[JBoss JIRA] Created: (JBAS-5960) EJB2: Lack of security domain in JBoss DD does not bypass security
12:09 p.m.
EJB2: Lack of security domain in JBoss DD does not bypass security
------------------------------------------------------------------
Key: JBAS-5960
URL: https://jira.jboss.org/jira/browse/JBAS-5960
Project: JBoss Application Server
Issue Type: Feature Request
Security Level: Public (Everyone can see)
Components: EJB2
Affects Versions: JBossAS-5.0.0.CR1
Reporter: Anil Saldhana
Assignee: Anil Saldhana
Fix For: JBossAS-5.0.0.GA
Currently, if there is no security domain defined for a deployment, we bypass security
with a fat WARN message. But if there is presence of security meta data for the
deployment (EJB2 method perms in ejb-jar.xml), there is an expectation of security
enforcement. In this case, we need to default the security domain to "other".
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:59 a.m.
New subject: [JBoss JIRA] Assigned: (JBAS-5960) EJB2: Lack of security domain in JBoss DD does not bypass security
[
https://jira.jboss.org/jira/browse/JBAS-5960?page=com.atlassian.jira.plug...
]
Anil Saldhana reassigned JBAS-5960:
-----------------------------------
Assignee: Marcus Moyses (was: Anil Saldhana)
The location of the code is org.jboss.ejb.plugins.SecurityInterceptor where we check for
security domain == null. If yes, we print a log.WARN and move on to the next interceptor.
What we need to do is if security domain == null, then just take the default for EJBs,
SecurityConstants.DEFAULT_EJB_APPLICATION_POLICY).
Ensure that the run "ant tests-security-basic-unit" passes in AS5 testsuite.
EJB2: Lack of security domain in JBoss DD does not bypass security
------------------------------------------------------------------
Key: JBAS-5960
URL: https://jira.jboss.org/jira/browse/JBAS-5960
Project: JBoss Application Server
Issue Type: Feature Request
Security Level: Public(Everyone can see)
Components: EJB2
Affects Versions: JBossAS-5.0.0.CR1
Reporter: Anil Saldhana
Assignee: Marcus Moyses
Fix For: JBossAS-5.0.0.GA
Currently, if there is no security domain defined for a deployment, we bypass security
with a fat WARN message. But if there is presence of security meta data for the
deployment (EJB2 method perms in ejb-jar.xml), there is an expectation of security
enforcement. In this case, we need to default the security domain to "other".
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
12:14 p.m.
New subject: [JBoss JIRA] Commented: (JBAS-5960) EJB2: Lack of security domain in JBoss DD does not bypass security
[
https://jira.jboss.org/jira/browse/JBAS-5960?page=com.atlassian.jira.plug...
]
Anil Saldhana commented on JBAS-5960:
-------------------------------------
Remember, securitydomain = "" means that the user has requested an explicit
bypass of security, rather than "null" which means someone forgot to configure a
security domain.
EJB2: Lack of security domain in JBoss DD does not bypass security
------------------------------------------------------------------
Key: JBAS-5960
URL: https://jira.jboss.org/jira/browse/JBAS-5960
Project: JBoss Application Server
Issue Type: Feature Request
Security Level: Public(Everyone can see)
Components: EJB2
Affects Versions: JBossAS-5.0.0.CR1
Reporter: Anil Saldhana
Assignee: Marcus Moyses
Fix For: JBossAS-5.0.0.GA
Currently, if there is no security domain defined for a deployment, we bypass security
with a fat WARN message. But if there is presence of security meta data for the
deployment (EJB2 method perms in ejb-jar.xml), there is an expectation of security
enforcement. In this case, we need to default the security domain to "other".
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:24 a.m.
New subject: [JBoss JIRA] Resolved: (JBAS-5960) EJB2: Lack of security domain in JBoss DD does not bypass security
[
https://jira.jboss.org/jira/browse/JBAS-5960?page=com.atlassian.jira.plug...
]
Marcus Moyses resolved JBAS-5960.
---------------------------------
Resolution: Done
Fixed and created test org.jboss.test.security.test.EJBNullSecurityDomainUnitTestCase for
it in the testsuite.
EJB2: Lack of security domain in JBoss DD does not bypass security
------------------------------------------------------------------
Key: JBAS-5960
URL: https://jira.jboss.org/jira/browse/JBAS-5960
Project: JBoss Application Server
Issue Type: Feature Request
Security Level: Public(Everyone can see)
Components: EJB2
Affects Versions: JBossAS-5.0.0.CR1
Reporter: Anil Saldhana
Assignee: Marcus Moyses
Fix For: JBossAS-5.0.0.GA
Currently, if there is no security domain defined for a deployment, we bypass security
with a fat WARN message. But if there is presence of security meta data for the
deployment (EJB2 method perms in ejb-jar.xml), there is an expectation of security
enforcement. In this case, we need to default the security domain to "other".
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:03 p.m.
New subject: [JBoss JIRA] Commented: (JBAS-5960) EJB2: Lack of security domain in JBoss DD does not bypass security
[
https://jira.jboss.org/jira/browse/JBAS-5960?page=com.atlassian.jira.plug...
]
Anil Saldhana commented on JBAS-5960:
-------------------------------------
The key to do security domain fallback is not only missed security domain name but also
whether there is security meta data defined for the ejb deployment. marcus checks whether
there is at least one method with no unchecked permission.
