[Jboss-cvs] JBossAS SVN: r55348 - in branches/JBoss_4_0_3_SP1_CP/tomcat/src/main/org/jboss/web/tomcat: security tc5
jboss-cvs-commits at lists.jboss.org
jboss-cvs-commits at lists.jboss.org
Sat Aug 5 12:47:06 EDT 2006
Author: ryan.campbell at jboss.com
Date: 2006-08-05 12:47:05 -0400 (Sat, 05 Aug 2006)
New Revision: 55348
Added:
branches/JBoss_4_0_3_SP1_CP/tomcat/src/main/org/jboss/web/tomcat/security/DoaminPrincipalKey.java
Modified:
branches/JBoss_4_0_3_SP1_CP/tomcat/src/main/org/jboss/web/tomcat/security/JBossSecurityMgrRealm.java
branches/JBoss_4_0_3_SP1_CP/tomcat/src/main/org/jboss/web/tomcat/security/JaccContextValve.java
branches/JBoss_4_0_3_SP1_CP/tomcat/src/main/org/jboss/web/tomcat/tc5/TomcatDeployer.java
Log:
merge JBAS-3045: Security patch for isUserInRole(String) for same principal name
Copied: branches/JBoss_4_0_3_SP1_CP/tomcat/src/main/org/jboss/web/tomcat/security/DoaminPrincipalKey.java (from rev 55347, branches/JBoss_4_0_3_SP1_JBAS-3045/tomcat/src/main/org/jboss/web/tomcat/security/DoaminPrincipalKey.java)
Modified: branches/JBoss_4_0_3_SP1_CP/tomcat/src/main/org/jboss/web/tomcat/security/JBossSecurityMgrRealm.java
===================================================================
--- branches/JBoss_4_0_3_SP1_CP/tomcat/src/main/org/jboss/web/tomcat/security/JBossSecurityMgrRealm.java 2006-08-05 16:31:20 UTC (rev 55347)
+++ branches/JBoss_4_0_3_SP1_CP/tomcat/src/main/org/jboss/web/tomcat/security/JBossSecurityMgrRealm.java 2006-08-05 16:47:05 UTC (rev 55348)
@@ -54,7 +54,7 @@
*/
private CertificatePrincipal certMapping = new SubjectDNMapping();
/**
- * ConcurrentReaderHashMap<UserPrincipal, GenericPrincipal> used to handle the
+ * ConcurrentReaderHashMap<DomainPrincipalKey, GenericPrincipal> used to handle the
* HttpServletRequest.isUserInRole when the request principal has been
* overwritten by the CustomPrincipalValve
*/
@@ -161,8 +161,8 @@
+ "to: " + principal);
}
// Get the caching principal
- principal = getCachingPrincpal(realmMapping, oldPrincipal,
- principal, certs, subject);
+ principal = getCachingPrincpal(securityMgr.getSecurityDomain(),
+ realmMapping, oldPrincipal, principal, certs, subject);
}
else
{
@@ -241,8 +241,8 @@
+ "to: " + principal);
}
// Get the caching principal
- principal = getCachingPrincpal(realmMapping, oldPrincipal,
- principal, credentials, subject);
+ principal = getCachingPrincpal(securityMgr.getSecurityDomain(),
+ realmMapping, oldPrincipal, principal, credentials, subject);
}
else
{
@@ -282,7 +282,9 @@
{
return super.hasRole(principal, role);
}
- JBossGenericPrincipal gp = (JBossGenericPrincipal) roleMap.get(principal);
+ String securityDomain = (String) JaccContextValve.activeSecurityDomain.get();
+ DoaminPrincipalKey key = new DoaminPrincipalKey(principal, securityDomain);
+ JBossGenericPrincipal gp = (JBossGenericPrincipal) roleMap.get(key);
Set userRoles = gp.getUserRoles();
if( userRoles != null )
{
@@ -345,7 +347,9 @@
*/
protected Set getPrincipalRoles(Principal principal)
{
- JBossGenericPrincipal gp = (JBossGenericPrincipal) roleMap.get(principal);
+ String securityDomain = (String) JaccContextValve.activeSecurityDomain.get();
+ DoaminPrincipalKey key = new DoaminPrincipalKey(principal, securityDomain);
+ JBossGenericPrincipal gp = (JBossGenericPrincipal) roleMap.get(key);
Set userRoles = gp.getUserRoles();
return userRoles;
}
@@ -360,7 +364,8 @@
* @param credential - the credential used for authentication
* @return the tomcat session principal wrapper
*/
- protected Principal getCachingPrincpal(RealmMapping realmMapping,
+ protected Principal getCachingPrincpal(String securityDomain,
