[
https://issues.jboss.org/browse/WFCORE-3796?page=com.atlassian.jira.plugi...
]
Brian Stansberry commented on WFCORE-3796:
------------------------------------------
This should not be done by any management code that runs in Stage.MODEL. Checking runtime
state should only be done in Stage.RUNTIME, and only in processes that are certain to have
the correct runtime state. You should assume code running in Stage.MODEL has no clue as to
the actual runtime state. And in a domain, the DC definitely has no clue as to what its
servers support, and even an HC might be uninformed in some cases (e.g. the HC is running
JDK 11 but the server is JDK 8.)
If the code doing the check in Stage.RUNTIME wants to force rollback regardless of any
rollback-on-runtime-failure setting by the user, OperationContext.setRollbackOnly can be
used. This is a valid approach for doing configuration correctness checks outside of
Stage.MODEL.
Incorrect Elytron permission class-name or module should throw
exception
------------------------------------------------------------------------
Key: WFCORE-3796
URL:
https://issues.jboss.org/browse/WFCORE-3796
Project: WildFly Core
Issue Type: Bug
Components: Security
Affects Versions: 5.0.0.Alpha4
Reporter: Ondrej Lukas
When non-existent class-name or module (e.g. when there is a typo) is added to any
Elytron permission mapper (constant-permission-mapper or simple-permission-mapper) then
exception should be thrown. Otherwise it can result to situation when due to a typo some
permission is granted to any identity instead of denying it - when permission in used on
'deny' side.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)