8:28 p.m.
Discrepancies in User and Group management API in Seam Security 3
-----------------------------------------------------------------
Key: SEAM-102
URL: https://issues.jboss.org/browse/SEAM-102
Project: Seam 3 Distribution
Issue Type: Bug
Affects Versions: 3.0.0.Final
Environment: Seam 3.1.0.Beta2
JBoss AS 7
Reporter: Luca Cavagnoli
Priority: Minor
The method:
{code:java}
Group groupName = pm.createGroup("Group name", "Group type");
{code}
just adds a row in IdentityObject with the following values:
{code:sql}
('Group name', SELECT id FROM IdentityObjectType WHERE name = 'Group
type')
{code}
if IdentityObjectType doesn't already have a row with name = "Group type",
the IDENTITY_OBJECT_TYPE_ID in the new IdentityObject row is set to null, instead of
adding a new row in IdentityObjectType for the new group type.
The method
{code:java}
PersistenceManager.createGroup(String groupName, String groupType)
{code}
can also be abused by creating a group with 'USER' as groupType, despite
'USER' was the identity object type chosen to represent users, not groups.
The method
{code:java}
Collection<Group> PersistenceManager.findGroup(String groupType)
{code}
performs no check about the groupType parameter. One could invoke it as follows:
{code:java}
findGroup("USER")
{code}
and the result would be a list of groups which are actually users.
'USER' should be excluded from the list of types that are searched for.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:34 p.m.
[
https://issues.jboss.org/browse/SEAM-102?page=com.atlassian.jira.plugin.s...
]
Luca Cavagnoli updated SEAM-102:
--------------------------------
Labels: idmconsole picketlink seam-security (was: picketlink
seam-security)
Environment:
Seam 3.1.0.Beta2
JBoss AS 7
idmconsole
was:
Seam 3.1.0.Beta2
JBoss AS 7
Workaround Description: (was: Create all the IdentityObjectType entries that your
application is going to be using up front. (partial workaround))
Component/s: Shared Examples
Forum Reference:
http://seamframework.org/Community/PerplexitiesAboutSeam3AndPicketlink (was:
http://seamframework.org/Community/PerplexitiesAboutSeam3AndPicketlink)
When filing this JIRA, I choose 3.0.0.Final as affeted version because it didn't allow
me to choose 3.1.0.Beta2, which I am actually using.
I'm using 3.1.0.Beta2 because with 3.0.0.Final the idmconsole example doesn't work
with JBoss AS 7.
Discrepancies in User and Group management API in Seam Security 3
-----------------------------------------------------------------
Key: SEAM-102
URL: https://issues.jboss.org/browse/SEAM-102
Project: Seam 3 Distribution
Issue Type: Bug
Components: Shared Examples
Affects Versions: 3.0.0.Final
Environment: Seam 3.1.0.Beta2
JBoss AS 7
idmconsole
Reporter: Luca Cavagnoli
Priority: Minor
Labels: idmconsole, picketlink, seam-security
The method:
{code:java}
Group groupName = pm.createGroup("Group name", "Group type");
{code}
just adds a row in IdentityObject with the following values:
{code:sql}
('Group name', SELECT id FROM IdentityObjectType WHERE name = 'Group
type')
{code}
if IdentityObjectType doesn't already have a row with name = "Group type",
the IDENTITY_OBJECT_TYPE_ID in the new IdentityObject row is set to null, instead of
adding a new row in IdentityObjectType for the new group type.
The method
{code:java}
PersistenceManager.createGroup(String groupName, String groupType)
{code}
can also be abused by creating a group with 'USER' as groupType, despite
'USER' was the identity object type chosen to represent users, not groups.
The method
{code:java}
Collection<Group> PersistenceManager.findGroup(String groupType)
{code}
performs no check about the groupType parameter. One could invoke it as follows:
{code:java}
findGroup("USER")
{code}
and the result would be a list of groups which are actually users.
'USER' should be excluded from the list of types that are searched for.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:23 p.m.
New subject: [JBoss JIRA] (SEAMSECURITY-108) Discrepancies in User and Group management API in Seam Security 3
[
https://issues.jboss.org/browse/SEAMSECURITY-108?page=com.atlassian.jira....
]
Shane Bryzak moved SEAM-102 to SEAMSECURITY-108:
------------------------------------------------
Project: Seam Security (was: Seam 3 Distribution)
Key: SEAMSECURITY-108 (was: SEAM-102)
Affects Version/s: 3.1.0.Beta3
(was: 3.0.0.Final)
Component/s: (was: Shared Examples)
Discrepancies in User and Group management API in Seam Security 3
-----------------------------------------------------------------
Key: SEAMSECURITY-108
URL: https://issues.jboss.org/browse/SEAMSECURITY-108
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta3
Environment: Seam 3.1.0.Beta2
JBoss AS 7
idmconsole
Reporter: Luca Cavagnoli
Priority: Minor
Labels: idmconsole, picketlink, seam-security
The method:
{code:java}
Group groupName = pm.createGroup("Group name", "Group type");
{code}
just adds a row in IdentityObject with the following values:
{code:sql}
('Group name', SELECT id FROM IdentityObjectType WHERE name = 'Group
type')
{code}
if IdentityObjectType doesn't already have a row with name = "Group type",
the IDENTITY_OBJECT_TYPE_ID in the new IdentityObject row is set to null, instead of
adding a new row in IdentityObjectType for the new group type.
