[jboss-jira] [JBoss JIRA] Updated: (JBAS-3781) Stateful SB Instance Interceptor should not push SubjectContext if RunAsIdentity present
Anil Saldhana (JIRA)
jira-events at lists.jboss.org
Fri Mar 16 00:50:32 EDT 2007
[ http://jira.jboss.com/jira/browse/JBAS-3781?page=all ]
Anil Saldhana updated JBAS-3781:
--------------------------------
Fix Version/s: JBossAS-5.0.0.Beta2
(was: JBossAS-5.0.0.Beta3)
(was: JBossAS-4.0.5.SP1 )
(was: JBossAS-3.2.8.SP2)
Complexity: Medium (was: Low)
> Stateful SB Instance Interceptor should not push SubjectContext if RunAsIdentity present
> ----------------------------------------------------------------------------------------
>
> Key: JBAS-3781
> URL: http://jira.jboss.com/jira/browse/JBAS-3781
> Project: JBoss Application Server
> Issue Type: Bug
> Security Level: Public(Everyone can see)
> Components: EJB2
> Affects Versions: JBossAS-4.0.5.GA, JBossAS-5.0.0.Beta1, JBossAS-3.2.8.SP1
> Reporter: Anil Saldhana
> Assigned To: Anil Saldhana
> Fix For: JBossAS-5.0.0.Beta2, JBossAS-4.2.0.GA
>
>
> The following Subject Context push (with null Subject) to establish client security context should not be performed if the user has configured a RunAsIdentity in the caller bean.
> /* The security context must be established before the cache
> lookup because the activation of a session should have the caller's
> security context as ejbActivate is allowed to call other secured
> resources. Since the pm makes the ejbActivate call, we need to
> set the caller's security context. The only reason this shows up for
> stateful session is that we moved the SecurityInterceptor to after
> the instance interceptor to allow security exceptions to result in
> invalidation of the session. This may be too literal an interpretation
> of the ejb spec requirement that runtime exceptions should invalidate
> the session.
> */
> SecurityActions.pushSubjectContext(mi.getPrincipal(), mi.getCredential(), null);
> The resolution is:
> if(SecurityActions.peekRunAsIdentity() == null)
> SecurityActions.pushSubjectContext(mi.getPrincipal(), mi.getCredential(), null);
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
More information about the jboss-jira
mailing list