[JBoss JIRA] Created: (JBAS-8352) Stacked login with subclassed Principal does not work.
by Craig Horrell (JIRA)
Stacked login with subclassed Principal does not work.
------------------------------------------------------
Key: JBAS-8352
URL: https://jira.jboss.org/browse/JBAS-8352
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Security
Affects Versions: JBossAS-5.1.0.GA
Environment: Windows XP; Jboss 5.1.0.GA;
Reporter: Craig Horrell
Assignee: Anil Saldhana
The Principal is not propagated from login module to login module when using stacked logins. Instead, a new Principal is created, but only the first one survives.
Code references:
1. org.jboss.security.auth.spi.UsernamePasswordLoginModule: Method login():
Object username = sharedState.get("javax.security.auth.login.name");
if (username instanceof Principal) {
identity = (Principal) username;
} else {
String name = username.toString();
try {
identity = createIdentity(name);
} catch (Exception e) {
log.debug("Failed to create principal", e);
throw new LoginException("Failed to create principal: " + e.getMessage());
}
}
The code above checks to see if the Object stored in the shared state is a Principal. This code is correct.
2. Later in the same method:
if (getUseFirstPass() == true) { // Add the username and password to the shared state map
sharedState.put("javax.security.auth.login.name", username);
sharedState.put("javax.security.auth.login.password", credential);
}
This is part of the bug. It stores the name instead of the Object, which causes the second login module to create a new Principal.
3. org.jboss.security.auth.spi.AbstractServerLoginModule: Method: commit():
Principal identity = getIdentity();
principals.add(identity);
'principals' is a Set. The add will not replace an existing identity, so the one created by the second login module is ignored.
If the second login module got the object from the first, it could update it. As it is the second login module cannot do anything with the principal, as it is discarded.
Complications: Some thought would have to be given as to what would happen if two different principal classes were specified in the config. Perhaps disallow that ?
Our specific issue: We have a subclassed SimplePrincipal that holds context based security information for that user that is checked as part of the authorization in our web services. We stack a LDAP login module for the user-id and password, then a subclass of DatabaseServerLoginModule that gets the roles and other context based data from a database.
Work Around: in the subclassed DatabaseServerLoginModule's getRoleSets() method we do:
// To overcome stacked login bugs, we must replace the existing principal
// with a new one created here.
Principal pr = this.getIdentity();
log.trace("SlDbServerLoginModule: getRoleSets(): "
+ "Got Principal from parent: user: " + pr.getName());
SlIdentity slId = new SlIdentity(pr.getName());
slId.addClientList(getSlClientList(username, roleSet));
slId.addSiteList(getSlSiteList(username, roleSet));
Set<Principal> prs = this.subject.getPrincipals();
prs.remove(pr);
prs.add(slId);
log.trace("SlDbServerLoginModule: getRoleSets(): "
+ "Replaced Principal with SlIdentity: user: " + slId.getName());
return roleSets;
Thanks,
Craig.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
13 years, 11 months
[JBoss JIRA] Created: (JBRULES-2706) Replace extjs grid in decision tables and rule templates with a new grid that suppors cell merging
by Geoffrey De Smet (JIRA)
Replace extjs grid in decision tables and rule templates with a new grid that suppors cell merging
--------------------------------------------------------------------------------------------------
Key: JBRULES-2706
URL: https://jira.jboss.org/browse/JBRULES-2706
Project: Drools
Issue Type: Feature Request
Security Level: Public (Everyone can see)
Components: drools-guvnor
Affects Versions: 5.1.1.FINAL
Reporter: Geoffrey De Smet
Assignee: Geoffrey De Smet
Priority: Critical
Fix For: 5.2.0.M1
<conan> so what I'd like to do is get our dtable moved across to a new grid
<conan> but also for it to be updated so that it supports cell merging
<conan> the cell merging is essential for proper web based dtables
<conan> cbrock was working on errai grid that supports cell merging
<conan> manstis has been looking into it
<conan> he submitted some patches to errai but says it's a lot of work
<conan> to make it into a full component
<conan> he thinks that flex grid now has cell merging, but I doubt that.....
<conan> but he might be right in that it would be quicker to move the errai cell merging code into a fork of the gwt flex grid
<conan> that try and move everything into errai grid that makes a grid workable
<conan> a second issue is that that the rule template
<conan> really should use the same grid as dtable grid
<conan> including the same mechanisms for driving possible values et
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
13 years, 11 months