+ RealmMapping realmMapping,
Principal authPrincipal, Principal callerPrincipal, Object credential,
Subject subject)
{
@@ -379,7 +384,8 @@
JBossGenericPrincipal gp = new JBossGenericPrincipal(this, subject,
authPrincipal, callerPrincipal, credential, roles, userRoles);
// Cache the roles under the caller principal for isUserInRole calls
- roleMap.put(callerPrincipal, gp);
+ DoaminPrincipalKey key = new DoaminPrincipalKey(callerPrincipal, securityDomain);
+ roleMap.put(key, gp);
return gp;
}
}
Modified: branches/JBoss_4_0_3_SP1_CP/tomcat/src/main/org/jboss/web/tomcat/security/JaccContextValve.java
===================================================================
--- branches/JBoss_4_0_3_SP1_CP/tomcat/src/main/org/jboss/web/tomcat/security/JaccContextValve.java 2006-08-05 16:31:20 UTC (rev 55347)
+++ branches/JBoss_4_0_3_SP1_CP/tomcat/src/main/org/jboss/web/tomcat/security/JaccContextValve.java 2006-08-05 16:47:05 UTC (rev 55348)
@@ -16,6 +16,7 @@
import org.apache.catalina.connector.Response;
import org.apache.catalina.valves.ValveBase;
import org.jboss.logging.Logger;
+import org.jboss.metadata.WebMetaData;
/**
* A Valve that sets the JACC context id and HttpServletRequest policy
@@ -28,17 +29,29 @@
public class JaccContextValve extends ValveBase
{
private static Logger log = Logger.getLogger(JaccContextValve.class);
+ /** ThreadLocal<CodeSource> for the war CodeSource */
public static ThreadLocal activeCS = new ThreadLocal();
+ /** ThreadLocal<String> for the war security-domain */
+ public static ThreadLocal activeSecurityDomain = new ThreadLocal();
- /** The web app metadata */
+ /** The web app JACC context name */
private String contextID;
+ /** The web app security-domain name */
+ private String securityDomain;
/** The web app deployment code source */
private CodeSource warCS;
private boolean trace;
- public JaccContextValve(String contextID, CodeSource cs)
+ public JaccContextValve(WebMetaData metaData, CodeSource cs)
{
- this.contextID = contextID;
+ this.contextID = metaData.getJaccContextID();
+ this.securityDomain = metaData.getSecurityDomain();
+ if( securityDomain != null )
+ {
+ int slash = securityDomain.lastIndexOf('/');
+ if( slash >= 0 )
+ securityDomain = securityDomain.substring(slash+1);
+ }
this.warCS = cs;
this.trace = log.isTraceEnabled();
}
@@ -53,6 +66,8 @@
{
// Set the JACC context id
PolicyContext.setContextID(contextID);
+ // Set the security domain
+ activeSecurityDomain.set(securityDomain);
// Set the JACC HttpServletRequest PolicyContextHandler data
HttpServletRequestPolicyContextHandler.setRequest(httpRequest);
// Perform the request
@@ -62,6 +77,7 @@
{
SecurityAssociationActions.clear();
activeCS.set(null);
+ activeSecurityDomain.set(null);
}
}
Modified: branches/JBoss_4_0_3_SP1_CP/tomcat/src/main/org/jboss/web/tomcat/tc5/TomcatDeployer.java
===================================================================
--- branches/JBoss_4_0_3_SP1_CP/tomcat/src/main/org/jboss/web/tomcat/tc5/TomcatDeployer.java 2006-08-05 16:31:20 UTC (rev 55347)
+++ branches/JBoss_4_0_3_SP1_CP/tomcat/src/main/org/jboss/web/tomcat/tc5/TomcatDeployer.java 2006-08-05 16:47:05 UTC (rev 55348)
@@ -267,7 +267,7 @@
// Add a valve to estalish the JACC context before authorization valves
Certificate[] certs = null;
CodeSource cs = new CodeSource(url, certs);
- JaccContextValve jaccValve = new JaccContextValve(metaData.getJaccContextID(), cs);
+ JaccContextValve jaccValve = new JaccContextValve(metaData, cs);
server.invoke(objectName, "addValve",
new Object[]{jaccValve},
new String[]{"org.apache.catalina.Valve"});
More information about the jboss-cvs-commits
mailing list