[jboss-user] [JBoss Seam] - Re: Security flaw in Seam docs, section 12.3.2

[shane.bryzak@jboss.com]

You have direct access to the subject via Identity.getSubject(), if you want to remove all the roles simply iterate through the principals in the subject until you find the "Roles" group.  Here's an example:


  |       for ( Group sg : Identity.instance().getSubject().getPrincipals(Group.class) )      
  |       {
  |          if ( Identity.ROLES_GROUP.equals( sg.getName() ) )
  |          {
  |             Identity.instance().getSubject().getPrincipals().remove(sg);
  |             break;
  |          }
  |       }
  | 

View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4034604#4034604

Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4034604