[jboss-cvs] JBossAS SVN: r112600 - in branches/JBPAPP_5_1_2_GA_JBPAPP-7896/server/src/main/org/jboss/ejb/plugins: security and 1 other directory.

[jboss-cvs-commits at lists.jboss.org]

Author: dehort
Date: 2012-01-31 16:03:56 -0500 (Tue, 31 Jan 2012)
New Revision: 112600

Modified:
   branches/JBPAPP_5_1_2_GA_JBPAPP-7896/server/src/main/org/jboss/ejb/plugins/SecurityInterceptor.java
   branches/JBPAPP_5_1_2_GA_JBPAPP-7896/server/src/main/org/jboss/ejb/plugins/security/PreSecurityInterceptor.java
Log:
Fixing a bug where the SecurityInterceptor can remove the run-as identity
[JBPAPP-7896]


Modified: branches/JBPAPP_5_1_2_GA_JBPAPP-7896/server/src/main/org/jboss/ejb/plugins/SecurityInterceptor.java
===================================================================
--- branches/JBPAPP_5_1_2_GA_JBPAPP-7896/server/src/main/org/jboss/ejb/plugins/SecurityInterceptor.java	2012-01-31 20:44:19 UTC (rev 112599)
+++ branches/JBPAPP_5_1_2_GA_JBPAPP-7896/server/src/main/org/jboss/ejb/plugins/SecurityInterceptor.java	2012-01-31 21:03:56 UTC (rev 112600)
@@ -222,12 +222,26 @@
    {
       if (this.shouldBypassSecurity(mi))
       {
+         RunAs previous_runas = SecurityActions.peekRunAsIdentity();
+         System.out.println("*** previous_runas = " + previous_runas);
+
          if (log.isTraceEnabled())
             log.trace("Bypass security for invoke or invokeHome");
-         if (isInvoke)
-            return getNext().invoke(mi);
-         else
-            return getNext().invokeHome(mi);
+         try
+         {
+           if (isInvoke)
+             return getNext().invoke(mi);
+           else
+             return getNext().invokeHome(mi);
+         }
+         finally
+         {
+            if( previous_runas != null) {
+              System.out.println("*** previous_runas = " + previous_runas);
+              SecurityActions.pushRunAsIdentity(previous_runas);
+            }
+         }
+
       }
 
       SecurityContext sc = SecurityActions.getSecurityContext();
@@ -378,10 +392,15 @@
       boolean containerMethod = m == null || m.equals(ejbTimeout);
       if (containerMethod == true || securityManager == null || container == null)
       {
+         RunAs previous_runas = SecurityActions.peekRunAsIdentity();
+         System.out.println("*** previous_runas = " + previous_runas);
+
          // Allow for the propagation of caller info to other beans
          SecurityActions.createAndSetSecurityContext(mi.getPrincipal(), mi.getCredential(), "BYPASSED-SECURITY");
          if (this.runAsIdentity != null)
             SecurityActions.pushRunAsIdentity(runAsIdentity);
+         else if( previous_runas != null )
+            SecurityActions.pushRunAsIdentity(previous_runas);
          return true;
       }
       return false;
@@ -392,4 +411,4 @@
       RunAs incomingRunAs = sc.getIncomingRunAs();
       return incomingRunAs != null && incomingRunAs instanceof RunAsIdentity;
    }
-}
\ No newline at end of file
+}

Modified: branches/JBPAPP_5_1_2_GA_JBPAPP-7896/server/src/main/org/jboss/ejb/plugins/security/PreSecurityInterceptor.java
===================================================================
--- branches/JBPAPP_5_1_2_GA_JBPAPP-7896/server/src/main/org/jboss/ejb/plugins/security/PreSecurityInterceptor.java	2012-01-31 20:44:19 UTC (rev 112599)
+++ branches/JBPAPP_5_1_2_GA_JBPAPP-7896/server/src/main/org/jboss/ejb/plugins/security/PreSecurityInterceptor.java	2012-01-31 21:03:56 UTC (rev 112600)
@@ -96,10 +96,26 @@
       //No Security in the absence of SecurityDomain
       if(securityDomain == null)
       {
+         SecurityContext previous_sc = SecurityActions.getSecurityContext();
+         System.out.println("*** previous_sc = " + previous_sc);
+         System.out.println("*** previous_sc.getOutgointRunAs() = " + previous_sc.getOutgoingRunAs());
+         try
+         {
          if(isInvoke)
             return getNext().invoke(mi);
          else
             return getNext().invokeHome(mi);
+         }
+         finally
+         {
+         SecurityContext current_sc = SecurityActions.getSecurityContext();
+         System.out.println("*** current_sc = " + current_sc);
+         System.out.println("*** current_sc.getOutgointRunAs() = " + current_sc.getOutgoingRunAs());
+
+//         System.out.println("*** resetting security context");
+//         SecurityActions.setSecurityContext(previous_sc);
+         }
+
       }   
 
       if (log.isTraceEnabled())