@Context injection in Stateless EJB used by JAX-RS

Question

I have something like this setup below. This is a simplified version but I think it gets the basic idea across. I am using Jersey 2.16, Java 1.8, and Glassfish Open Source 4.1

public interface IReportService {
    String addNewReport(Report report);
}

@Path("reports")
public class ReportResource implements IReportService {
    /**
    * Service layer.
    */
    @EJB
    private transient ReportService service;

    @POST
    @Consumes({MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
    @Produces(MediaType.TEXT_PLAIN)
    @Override
    public String addNewReport(final Report report) {
       return service.addNewReport(report);
    }
}

@Stateless
@LocalBean
public class ReportService implements IReportService {

   @EJB
   private IReportPersistence reportPersistence;

   @Context
   SecurityContext secContext;

   public String addNewReport(final Report report) {
       report.setUserName(secContext.getUserPrincipal().getName());
       reportPersistence.persist(report);
    }
}

But when I deploy and try to hit the web-service I get a NullPointer exception from the security context. It just seems that the Context is not being injected at all. I checked and it's the secContext variable itself, not just the return from getUserPrincipal() that is null. There are no warning or exceptions in the Glassfish log besides my NullPointer (which results in a 500 error returned to the web client).

Answer 1

The problem is that you are using the SecurityContext in the wrong place. You have to use it inside your REST resource class.

You can try the following:

@POST
@Consumes({MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
@Produces(MediaType.TEXT_PLAIN)
@Override
public String addNewReport(final Report report, @Context SecurityContext sc) {
   report.setUserName(sC.getUserPrincipal().getName());
   return service.addNewReport(report);
}

For more details have a look at the Jersey Documentation - Chapter 16. Security.

Inside of EJBs you have to use the EJBContext (or the SessionContext).