[JBoss JIRA] (AS7-5862) Do not ignore security annotations and deployment descriptor configurations on EJBs in the absence of explicit security domain configuration
by Josef Cacek (JIRA)
Josef Cacek created AS7-5862:
--------------------------------
Summary: Do not ignore security annotations and deployment descriptor configurations on EJBs in the absence of explicit security domain configuration
Key: AS7-5862
URL: https://issues.jboss.org/browse/AS7-5862
Project: Application Server 7
Issue Type: Feature Request
Components: EJB
Affects Versions: 7.1.2.Final (EAP)
Reporter: Josef Cacek
Assignee: jaikiran pai
Fix For: 7.2.0.Alpha1
Consider the following example:
{code}
@Stateless
public class SecureBean
{
@RolesAllowed("role1")
public void restrictedRoles()
{
...
}
@DenyAll
public void denyEveryone()
{
...
}
}
{code}
Notice that the bean methods use EJB security annotations to restrict access *however* the bean doesn't have any explicit @SecurityDomain configured (not even in jboss-ejb3.xml). Right now, AS7 ignores the security restriction on that bean allows everyone to invoke on it, as if security wasn't configured for that bean. This has confused users who expect the invocations to fail since they have used the javax.ejb.* security annotations to restrict access. Many users have asked for a feature where the security domain is defaulted (if not explicitly specified) in cases like this.
This JIRA is expected to introduce this feature in AS 7.2.x
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
13 years, 6 months
[JBoss JIRA] Created: (JBAS-6326) InterruptedException on shutdown
by Jeff Yu (JIRA)
InterruptedException on shutdown
--------------------------------
Key: JBAS-6326
URL: https://jira.jboss.org/jira/browse/JBAS-6326
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: JCA service
Affects Versions: JBossAS-4.2.2.GA
Reporter: Jeff Yu
Assignee: Jeff Zhang
Priority: Minor
I see the following exception on shutdown with either default, all, production servers (using all's log4j configuration). I'm not sure it is necessary for users to see. Probably needs to be changed to DEBUG level if really not relevant.
09:07:59,647 WARN [NewMsgsWorker] Interrupted waiting for new msg check
java.lang.InterruptedException
at java.lang.Object.wait(Native Method)
at java.lang.Object.wait(Object.java:474)
at EDU.oswego.cs.dl.util.concurrent.Semaphore.acquire(Semaphore.java:108)
at EDU.oswego.cs.dl.util.concurrent.SemaphoreControlledChannel.take(SemaphoreControlledChannel.java:131)
at org.jboss.resource.adapter.mail.inflow.NewMsgsWorker.run(NewMsgsWorker.java:75)
at org.jboss.resource.work.WorkWrapper.execute(WorkWrapper.java:204)
at org.jboss.util.threadpool.BasicTaskWrapper.run(BasicTaskWrapper.java:275)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:756)
at java.lang.Thread.run(Thread.java:595)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
13 years, 6 months