The method
{code:java}
PersistenceManager.createGroup(String groupName, String groupType)
{code}
can also be abused by creating a group with 'USER' as groupType, despite
'USER' was the identity object type chosen to represent users, not groups.
The method
{code:java}
Collection<Group> PersistenceManager.findGroup(String groupType)
{code}
performs no check about the groupType parameter. One could invoke it as follows:
{code:java}
findGroup("USER")
{code}
and the result would be a list of groups which are actually users.
'USER' should be excluded from the list of types that are searched for.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:27 p.m.
New subject: [JBoss JIRA] (SEAMSECURITY-108) Discrepancies in User and Group management API in Seam Security 3
[
https://issues.jboss.org/browse/SEAMSECURITY-108?page=com.atlassian.jira....
]
Shane Bryzak reassigned SEAMSECURITY-108:
-----------------------------------------
Assignee: Shane Bryzak
Discrepancies in User and Group management API in Seam Security 3
-----------------------------------------------------------------
Key: SEAMSECURITY-108
URL: https://issues.jboss.org/browse/SEAMSECURITY-108
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta3
Environment: Seam 3.1.0.Beta2
JBoss AS 7
idmconsole
Reporter: Luca Cavagnoli
Assignee: Shane Bryzak
Priority: Minor
Labels: idmconsole, picketlink, seam-security
The method:
{code:java}
Group groupName = pm.createGroup("Group name", "Group type");
{code}
just adds a row in IdentityObject with the following values:
{code:sql}
('Group name', SELECT id FROM IdentityObjectType WHERE name = 'Group
type')
{code}
if IdentityObjectType doesn't already have a row with name = "Group type",
the IDENTITY_OBJECT_TYPE_ID in the new IdentityObject row is set to null, instead of
adding a new row in IdentityObjectType for the new group type.
The method
{code:java}
PersistenceManager.createGroup(String groupName, String groupType)
{code}
can also be abused by creating a group with 'USER' as groupType, despite
'USER' was the identity object type chosen to represent users, not groups.
The method
{code:java}
Collection<Group> PersistenceManager.findGroup(String groupType)
{code}
performs no check about the groupType parameter. One could invoke it as follows:
{code:java}
findGroup("USER")
{code}
and the result would be a list of groups which are actually users.
'USER' should be excluded from the list of types that are searched for.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:46 p.m.
New subject: [JBoss JIRA] (SEAMSECURITY-108) Discrepancies in User and Group management API in Seam Security 3
[
https://issues.jboss.org/browse/SEAMSECURITY-108?page=com.atlassian.jira....
]
Luca Cavagnoli commented on SEAMSECURITY-108:
---------------------------------------------
I explored the source code and I found this:
The method
{code:java}
org.picketlink.idm.api Group
org.picketlink.idm.impl.api.session.managers.PersistenceManagerImpl.createGroup(String
groupName, String groupType)
{code}
tries to identity the Identity Object Type "groupType" with the following
instruction:
{code:java}
IdentityObjectType iot = getIdentityObjectType(groupType);
{code:java}
Which causes a call to:
org.picketlink.idm.impl.api.session.mapper
{code:java}
org.picketlink.idm.spi.model IdentityObjectType
org.picketlink.idm.impl.api.session.mapper.IdentityObjectTypeMapperImpl.getIdentityObjectType(String
groupType)
{}
Which matches the given groupType against a Map representing the existing group types. If
no match is found, it returns null.
After that, PersistenceManagerImpl has the following line:
{code:java}
IdentityObject identityObject =
getRepository().createIdentityObject(getInvocationContext(), groupName, iot);
{code}
with a nul "iot" parameter.
What I find weird is that the following line in JpaIdentityStore:
{code:java}
typeProp.setValue(identityInstance, identityObjectType.getName());
{code}
doesn't throw a NullPointerException.
Discrepancies in User and Group management API in Seam Security 3
-----------------------------------------------------------------
Key: SEAMSECURITY-108
URL: https://issues.jboss.org/browse/SEAMSECURITY-108
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta3
Environment: Seam 3.1.0.Beta2
JBoss AS 7
idmconsole
Reporter: Luca Cavagnoli
Assignee: Shane Bryzak
Priority: Minor
Labels: idmconsole, picketlink, seam-security
The method:
{code:java}
Group groupName = pm.createGroup("Group name", "Group type");
{code}
just adds a row in IdentityObject with the following values:
{code:sql}
('Group name', SELECT id FROM IdentityObjectType WHERE name = 'Group
type')
{code}
if IdentityObjectType doesn't already have a row with name = "Group type",
the IDENTITY_OBJECT_TYPE_ID in the new IdentityObject row is set to null, instead of
adding a new row in IdentityObjectType for the new group type.
The method
{code:java}
PersistenceManager.createGroup(String groupName, String groupType)
{code}
can also be abused by creating a group with 'USER' as groupType, despite
'USER' was the identity object type chosen to represent users, not groups.
The method
{code:java}
Collection<Group> PersistenceManager.findGroup(String groupType)
{code}
performs no check about the groupType parameter. One could invoke it as follows:
{code:java}
findGroup("USER")
{code}
and the result would be a list of groups which are actually users.
'USER' should be excluded from the list of types that are searched for.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:46 p.m.
New subject: [JBoss JIRA] (SEAMSECURITY-108) Discrepancies in User and Group management API in Seam Security 3
[
https://issues.jboss.org/browse/SEAMSECURITY-108?page=com.atlassian.jira....
