[jboss-cvs] JBossAS SVN: r78378 - trunk/tomcat/src/main/org/jboss/web/tomcat/security.

[jboss-cvs-commits at lists.jboss.org]

Author: anil.saldhana at jboss.com
Date: 2008-09-10 17:00:18 -0400 (Wed, 10 Sep 2008)
New Revision: 78378

Modified:
   trunk/tomcat/src/main/org/jboss/web/tomcat/security/SecurityContextEstablishmentValve.java
Log:
JBAS-5946: SecurityContextEstablishmentValve needs to handle the current security context correctly

Modified: trunk/tomcat/src/main/org/jboss/web/tomcat/security/SecurityContextEstablishmentValve.java
===================================================================
--- trunk/tomcat/src/main/org/jboss/web/tomcat/security/SecurityContextEstablishmentValve.java	2008-09-10 20:25:06 UTC (rev 78377)
+++ trunk/tomcat/src/main/org/jboss/web/tomcat/security/SecurityContextEstablishmentValve.java	2008-09-10 21:00:18 UTC (rev 78378)
@@ -34,7 +34,6 @@
 import org.jboss.security.SecurityRolesAssociation;
 import org.jboss.security.SecurityUtil;
 
-//$Id$
 
 /**
  *  Establish the Security Context
@@ -45,16 +44,19 @@
 public class SecurityContextEstablishmentValve extends ValveBase
 {  
    private String configuredSecurityDomainName;
-   private String securityContextClassName;
-   private String defaultSecurityDomain;
+   private String securityContextClassName; 
    private ISecurityManagement securityManagement;
 
    public SecurityContextEstablishmentValve(String configuredSecurityDomain, 
          String defaultSecurityDomain, String fqnClass,
          ISecurityManagement securityManagement)
    {
-      this.configuredSecurityDomainName = configuredSecurityDomain;
-      this.defaultSecurityDomain = defaultSecurityDomain;
+      String securityDomain = defaultSecurityDomain;
+      
+      if(configuredSecurityDomain != null)
+        securityDomain  = configuredSecurityDomain; 
+      
+      this.configuredSecurityDomainName = SecurityUtil.unprefixSecurityDomain(securityDomain);  
       this.securityContextClassName = fqnClass;
       this.securityManagement = securityManagement;
    }
@@ -62,30 +64,24 @@
    @Override
    public void invoke(Request request, Response response)
    throws IOException, ServletException
-   { 
+   {
+      SecurityContext cachedContext = null;
+      
       boolean createdSecurityContext = false;
       //Set the security context if one is unavailable
       SecurityContext sc = SecurityAssociationActions.getSecurityContext();
+      if(sc != null && 
+            sc.getSecurityDomain().equals(configuredSecurityDomainName) == false)
+      {
+         cachedContext = sc;
+         SecurityContext newSC = createSecurityContext();
+         SecurityAssociationActions.setSecurityContext(newSC);
+         createdSecurityContext = true;
+      }
+      
       if(sc == null)
       {
-         String securityDomain = configuredSecurityDomainName;
-         if(securityDomain != null)
-            securityDomain = securityDomain.trim();
-         
-         if(securityDomain == null)
-            securityDomain = SecurityUtil.unprefixSecurityDomain(defaultSecurityDomain);
-         else
-            securityDomain = SecurityUtil.unprefixSecurityDomain(securityDomain);
-         try
-         {
-            sc = SecurityAssociationActions.createSecurityContext(securityDomain,
-                  this.securityContextClassName); 
-         }
-         catch (PrivilegedActionException e)
-         {
-            throw new RuntimeException(e);
-         } 
-         sc.setSecurityManagement(securityManagement);
+         sc = createSecurityContext();
          SecurityAssociationActions.setSecurityContext(sc);
          createdSecurityContext = true;
       }
@@ -102,6 +98,26 @@
          {
             SecurityAssociationActions.clearSecurityContext();
          }
+         if(cachedContext != null)
+            SecurityAssociationActions.setSecurityContext(cachedContext);
       }
    } 
+   
+   private SecurityContext createSecurityContext()
+   {
+      SecurityContext securityContext = null;
+      try
+      {
+         securityContext = 
+            SecurityAssociationActions.createSecurityContext(this.configuredSecurityDomainName,
+               this.securityContextClassName); 
+      }
+      catch (PrivilegedActionException e)
+      {
+         throw new RuntimeException(e);
+      } 
+      
+      securityContext.setSecurityManagement(securityManagement);
+      return securityContext; 
+   }
 }
\ No newline at end of file