EJB2: Lack of security domain in JBoss DD does not bypass security
------------------------------------------------------------------
Key: JBAS-5960
URL: https://jira.jboss.org/jira/browse/JBAS-5960
Project: JBoss Application Server
Issue Type: Feature Request
Security Level: Public(Everyone can see)
Components: EJB2
Affects Versions: JBossAS-5.0.0.CR1
Reporter: Anil Saldhana
Assignee: Marcus Moyses
Fix For: JBossAS-5.0.0.GA
Currently, if there is no security domain defined for a deployment, we bypass security
with a fat WARN message. But if there is presence of security meta data for the
deployment (EJB2 method perms in ejb-jar.xml), there is an expectation of security
enforcement. In this case, we need to default the security domain to "other".
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:20 p.m.
New subject: [JBoss JIRA] Reopened: (JBAS-5960) EJB2: Lack of security domain in JBoss DD does not bypass security
[
https://jira.jboss.org/jira/browse/JBAS-5960?page=com.atlassian.jira.plug...
]
Anil Saldhana reopened JBAS-5960:
---------------------------------
Marcus, can you modify the test to include cases that pass also
========================
public void testEJB() throws Exception
{
log.debug("+++ testEJBNullSecurityDomain");
Object obj = getInitialContext().lookup("null.StatelessSession");
obj = PortableRemoteObject.narrow(obj, StatelessSessionHome.class);
StatelessSessionHome home = (StatelessSessionHome) obj;
log.debug("Found null.StatelessSession Home");
StatelessSession bean = null;
try
{
bean = home.create();
fail("Invoking create() should fail");
}
catch (Exception e)
{
Throwable t = e.getCause();
if (t instanceof SecurityException)
{
log.debug("Invoking create() was correctly denied by a
SecurityException:", e);
}
else
{
log.debug("Invoking create() failed by an unexpected reason:", e);
fail("Unexpected exception");
}
}
SecurityClient client = SecurityClientFactory.getSecurityClient();
client.setSimple(username, password);
client.login();
try
{
bean = home.create();
bean.echo("hi");
}
catch(Exception e)
{
fail(e.getLocalizedMessage());
}
}
=============================
An example.
EJB2: Lack of security domain in JBoss DD does not bypass security
------------------------------------------------------------------
Key: JBAS-5960
URL: https://jira.jboss.org/jira/browse/JBAS-5960
Project: JBoss Application Server
Issue Type: Feature Request
Security Level: Public(Everyone can see)
Components: EJB2
Affects Versions: JBossAS-5.0.0.CR1
Reporter: Anil Saldhana
Assignee: Marcus Moyses
Fix For: JBossAS-5.0.0.GA
Currently, if there is no security domain defined for a deployment, we bypass security
with a fat WARN message. But if there is presence of security meta data for the
deployment (EJB2 method perms in ejb-jar.xml), there is an expectation of security
enforcement. In this case, we need to default the security domain to "other".
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:38 p.m.
New subject: [JBoss JIRA] Commented: (JBAS-5960) EJB2: Lack of security domain in JBoss DD does not bypass security
[
https://jira.jboss.org/jira/browse/JBAS-5960?page=com.atlassian.jira.plug...
]
Anil Saldhana commented on JBAS-5960:
-------------------------------------
http://anonsvn.jboss.org/repos/jbossas/trunk/testsuite/src/main/org/jboss...
I reused your deployment and found the gaps.
EJB2: Lack of security domain in JBoss DD does not bypass security
------------------------------------------------------------------
Key: JBAS-5960
URL: https://jira.jboss.org/jira/browse/JBAS-5960
Project: JBoss Application Server
Issue Type: Feature Request
Security Level: Public(Everyone can see)
Components: EJB2
Affects Versions: JBossAS-5.0.0.CR1
Reporter: Anil Saldhana
Assignee: Marcus Moyses
Fix For: JBossAS-5.0.0.GA
Currently, if there is no security domain defined for a deployment, we bypass security
with a fat WARN message. But if there is presence of security meta data for the
deployment (EJB2 method perms in ejb-jar.xml), there is an expectation of security
enforcement. In this case, we need to default the security domain to "other".
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
12:23 p.m.
New subject: [JBoss JIRA] Resolved: (JBAS-5960) EJB2: Lack of security domain in JBoss DD does not bypass security
[
https://jira.jboss.org/jira/browse/JBAS-5960?page=com.atlassian.jira.plug...
]
Marcus Moyses resolved JBAS-5960.
---------------------------------
Resolution: Done
Modified the test case to include an attempt after login.
EJB2: Lack of security domain in JBoss DD does not bypass security
------------------------------------------------------------------
Key: JBAS-5960
URL: https://jira.jboss.org/jira/browse/JBAS-5960
Project: JBoss Application Server
Issue Type: Feature Request
Security Level: Public(Everyone can see)
Components: EJB2
Affects Versions: JBossAS-5.0.0.CR1
Reporter: Anil Saldhana
Assignee: Marcus Moyses
Fix For: JBossAS-5.0.0.GA
Currently, if there is no security domain defined for a deployment, we bypass security
with a fat WARN message. But if there is presence of security meta data for the
deployment (EJB2 method perms in ejb-jar.xml), there is an expectation of security
enforcement. In this case, we need to default the security domain to "other".
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6502
days inactive
6539
days old
7 comments
2 participants
participants (2)
-
Anil Saldhana (JIRA) -
Marcus Moyses (JIRA)