]
Luca Cavagnoli edited comment on SEAMSECURITY-108 at 10/5/11 7:45 PM:
----------------------------------------------------------------------
I explored the source code and I found this:
The method
{code:java}
org.picketlink.idm.api Group
org.picketlink.idm.impl.api.session.managers.PersistenceManagerImpl.createGroup(String
groupName, String groupType)
{code}
tries to identity the Identity Object Type "groupType" with the following
instruction:
{code:java}
IdentityObjectType iot = getIdentityObjectType(groupType);
{code:java}
Which causes a call to:
org.picketlink.idm.impl.api.session.mapper
{code:java}
org.picketlink.idm.spi.model IdentityObjectType
org.picketlink.idm.impl.api.session.mapper.IdentityObjectTypeMapperImpl.getIdentityObjectType(String
groupType)
{code}
Which matches the given groupType against a Map representing the existing group types. If
no match is found, it returns null.
After that, PersistenceManagerImpl has the following line:
{code:java}
IdentityObject identityObject =
getRepository().createIdentityObject(getInvocationContext(), groupName, iot);
{code}
with a nul "iot" parameter.
What I find weird is that the following line in JpaIdentityStore:
{code:java}
typeProp.setValue(identityInstance, identityObjectType.getName());
{code}
doesn't throw a NullPointerException.
was (Author: lucaster):
I explored the source code and I found this:
The method
{code:java}
org.picketlink.idm.api Group
org.picketlink.idm.impl.api.session.managers.PersistenceManagerImpl.createGroup(String
groupName, String groupType)
{code}
tries to identity the Identity Object Type "groupType" with the following
instruction:
{code:java}
IdentityObjectType iot = getIdentityObjectType(groupType);
{code:java}
Which causes a call to:
org.picketlink.idm.impl.api.session.mapper
{code:java}
org.picketlink.idm.spi.model IdentityObjectType
org.picketlink.idm.impl.api.session.mapper.IdentityObjectTypeMapperImpl.getIdentityObjectType(String
groupType)
{}
Which matches the given groupType against a Map representing the existing group types. If
no match is found, it returns null.
After that, PersistenceManagerImpl has the following line:
{code:java}
IdentityObject identityObject =
getRepository().createIdentityObject(getInvocationContext(), groupName, iot);
{code}
with a nul "iot" parameter.
What I find weird is that the following line in JpaIdentityStore:
{code:java}
typeProp.setValue(identityInstance, identityObjectType.getName());
{code}
doesn't throw a NullPointerException.
Discrepancies in User and Group management API in Seam Security 3
-----------------------------------------------------------------
Key: SEAMSECURITY-108
URL: https://issues.jboss.org/browse/SEAMSECURITY-108
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta3
Environment: Seam 3.1.0.Beta2
JBoss AS 7
idmconsole
Reporter: Luca Cavagnoli
Assignee: Shane Bryzak
Priority: Minor
Labels: idmconsole, picketlink, seam-security
The method:
{code:java}
Group groupName = pm.createGroup("Group name", "Group type");
{code}
just adds a row in IdentityObject with the following values:
{code:sql}
('Group name', SELECT id FROM IdentityObjectType WHERE name = 'Group
type')
{code}
if IdentityObjectType doesn't already have a row with name = "Group type",
the IDENTITY_OBJECT_TYPE_ID in the new IdentityObject row is set to null, instead of
adding a new row in IdentityObjectType for the new group type.
The method
{code:java}
PersistenceManager.createGroup(String groupName, String groupType)
{code}
can also be abused by creating a group with 'USER' as groupType, despite
'USER' was the identity object type chosen to represent users, not groups.
The method
{code:java}
Collection<Group> PersistenceManager.findGroup(String groupType)
{code}
performs no check about the groupType parameter. One could invoke it as follows:
{code:java}
findGroup("USER")
{code}
and the result would be a list of groups which are actually users.
'USER' should be excluded from the list of types that are searched for.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:48 p.m.
New subject: [JBoss JIRA] (SEAMSECURITY-108) Discrepancies in User and Group management API in Seam Security 3
[
https://issues.jboss.org/browse/SEAMSECURITY-108?page=com.atlassian.jira....
]
Luca Cavagnoli edited comment on SEAMSECURITY-108 at 10/5/11 7:47 PM:
----------------------------------------------------------------------
I explored the source code and I found this:
The method
{code:java}
org.picketlink.idm.api Group
org.picketlink.idm.impl.api.session.managers.PersistenceManagerImpl.createGroup(String
groupName, String groupType)
{code}
tries to find the Identity Object Type "groupType" with the following
instruction:
{code:java}IdentityObjectType iot = getIdentityObjectType(groupType);{code:java}
Which causes a call to:
org.picketlink.idm.impl.api.session.mapper
{code:java}
org.picketlink.idm.spi.model IdentityObjectType
org.picketlink.idm.impl.api.session.mapper.IdentityObjectTypeMapperImpl.getIdentityObjectType(String
groupType)
{code}
Which matches the given groupType against a Map representing the existing group types. If
no match is found, it returns null.
After that, PersistenceManagerImpl has the following line:
{code:java}
IdentityObject identityObject =
getRepository().createIdentityObject(getInvocationContext(), groupName, iot);
{code}
with a nul "iot" parameter.
