[jboss-cvs] JBossAS SVN: r62679 - trunk/server/src/main/org/jboss/ejb.

[jboss-cvs-commits at lists.jboss.org]

Author: anil.saldhana at jboss.com
Date: 2007-05-01 00:22:55 -0400 (Tue, 01 May 2007)
New Revision: 62679

Modified:
   trunk/server/src/main/org/jboss/ejb/EnterpriseContext.java
Log:
do not do isCallerInRoleCheck if subject is null

Modified: trunk/server/src/main/org/jboss/ejb/EnterpriseContext.java
===================================================================
--- trunk/server/src/main/org/jboss/ejb/EnterpriseContext.java	2007-05-01 04:22:17 UTC (rev 62678)
+++ trunk/server/src/main/org/jboss/ejb/EnterpriseContext.java	2007-05-01 04:22:55 UTC (rev 62679)
@@ -38,6 +38,7 @@
 import javax.ejb.TimerService;
 import javax.naming.InitialContext;
 import javax.naming.NamingException;
+import javax.security.auth.Subject;
 import javax.security.jacc.PolicyContextException;
 import javax.transaction.HeuristicMixedException;
 import javax.transaction.HeuristicRollbackException;
@@ -546,15 +547,13 @@
             securityRoleRefs.add(new SecurityRoleRef(meta.getName(), meta.getLink(),meta.getDescription()));
          } 
          final HashMap map =  new HashMap();
-         map.put(ResourceKeys.EJB_NAME ,getContainer().getBeanMetaData().getEjbName()); 
-         map.put(ResourceKeys.EJB_PRINCIPAL, principal); 
-         map.put(ResourceKeys.AUTHORIZATION_MANAGER,authzManager); 
-         map.put(ResourceKeys.RUNASIDENTITY, runAsIdentity);
-         map.put(ResourceKeys.SECURITY_ROLE_REFERENCES, securityRoleRefs);
-         map.put(ResourceKeys.ROLENAME, roleName);
-         map.put(ResourceKeys.ROLEREF_PERM_CHECK, Boolean.TRUE);
+         //Get the context subject
+         Subject contextSubject = null;
          try
          {
+            contextSubject = SecurityActions.getContextSubject();
+            if(contextSubject == null)
+               log.error("Subject is null for isCallerInRole Check with role="+roleName);
             map.put(ResourceKeys.CALLER_SUBJECT, SecurityActions.getContextSubject());
          }
          catch (PolicyContextException pe)
@@ -562,22 +561,34 @@
            if(log.isTraceEnabled())
               log.trace("PolicyContextException in getting caller subject:",pe);
          }
-         EJBResource ejbResource = new EJBResource(map);
+
          boolean isAuthorized = false;
-         try
-         {
-            int check = authzManager.authorize(ejbResource);
-            isAuthorized = (check == AuthorizationContext.PERMIT);
-         } 
-         catch (Exception e)
-         {
-            isAuthorized = false;
-            if(log.isTraceEnabled()) 
-               log.trace(roleName + "::isCallerInRole check failed:"+e.getLocalizedMessage());
-            if(securityContext != null )
-            { 
-               securityContext.getAuditManager().audit(new AuditEvent(AuditLevel.FAILURE, map, e));
-            }
+         if(contextSubject != null)
+         { 
+            map.put(ResourceKeys.EJB_NAME ,getContainer().getBeanMetaData().getEjbName()); 
+            map.put(ResourceKeys.EJB_PRINCIPAL, principal); 
+            map.put(ResourceKeys.AUTHORIZATION_MANAGER,authzManager); 
+            map.put(ResourceKeys.RUNASIDENTITY, runAsIdentity);
+            map.put(ResourceKeys.SECURITY_ROLE_REFERENCES, securityRoleRefs);
+            map.put(ResourceKeys.ROLENAME, roleName);
+            map.put(ResourceKeys.ROLEREF_PERM_CHECK, Boolean.TRUE);
+             
+            EJBResource ejbResource = new EJBResource(map);
+            try
+            {
+               int check = authzManager.authorize(ejbResource);
+               isAuthorized = (check == AuthorizationContext.PERMIT);
+            } 
+            catch (Exception e)
+            {
+               isAuthorized = false;
+               if(log.isTraceEnabled()) 
+                  log.trace(roleName + "::isCallerInRole check failed:"+e.getLocalizedMessage());
+               if(securityContext != null )
+               { 
+                  securityContext.getAuditManager().audit(new AuditEvent(AuditLevel.FAILURE, map, e));
+               }
+            } 
          }
          return isAuthorized;
       }