6:57 a.m.
[ http://jira.jboss.com/jira/browse/JBAS-1824?page=comments#action_12346229 ]
Roland R?z commented on JBAS-1824:
----------------------------------
Sadly, the new feature described in http://jira.jboss.com/jira/browse/JBAS-2926 is just
about tomcat and not jacc.
Providing such a feature prevents from ugly workarounds. For example writing a simple
public web service (with an EJB3 stateless session bean) requires the developer to add for
example the @RolesAllowed("friend") at the class level, else in the generated
web deployment is not able to produce the jacc permissions.
The proposed change at the JACC layer by using a WebResourcePermission("xyz",
null) looks like a good solution. Until that is implemented JBoss could provide a feature
similar as the following:
org.jboss.web.WebPermissionMapping#createPermissions():
...
// Get the qualified url pattern
PatternInfo info = (PatternInfo) patternMap.get(url);
Iterator roles = wsmd.getRoles().iterator();
HashSet mappedRoles = new HashSet();
while( roles.hasNext() )
{
String role = (String) roles.next();
if( role.equals("*") )
{
if (Boolean.valueOf(
System.getProperty("jboss.tomcat.jacc.allow-all.role.for.star",
"false")).booleanValue()) {
// add the "ALLOW-ALL" which could be handled
// generically in jacc
mappedRoles.add("ALLOW-ALL");
}
// The wildcard ref maps to all declared security-role names
Iterator allRoles = metaData.getSecurityRoleNames().iterator();
while( allRoles.hasNext() )
{
role = (String) allRoles.next();
mappedRoles.add(role);
}
}
else
{
mappedRoles.add(role);
}
}
...
This feature would allow to handle the role * generically in the jacc provider. The
developer just sets the jboss.tomcat.jacc.allow-all.role.for.star system property to true
and uses then the role * as a role which any authenticated user has.
JACC: <role-name>*</role-name> in web.xml
-----------------------------------------
Key: JBAS-1824
URL: http://jira.jboss.com/jira/browse/JBAS-1824
Project: JBoss Application Server
Issue Type: Feature Request
Components: Security
Affects Versions: JBossAS-4.0.2 Final
Environment: -
Reporter: Roland R?z
Assigned To: Scott M Stark
Priority: Minor
Original Estimate: 1 hour
Remaining Estimate: 1 hour
In some cases I wish to do authentication without authorisation. For example everybody
has access to my web-resource, but I want to know who she/he is.
Therefore the accessing user must login.
So my web.xml contains the following snippet:
...
<security-constraint>
<web-resource-collection>
<web-resource-name>Protected Helloworld example</web-resource-name>
<description/>
<url-pattern>/servlet/HelloWorldExample</url-pattern>
<http-method>POST</http-method>
<http-method>GET</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>public</realm-name>
</login-config>
...
The web app runs with this configuration in Tomcat 5.5.8 standalone but not in Jboss.
To run it in Jboss I have to add the following element:
<security-role>
<role-name>aRole</role-name>
</security-role>
The JACC spec (section 3.1.3.1, paragraph 3)states :
" ?. When an auth-constraint names the reserved role-name, "*", all of the
patterns in the containing security-constraint must be combined with all of the roles
defined in the web application."
JBoss implemented this by combining all of the patterns with all roles defined in the
web.xml and assumes that each role has to be defined in the web.xml.
But the web applications roles are probably defined in other files than the web.xml. In
our case we use JACC with an external authentication provider. And each time, the roles
changes, I also would have to modify the web.xml.
It is desirable if the auth-contraint with the role-name "*" acceppts
"all" roles and not only those that are defined in the web.xml.
Or is this a JACC spec issue?
Regards,
Andrea
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
7139
days inactive
7139
days old
0 comments
1 participants
participants (1)
-
Roland R?z (JIRA)