What I find weird is that the following line in JpaIdentityStore:
{code:java}
typeProp.setValue(identityInstance, identityObjectType.getName());
{code}
doesn't throw a NullPointerException.
was (Author: lucaster):
I explored the source code and I found this:
The method
{code:java}
org.picketlink.idm.api Group
org.picketlink.idm.impl.api.session.managers.PersistenceManagerImpl.createGroup(String
groupName, String groupType)
{code}
tries to identity the Identity Object Type "groupType" with the following
instruction:
{code:java}
IdentityObjectType iot = getIdentityObjectType(groupType);
{code:java}
Which causes a call to:
org.picketlink.idm.impl.api.session.mapper
{code:java}
org.picketlink.idm.spi.model IdentityObjectType
org.picketlink.idm.impl.api.session.mapper.IdentityObjectTypeMapperImpl.getIdentityObjectType(String
groupType)
{code}
Which matches the given groupType against a Map representing the existing group types. If
no match is found, it returns null.
After that, PersistenceManagerImpl has the following line:
{code:java}
IdentityObject identityObject =
getRepository().createIdentityObject(getInvocationContext(), groupName, iot);
{code}
with a nul "iot" parameter.
What I find weird is that the following line in JpaIdentityStore:
{code:java}
typeProp.setValue(identityInstance, identityObjectType.getName());
{code}
doesn't throw a NullPointerException.
Discrepancies in User and Group management API in Seam Security 3
-----------------------------------------------------------------
Key: SEAMSECURITY-108
URL: https://issues.jboss.org/browse/SEAMSECURITY-108
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta3
Environment: Seam 3.1.0.Beta2
JBoss AS 7
idmconsole
Reporter: Luca Cavagnoli
Assignee: Shane Bryzak
Priority: Minor
Labels: idmconsole, picketlink, seam-security
The method:
{code:java}
Group groupName = pm.createGroup("Group name", "Group type");
{code}
just adds a row in IdentityObject with the following values:
{code:sql}
('Group name', SELECT id FROM IdentityObjectType WHERE name = 'Group
type')
{code}
if IdentityObjectType doesn't already have a row with name = "Group type",
the IDENTITY_OBJECT_TYPE_ID in the new IdentityObject row is set to null, instead of
adding a new row in IdentityObjectType for the new group type.
The method
{code:java}
PersistenceManager.createGroup(String groupName, String groupType)
{code}
can also be abused by creating a group with 'USER' as groupType, despite
'USER' was the identity object type chosen to represent users, not groups.
The method
{code:java}
Collection<Group> PersistenceManager.findGroup(String groupType)
{code}
performs no check about the groupType parameter. One could invoke it as follows:
{code:java}
findGroup("USER")
{code}
and the result would be a list of groups which are actually users.
'USER' should be excluded from the list of types that are searched for.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:48 p.m.
New subject: [JBoss JIRA] (SEAMSECURITY-108) Discrepancies in User and Group management API in Seam Security 3
[
https://issues.jboss.org/browse/SEAMSECURITY-108?page=com.atlassian.jira....
]
Luca Cavagnoli edited comment on SEAMSECURITY-108 at 10/5/11 7:47 PM:
----------------------------------------------------------------------
I explored the source code and I found this:
The method
{code:java}
org.picketlink.idm.api Group
org.picketlink.idm.impl.api.session.managers.PersistenceManagerImpl.createGroup(String
groupName, String groupType)
{code}
tries to find the Identity Object Type "groupType" with the following
instruction:
{code:java}{code:java}IdentityObjectType iot =
getIdentityObjectType(groupType);{code:java}
Which causes a call to:
org.picketlink.idm.impl.api.session.mapper
{code:java}
org.picketlink.idm.spi.model IdentityObjectType
org.picketlink.idm.impl.api.session.mapper.IdentityObjectTypeMapperImpl.getIdentityObjectType(String
groupType)
{code}
Which matches the given groupType against a Map representing the existing group types. If
no match is found, it returns null.
After that, PersistenceManagerImpl has the following line:
{code:java}
IdentityObject identityObject =
getRepository().createIdentityObject(getInvocationContext(), groupName, iot);
{code}
with a nul "iot" parameter.
What I find weird is that the following line in JpaIdentityStore:
{code:java}
typeProp.setValue(identityInstance, identityObjectType.getName());
{code}
doesn't throw a NullPointerException.
was (Author: lucaster):
I explored the source code and I found this:
The method
{code:java}
org.picketlink.idm.api Group
org.picketlink.idm.impl.api.session.managers.PersistenceManagerImpl.createGroup(String
groupName, String groupType)
{code}
tries to find the Identity Object Type "groupType" with the following
instruction:
{code:java}IdentityObjectType iot = getIdentityObjectType(groupType);{code:java}
Which causes a call to:
org.picketlink.idm.impl.api.session.mapper
{code:java}
org.picketlink.idm.spi.model IdentityObjectType
org.picketlink.idm.impl.api.session.mapper.IdentityObjectTypeMapperImpl.getIdentityObjectType(String
groupType)
{code}
Which matches the given groupType against a Map representing the existing group types. If
no match is found, it returns null.
After that, PersistenceManagerImpl has the following line:
{code:java}
IdentityObject identityObject =
getRepository().createIdentityObject(getInvocationContext(), groupName, iot);
{code}
with a nul "iot" parameter.
What I find weird is that the following line in JpaIdentityStore:
{code:java}
typeProp.setValue(identityInstance, identityObjectType.getName());
{code}
doesn't throw a NullPointerException.
