[Design of Security on JBoss] - JBoss ACL schema
by sguilhen@redhat.com
We've been talking about an ACL configuration file that would specify the ACL policies for resources. These ACLs would be installed upon deployment and would be available through the ACLProvider that has been configured for the security domain.
An example of the configuration file (jboss-acl-policy.xml?):
| <jboss-acl xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
| xsi:schemaLocation="urn:jboss:jboss-acl-config:1.0"
| xmlns="urn:jboss:jboss-acl-config:1.0"
| xmlns:jbxb="urn:jboss:jboss-acl-config:1.0">
|
| <acl-definition resource="com.mycompany.Resource:XYZ">
| <entry>
| <identity-name>Administrator</identity-name>
| <permissions>CREATE,READ,UPDATE,DELETE</permissions>
| </entry>
| <entry>
| <identity-name>Guest</identity-name>
| <permissions>READ</permissions>
| </entry>
| </acl-definition>
|
| <!-- An extends attribute allows an ACL to inherit all the entries from its parent ACL -->
| <acl-definition resource="com.mycompany.Resource:ABC" extends="com.mycompany.Resource:XYZ">
| <entry>
| <identity-name>Regular_User</identity-name>
| <permissions>READ,UPDATE</permissions>
| </entry>
| <!-- This overrides the definition from the parent ACL -->
| <entry>
| <identity-name>Guest</identity-name>
| <permissions>READ,UPDATE</permissions>
| </entry>
| </acl-definition>
|
| </jboss-acl>
|
when deployed, the above configuration file would result in the creation of 2 ACLs: one for resource XYZ with 2 entries (Administrator and Guest) and one for resource ABC with 3 entries (Administrator, Guest and Regular_User). Code that wants to apply ACL checks would call the AuthorizationManager in order to verify if an identity has or not the expected permissions.
I'm opening this thread to gather opinions on this configuration file. Does it look ok? Do you think it is missing something? Would you specify the ACLs using a different schema?
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4183603#4183603
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4183603
16 years, 2 months
[Design of EJB 3.0] - Re: Default JNDI naming scheme in EJB3.0 and possible confli
by jaikiran
"jaikiran" wrote :
| I think the second example will be handled gracefully in 3.1 as per the specs (Section 4.4.1):
|
| anonymous wrote : Each portable session bean global JNDI name has the following syntax :
| |
| | java:global[/<app-name>]/<module-name>/<bean-name>#<fully-qualified-interface-name>
| |
| | The container registers a separate global JNDI name entry for each local business interface, each remote business interface, and any no-interface view, 2.x local home interface, or 2.x remote home interface. For the the no-interface view, the last portion of the entry name is the fully-qualified bean class name.
| |
|
| The fully-qualified-interface-name will generate a unique JNDI name.
|
On second thoughts, Carlo is right. The following scenario will not work even in 3.1:
Both packaged in same EAR/JAR:
package org.myapp.business;
|
| @Stateless
| public class ManagerBean implements org.myapp.Manager {
|
| }
|
package org.myapp.persistence;
|
| @Stateless
| public class ManagerBean implements org.myapp.Manager {
|
| }
|
Both of these will resolve to
java:global[/<app-name>]/<module-name>/ManagerBean#org.myapp.Manager
|
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4183581#4183581
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4183581
16 years, 2 months
[Design of EJB 3.0] - Re: Default JNDI naming scheme in EJB3.0 and possible confli
by jaikiran
"wolfc" wrote :
| The second example will even fail in 3.1, but I consider it bad practice to have two classes with the same name in 1 module.
I think the second example will be handled gracefully in 3.1 as per the specs (Section 4.4.1):
anonymous wrote : Each portable session bean global JNDI name has the following syntax :
|
| java:global[/<app-name>]/<module-name>/<bean-name>#<fully-qualified-interface-name>
|
| The container registers a separate global JNDI name entry for each local business interface, each remote business interface, and any no-interface view, 2.x local home interface, or 2.x remote home interface. For the the no-interface view, the last portion of the entry name is the fully-qualified bean class name.
|
The fully-qualified-interface-name will generate a unique JNDI name.
"ALRubinger" wrote :
| Otherwise we could default the EJB Name to the FQN of the bean impl class, but I think that'll cause more problems (migration) that it'll solve.
|
I agree - changing the default EJB name at this point would not be of much help for this not so common scenario.
"ALRubinger" wrote :
| So the workaround is to set it explicitly.
|
Right, but the current behaviour just silently ignores the 2nd EJB and does not bind it. So if we have the information that we have already bound bean1 to the same name then maybe we could log a WARN message to highlight this issue so that the user opts for the workaround.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4183564#4183564
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4183564
16 years, 2 months