAuthorizationContext.instantiateModule(JBossAuthorizationContext.java:336)
      at org.jboss.security.plugins.authorization.JBossAuthorizationContext.initializeModules(JBossAuthorizationContext.java:205)
      at org.jboss.security.plugins.authorization.JBossAuthorizationContext.authorize(JBossAuthorizationContext.java:141)
      at org.jboss.security.plugins.JBossAuthorizationManager.internalAuthorization(JBossAuthorizationManager.java:438)
      at org.jboss.security.plugins.JBossAuthorizationManager.authorize(JBossAuthorizationManager.java:115)
      at org.jboss.security.plugins.javaee.EJBAuthorizationHelper.isCallerInRole(EJBAuthorizationHelper.java:187)
      at org.jboss.as.security.service.SimpleSecurityManager.isCallerInRole(SimpleSecurityManager.java:229)
      at org.jboss.as.ejb3.component.EJBComponent.isCallerInRole(EJBComponent.java:400)
      at org.jboss.as.ejb3.context.EJBContextImpl.isCallerInRole(EJBContextImpl.java:115)
      at com.example.business.remote.DatasetEJB.getActiveDataset(DatasetEJB.java:225)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:497)
  ... 
      at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
      at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
      at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
      at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
      at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
      at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
      at java.lang.Thread.run(Thread.java:745)
  
  TRACE [org.jboss.security.audit] (default task-5) [Error]Resource:=[org.jboss.security.authorization.resources.EJBResource:contextMap={roleRefPermissionCheck=true, roleName=user, policyRegistration=null}:method=null:ejbMethodInterface=null:ejbName=DatasetEJB:ejbPrincipal=org.wildfly.extension.undertow.security.AccountImpl$AccountPrincipal@36ebcb:MethodRoles=null:securityRoleReferences=[]:callerSubject=Subject:
      Principal: user
      Principal: Roles(members:user,admin)
      Principal: CallerPrincipal(members:user)
  :callerRunAs=null:callerRunAs=null:ejbRestrictionEnforcement=false:ejbVersion=2.0];Action=authorization;roleRefPermissionCheck=true;Exception:=PBOX00071: Failed to instantiate interface org.jboss.security.authorization.AuthorizationModule class;roleName=user;Source=org.jboss.security.plugins.javaee.EJBAuthorizationHelper;policyRegistration=null;
  TRACE [org.jboss.security] (default task-5) PBOX00354: Setting security roles ThreadLocal: {}
  INFO  [com.example.business.remote.DatasetEJB] (default task-5) User has role 'user' false
  </code></pre>
  
  <p>And I don't understand why.<br>
  My guess is that the security domain is correctly configured, because otherwise the war would not be working. So it must have something to do with a missing config in the EJB.</p>
  
  <p>Some additional info:</p>
  
  <p>In the standalone.xml I have these settings:</p>
  
  <pre><code>&lt;subsystem xmlns="urn:jboss:domain:ejb3:4.0"&gt;
     ...
      &lt;default-security-domain value="jdbcejbrick"/&gt;
      &lt;default-missing-method-permissions-deny-access value="false"/&gt;
      &lt;log-system-exceptions value="true"/&gt;
  &lt;/subsystem&gt;
  </code></pre>
  
  <p>And</p>
  
  <pre><code>&lt;security-domain name="jdbcejbrick" cache-type="default"&gt;
      &lt;authentication&gt;
          &lt;login-module code="Database" flag="required"&gt;
              &lt;module-option name="dsJndiName" value="java:jboss/datasources/poc-ejb-alg"/&gt;
              &lt;module-option name="rolesQuery" value="SELECT a.NAME, 'Roles' FROM AUTHORIZATIONS a LEFT JOIN AUTHORIZATION_USER au on au.AUTHORIZATION_ID = a.ID LEFT JOIN AUTHORIZATION_USER_GROUP aug on aug.AUTHORIZATION_ID = a.ID LEFT JOIN USER_GROUPS ug on aug.GROUP_ID  = ug.ID LEFT JOIN USER_USER_GROUP uug on ug.ID = uug.GROUP_ID LEFT JOIN USERS u on (au.USER_ID = u.ID) or (uug.USER_ID = u.ID) WHERE u.NAME=?"/&gt;
              &lt;module-option name="principalsQuery" value="select PASSWORD from USERS where NAME=?"/&gt;
          &lt;/login-module&gt;
      &lt;/authentication&gt;
      &lt;authorization&gt;
          &lt;policy-module code="Database" flag="required"&gt;
              &lt;module-option name="dsJndiName" value="java:jboss/datasources/poc-ejb-alg"/&gt;
              &lt;module-option name="rolesQuery" value="SELECT a.NAME, 'Roles' FROM AUTHORIZATIONS a LEFT JOIN AUTHORIZATION_USER au on au.AUTHORIZATION_ID = a.ID LEFT JOIN AUTHORIZATION_USER_GROUP aug on aug.AUTHORIZATION_ID = a.ID LEFT JOIN USER_GROUPS ug on aug.GROUP_ID  = ug.ID LEFT JOIN USER_USER_GROUP uug on ug.ID = uug.GROUP_ID LEFT JOIN USERS u on (au.USER_ID = u.ID) or (uug.USER_ID = u.ID) WHERE u.NAME=?"/&gt;
              &lt;module-option name="principalsQuery" value="select PASSWORD from USERS where NAME=?"/&gt;
          &lt;/policy-module&gt;
      &lt;/authorization&gt;
  &lt;/security-domain&gt;
  </code></pre>
  
  <p>I have a jboss-ejb3.xml in src/main/resources/META-INF of the EJB</p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;
  
  &lt;jboss:ejb-jar xmlns:jboss="http://www.jboss.com/xml/ns/javaee" xmlns:sec="urn:security" xmlns="http://java.sun.com/xml/ns/javaee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.jboss.com/xml/ns/javaee http://www.jboss.org/j2ee/schema/jboss-ejb3-2_0.xsd
        http://java.sun.com/xml/ns/javaee http://www.jboss.org/j2ee/schema/jboss-ejb3-spec-2_0.xsd
        urn:security urn:security"
    version="3.1" impl-version="2.0"&gt;
  
    &lt;assembly-descriptor&gt;
  
      &lt;sec:security&gt;
        &lt;ejb-name&gt;*&lt;/ejb-name&gt;
        &lt;sec:security-domain&gt;jdbcejbrick&lt;/sec:security-domain&gt;
      &lt;/sec:security&gt;
    &lt;/assembly-descriptor&gt;
  
  &lt;/jboss:ejb-jar&gt;
  </code></pre>
  
  <p>I have an ejb-jar.xml in src/main/resources/META-INF of the EJB</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;ejb-jar&gt;
    &lt;assembly-descriptor&gt;
  
      &lt;security-role&gt;
        &lt;role-name&gt;admin&lt;/role-name&gt;
      &lt;/security-role&gt;
  
      &lt;security-role&gt;
        &lt;role-name&gt;user&lt;/role-name&gt;
      &lt;/security-role&gt;
    &lt;/assembly-descriptor&gt;
  &lt;/ejb-jar&gt;
  </code></pre>
  
  <p>I am feeling that I am real close, so please help.</p>