Discrepancies in User and Group management API in Seam Security 3
-----------------------------------------------------------------
Key: SEAMSECURITY-108
URL: https://issues.jboss.org/browse/SEAMSECURITY-108
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta3
Environment: Seam 3.1.0.Beta2
JBoss AS 7
idmconsole
Reporter: Luca Cavagnoli
Assignee: Shane Bryzak
Priority: Minor
Labels: idmconsole, picketlink, seam-security
The method:
{code:java}
Group groupName = pm.createGroup("Group name", "Group type");
{code}
just adds a row in IdentityObject with the following values:
{code:sql}
('Group name', SELECT id FROM IdentityObjectType WHERE name = 'Group
type')
{code}
if IdentityObjectType doesn't already have a row with name = "Group type",
the IDENTITY_OBJECT_TYPE_ID in the new IdentityObject row is set to null, instead of
adding a new row in IdentityObjectType for the new group type.
The method
{code:java}
PersistenceManager.createGroup(String groupName, String groupType)
{code}
can also be abused by creating a group with 'USER' as groupType, despite
'USER' was the identity object type chosen to represent users, not groups.
The method
{code:java}
Collection<Group> PersistenceManager.findGroup(String groupType)
{code}
performs no check about the groupType parameter. One could invoke it as follows:
{code:java}
findGroup("USER")
{code}
and the result would be a list of groups which are actually users.
'USER' should be excluded from the list of types that are searched for.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:50 p.m.
New subject: [JBoss JIRA] (SEAMSECURITY-108) Discrepancies in User and Group management API in Seam Security 3
[
https://issues.jboss.org/browse/SEAMSECURITY-108?page=com.atlassian.jira....
]
Luca Cavagnoli edited comment on SEAMSECURITY-108 at 10/5/11 7:48 PM:
----------------------------------------------------------------------
I explored the source code and I found this:
The method
{code:java}
org.picketlink.idm.api Group
org.picketlink.idm.impl.api.session.managers.PersistenceManagerImpl.createGroup(String
groupName, String groupType)
{code}
tries to find the Identity Object Type "groupType" with the following
instruction:
IdentityObjectType iot = getIdentityObjectType(groupType);
Which causes a call to:
org.picketlink.idm.impl.api.session.mapper
{code:java}
org.picketlink.idm.spi.model IdentityObjectType
org.picketlink.idm.impl.api.session.mapper.IdentityObjectTypeMapperImpl.getIdentityObjectType(String
groupType)
{code}
Which matches the given groupType against a Map representing the existing group types. If
no match is found, it returns null.
After that, PersistenceManagerImpl has the following line:
{code:java}
IdentityObject identityObject =
getRepository().createIdentityObject(getInvocationContext(), groupName, iot);
{code}
with a nul "iot" parameter.
What I find weird is that the following line in JpaIdentityStore:
{code:java}
typeProp.setValue(identityInstance, identityObjectType.getName());
{code}
doesn't throw a NullPointerException.
was (Author: lucaster):
I explored the source code and I found this:
The method
{code:java}
org.picketlink.idm.api Group
org.picketlink.idm.impl.api.session.managers.PersistenceManagerImpl.createGroup(String
groupName, String groupType)
{code}
tries to find the Identity Object Type "groupType" with the following
instruction:
{code:java}{code:java}IdentityObjectType iot =
getIdentityObjectType(groupType);{code:java}
Which causes a call to:
org.picketlink.idm.impl.api.session.mapper
{code:java}
org.picketlink.idm.spi.model IdentityObjectType
org.picketlink.idm.impl.api.session.mapper.IdentityObjectTypeMapperImpl.getIdentityObjectType(String
groupType)
{code}
Which matches the given groupType against a Map representing the existing group types. If
no match is found, it returns null.
After that, PersistenceManagerImpl has the following line:
{code:java}
IdentityObject identityObject =
getRepository().createIdentityObject(getInvocationContext(), groupName, iot);
{code}
with a nul "iot" parameter.
What I find weird is that the following line in JpaIdentityStore:
{code:java}
typeProp.setValue(identityInstance, identityObjectType.getName());
{code}
doesn't throw a NullPointerException.
Discrepancies in User and Group management API in Seam Security 3
-----------------------------------------------------------------
Key: SEAMSECURITY-108
URL: https://issues.jboss.org/browse/SEAMSECURITY-108
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta3
Environment: Seam 3.1.0.Beta2
JBoss AS 7
idmconsole
Reporter: Luca Cavagnoli
Assignee: Shane Bryzak
Priority: Minor
Labels: idmconsole, picketlink, seam-security
The method:
{code:java}
Group groupName = pm.createGroup("Group name", "Group type");
{code}
just adds a row in IdentityObject with the following values:
{code:sql}
('Group name', SELECT id FROM IdentityObjectType WHERE name = 'Group
type')
{code}
if IdentityObjectType doesn't already have a row with name = "Group type",
the IDENTITY_OBJECT_TYPE_ID in the new IdentityObject row is set to null, instead of
adding a new row in IdentityObjectType for the new group type.
The method
{code:java}
PersistenceManager.createGroup(String groupName, String groupType)
{code}
can also be abused by creating a group with 'USER' as groupType, despite
'USER' was the identity object type chosen to represent users, not groups.
The method
{code:java}
Collection<Group> PersistenceManager.findGroup(String groupType)
{code}
performs no check about the groupType parameter. One could invoke it as follows:
{code:java}
findGroup("USER")
{code}
and the result would be a list of groups which are actually users.
'USER' should be excluded from the list of types that are searched for.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:50 p.m.
New subject: [JBoss JIRA] (SEAMSECURITY-108) Discrepancies in User and Group management API in Seam Security 3
[
https://issues.jboss.org/browse/SEAMSECURITY-108?page=com.atlassian.jira....
]
Luca Cavagnoli edited comment on SEAMSECURITY-108 at 10/5/11 7:49 PM:
----------------------------------------------------------------------
I explored the source code and I found this:
The method
{code:java}
org.picketlink.idm.api Group
org.picketlink.idm.impl.api.session.managers.PersistenceManagerImpl.createGroup(String
groupName, String groupType)
{code}
tries to find the Identity Object Type "groupType" with the following
instruction:
{code:java}
IdentityObjectType iot = getIdentityObjectType(groupType)
{code}
Which causes a call to:
org.picketlink.idm.impl.api.session.mapper
{code:java}
org.picketlink.idm.spi.model IdentityObjectType
org.picketlink.idm.impl.api.session.mapper.IdentityObjectTypeMapperImpl.getIdentityObjectType(String
groupType)
{code}
Which matches the given groupType against a Map representing the existing group types. If
no match is found, it returns null.
After that, PersistenceManagerImpl has the following line:
{code:java}
IdentityObject identityObject =
getRepository().createIdentityObject(getInvocationContext(), groupName, iot);
{code}
with a nul "iot" parameter.
What I find weird is that the following line in JpaIdentityStore:
{code:java}
typeProp.setValue(identityInstance, identityObjectType.getName());
{code}
doesn't throw a NullPointerException.
was (Author: lucaster):
I explored the source code and I found this:
The method
{code:java}
org.picketlink.idm.api Group
org.picketlink.idm.impl.api.session.managers.PersistenceManagerImpl.createGroup(String
groupName, String groupType)
{code}
tries to find the Identity Object Type "groupType" with the following
instruction:
IdentityObjectType iot = getIdentityObjectType(groupType);
Which causes a call to:
org.picketlink.idm.impl.api.session.mapper
{code:java}
org.picketlink.idm.spi.model IdentityObjectType
org.picketlink.idm.impl.api.session.mapper.IdentityObjectTypeMapperImpl.getIdentityObjectType(String
groupType)
{code}
Which matches the given groupType against a Map representing the existing group types. If
no match is found, it returns null.
After that, PersistenceManagerImpl has the following line:
{code:java}
IdentityObject identityObject =
getRepository().createIdentityObject(getInvocationContext(), groupName, iot);
{code}
with a nul "iot" parameter.
What I find weird is that the following line in JpaIdentityStore:
{code:java}
typeProp.setValue(identityInstance, identityObjectType.getName());
{code}
doesn't throw a NullPointerException.
Discrepancies in User and Group management API in Seam Security 3
-----------------------------------------------------------------
Key: SEAMSECURITY-108
URL: https://issues.jboss.org/browse/SEAMSECURITY-108
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta3
Environment: Seam 3.1.0.Beta2
JBoss AS 7
idmconsole
Reporter: Luca Cavagnoli
Assignee: Shane Bryzak
Priority: Minor
Labels: idmconsole, picketlink, seam-security
The method:
{code:java}
Group groupName = pm.createGroup("Group name", "Group type");
{code}
just adds a row in IdentityObject with the following values:
{code:sql}
('Group name', SELECT id FROM IdentityObjectType WHERE name = 'Group
type')
{code}
if IdentityObjectType doesn't already have a row with name = "Group type",
the IDENTITY_OBJECT_TYPE_ID in the new IdentityObject row is set to null, instead of
adding a new row in IdentityObjectType for the new group type.
The method
{code:java}
PersistenceManager.createGroup(String groupName, String groupType)
{code}
can also be abused by creating a group with 'USER' as groupType, despite
'USER' was the identity object type chosen to represent users, not groups.
The method
{code:java}
Collection<Group> PersistenceManager.findGroup(String groupType)
{code}
performs no check about the groupType parameter. One could invoke it as follows:
{code:java}
findGroup("USER")
{code}
and the result would be a list of groups which are actually users.
'USER' should be excluded from the list of types that are searched for.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:50 p.m.
New subject: [JBoss JIRA] (SEAMSECURITY-108) Discrepancies in User and Group management API in Seam Security 3
[
https://issues.jboss.org/browse/SEAMSECURITY-108?page=com.atlassian.jira....
]
Luca Cavagnoli edited comment on SEAMSECURITY-108 at 10/5/11 7:49 PM:
----------------------------------------------------------------------
I explored the source code and I found this:
The method
{code:java}
org.picketlink.idm.api Group
org.picketlink.idm.impl.api.session.managers.PersistenceManagerImpl.createGroup(String
groupName, String groupType)
{code}
tries to find the Identity Object Type "groupType" with the following
instruction:
{code:java}
IdentityObjectType iot = getIdentityObjectType(groupType);
{code}
Which causes a call to:
org.picketlink.idm.impl.api.session.mapper
{code:java}
org.picketlink.idm.spi.model IdentityObjectType
org.picketlink.idm.impl.api.session.mapper.IdentityObjectTypeMapperImpl.getIdentityObjectType(String
groupType)
{code}
Which matches the given groupType against a Map representing the existing group types. If
no match is found, it returns null.
After that, PersistenceManagerImpl has the following line:
{code:java}
IdentityObject identityObject =
getRepository().createIdentityObject(getInvocationContext(), groupName, iot);
{code}
with a nul "iot" parameter.
What I find weird is that the following line in JpaIdentityStore:
{code:java}
typeProp.setValue(identityInstance, identityObjectType.getName());
{code}
doesn't throw a NullPointerException.
was (Author: lucaster):
I explored the source code and I found this:
The method
{code:java}
org.picketlink.idm.api Group
org.picketlink.idm.impl.api.session.managers.PersistenceManagerImpl.createGroup(String
groupName, String groupType)
{code}
tries to find the Identity Object Type "groupType" with the following
instruction:
{code:java}
IdentityObjectType iot = getIdentityObjectType(groupType)
{code}
Which causes a call to:
org.picketlink.idm.impl.api.session.mapper
{code:java}
org.picketlink.idm.spi.model IdentityObjectType
org.picketlink.idm.impl.api.session.mapper.IdentityObjectTypeMapperImpl.getIdentityObjectType(String
groupType)
{code}
Which matches the given groupType against a Map representing the existing group types. If
no match is found, it returns null.
After that, PersistenceManagerImpl has the following line:
{code:java}
IdentityObject identityObject =
getRepository().createIdentityObject(getInvocationContext(), groupName, iot);
{code}
with a nul "iot" parameter.
What I find weird is that the following line in JpaIdentityStore:
{code:java}
typeProp.setValue(identityInstance, identityObjectType.getName());
{code}
doesn't throw a NullPointerException.
Discrepancies in User and Group management API in Seam Security 3
-----------------------------------------------------------------
Key: SEAMSECURITY-108
URL: https://issues.jboss.org/browse/SEAMSECURITY-108
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta3
Environment: Seam 3.1.0.Beta2
JBoss AS 7
idmconsole
Reporter: Luca Cavagnoli
Assignee: Shane Bryzak
Priority: Minor
Labels: idmconsole, picketlink, seam-security
The method:
{code:java}
Group groupName = pm.createGroup("Group name", "Group type");
{code}
just adds a row in IdentityObject with the following values:
{code:sql}
('Group name', SELECT id FROM IdentityObjectType WHERE name = 'Group
type')
{code}
if IdentityObjectType doesn't already have a row with name = "Group type",
the IDENTITY_OBJECT_TYPE_ID in the new IdentityObject row is set to null, instead of
adding a new row in IdentityObjectType for the new group type.
The method
{code:java}
PersistenceManager.createGroup(String groupName, String groupType)
{code}
can also be abused by creating a group with 'USER' as groupType, despite
'USER' was the identity object type chosen to represent users, not groups.
The method
{code:java}
Collection<Group> PersistenceManager.findGroup(String groupType)
{code}
performs no check about the groupType parameter. One could invoke it as follows:
{code:java}
findGroup("USER")
{code}
and the result would be a list of groups which are actually users.
'USER' should be excluded from the list of types that are searched for.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:52 p.m.
New subject: [JBoss JIRA] (SEAMSECURITY-108) Discrepancies in User and Group management API in Seam Security 3
[
https://issues.jboss.org/browse/SEAMSECURITY-108?page=com.atlassian.jira....
]
Luca Cavagnoli edited comment on SEAMSECURITY-108 at 10/5/11 7:50 PM:
----------------------------------------------------------------------
I explored the source code and I found this:
The method
{code:java}
org.picketlink.idm.api Group
org.picketlink.idm.impl.api.session.managers.PersistenceManagerImpl.createGroup(String
groupName, String groupType)
{code}
tries to find the Identity Object Type "groupType" with the following
instruction:
{code:java}
IdentityObjectType iot = getIdentityObjectType(groupType);
{code}
Which causes a call to:
{code:java}
org.picketlink.idm.spi.model IdentityObjectType
org.picketlink.idm.impl.api.session.mapper.IdentityObjectTypeMapperImpl.getIdentityObjectType(String
groupType)
{code}
Which matches the given groupType against a Map representing the existing group types. If
no match is found, it returns null.
After that, PersistenceManagerImpl has the following line:
{code:java}
IdentityObject identityObject =
getRepository().createIdentityObject(getInvocationContext(), groupName, iot);
{code}
with a null "iot" parameter.
What I find weird is that the following line in JpaIdentityStore:
{code:java}
typeProp.setValue(identityInstance, identityObjectType.getName());
{code}
doesn't throw a NullPointerException.
was (Author: lucaster):
I explored the source code and I found this:
The method
{code:java}
org.picketlink.idm.api Group
org.picketlink.idm.impl.api.session.managers.PersistenceManagerImpl.createGroup(String
groupName, String groupType)
{code}
tries to find the Identity Object Type "groupType" with the following
instruction:
{code:java}
IdentityObjectType iot = getIdentityObjectType(groupType);
{code}
Which causes a call to:
{code:java}
org.picketlink.idm.spi.model IdentityObjectType
org.picketlink.idm.impl.api.session.mapper.IdentityObjectTypeMapperImpl.getIdentityObjectType(String
groupType)
{code}
Which matches the given groupType against a Map representing the existing group types. If
no match is found, it returns null.
After that, PersistenceManagerImpl has the following line:
{code:java}
IdentityObject identityObject =
getRepository().createIdentityObject(getInvocationContext(), groupName, iot);
{code}
with a nul "iot" parameter.
What I find weird is that the following line in JpaIdentityStore:
{code:java}
typeProp.setValue(identityInstance, identityObjectType.getName());
{code}
doesn't throw a NullPointerException.
Discrepancies in User and Group management API in Seam Security 3
-----------------------------------------------------------------
Key: SEAMSECURITY-108
URL: https://issues.jboss.org/browse/SEAMSECURITY-108
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta3
Environment: Seam 3.1.0.Beta2
JBoss AS 7
idmconsole
Reporter: Luca Cavagnoli
Assignee: Shane Bryzak
Priority: Minor
Labels: idmconsole, picketlink, seam-security
The method:
{code:java}
Group groupName = pm.createGroup("Group name", "Group type");
{code}
just adds a row in IdentityObject with the following values:
{code:sql}
('Group name', SELECT id FROM IdentityObjectType WHERE name = 'Group
type')
{code}
if IdentityObjectType doesn't already have a row with name = "Group type",
the IDENTITY_OBJECT_TYPE_ID in the new IdentityObject row is set to null, instead of
adding a new row in IdentityObjectType for the new group type.
The method
{code:java}
PersistenceManager.createGroup(String groupName, String groupType)
{code}
can also be abused by creating a group with 'USER' as groupType, despite
'USER' was the identity object type chosen to represent users, not groups.
The method
{code:java}
Collection<Group> PersistenceManager.findGroup(String groupType)
{code}
performs no check about the groupType parameter. One could invoke it as follows:
{code:java}
findGroup("USER")
{code}
and the result would be a list of groups which are actually users.
'USER' should be excluded from the list of types that are searched for.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:52 p.m.
New subject: [JBoss JIRA] (SEAMSECURITY-108) Discrepancies in User and Group management API in Seam Security 3
[
https://issues.jboss.org/browse/SEAMSECURITY-108?page=com.atlassian.jira....
]
Luca Cavagnoli edited comment on SEAMSECURITY-108 at 10/5/11 7:50 PM:
----------------------------------------------------------------------
I explored the source code and I found this:
The method
{code:java}
org.picketlink.idm.api Group
org.picketlink.idm.impl.api.session.managers.PersistenceManagerImpl.createGroup(String
groupName, String groupType)
{code}
tries to find the Identity Object Type "groupType" with the following
instruction:
{code:java}
IdentityObjectType iot = getIdentityObjectType(groupType);
{code}
Which causes a call to:
{code:java}
org.picketlink.idm.spi.model IdentityObjectType
org.picketlink.idm.impl.api.session.mapper.IdentityObjectTypeMapperImpl.getIdentityObjectType(String
groupType)
{code}
Which matches the given groupType against a Map representing the existing group types. If
no match is found, it returns null.
After that, PersistenceManagerImpl has the following line:
{code:java}
IdentityObject identityObject =
getRepository().createIdentityObject(getInvocationContext(), groupName, iot);
{code}
with a nul "iot" parameter.
What I find weird is that the following line in JpaIdentityStore:
{code:java}
typeProp.setValue(identityInstance, identityObjectType.getName());
{code}
doesn't throw a NullPointerException.
was (Author: lucaster):
I explored the source code and I found this:
The method
{code:java}
org.picketlink.idm.api Group
org.picketlink.idm.impl.api.session.managers.PersistenceManagerImpl.createGroup(String
groupName, String groupType)
{code}
tries to find the Identity Object Type "groupType" with the following
instruction:
{code:java}
IdentityObjectType iot = getIdentityObjectType(groupType);
{code}
Which causes a call to:
org.picketlink.idm.impl.api.session.mapper
{code:java}
org.picketlink.idm.spi.model IdentityObjectType
org.picketlink.idm.impl.api.session.mapper.IdentityObjectTypeMapperImpl.getIdentityObjectType(String
groupType)
{code}
Which matches the given groupType against a Map representing the existing group types. If
no match is found, it returns null.
After that, PersistenceManagerImpl has the following line:
{code:java}
IdentityObject identityObject =
getRepository().createIdentityObject(getInvocationContext(), groupName, iot);
{code}
with a nul "iot" parameter.
What I find weird is that the following line in JpaIdentityStore:
{code:java}
typeProp.setValue(identityInstance, identityObjectType.getName());
{code}
doesn't throw a NullPointerException.
Discrepancies in User and Group management API in Seam Security 3
-----------------------------------------------------------------
Key: SEAMSECURITY-108
URL: https://issues.jboss.org/browse/SEAMSECURITY-108
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta3
Environment: Seam 3.1.0.Beta2
JBoss AS 7
idmconsole
Reporter: Luca Cavagnoli
Assignee: Shane Bryzak
Priority: Minor
Labels: idmconsole, picketlink, seam-security
The method:
{code:java}
Group groupName = pm.createGroup("Group name", "Group type");
{code}
just adds a row in IdentityObject with the following values:
{code:sql}
('Group name', SELECT id FROM IdentityObjectType WHERE name = 'Group
type')
{code}
if IdentityObjectType doesn't already have a row with name = "Group type",
the IDENTITY_OBJECT_TYPE_ID in the new IdentityObject row is set to null, instead of
adding a new row in IdentityObjectType for the new group type.
The method
{code:java}
PersistenceManager.createGroup(String groupName, String groupType)
{code}
can also be abused by creating a group with 'USER' as groupType, despite
'USER' was the identity object type chosen to represent users, not groups.
The method
{code:java}
Collection<Group> PersistenceManager.findGroup(String groupType)
{code}
performs no check about the groupType parameter. One could invoke it as follows:
{code:java}
findGroup("USER")
{code}
and the result would be a list of groups which are actually users.
'USER' should be excluded from the list of types that are searched for.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
4845
days inactive
4845
days old
12 comments
6 participants
participants (6)
-
Luca Cavagnoli (Commented) (JIRA) -
Luca Cavagnoli (Created) (JIRA)
-
Luca Cavagnoli (Issue Comment Edited) (JIRA)
-
Luca Cavagnoli (Updated) (JIRA)
-
Shane Bryzak (Assigned) (JIRA)
-
Shane Bryzak (Moved) (JIRA)