[jboss-jira] [JBoss JIRA] Commented: (JBAS-3595) Tomcat allows http access with transport guarantie CONFIDENTIAL

[Anil Saldhana (JIRA)]

    [ http://jira.jboss.com/jira/browse/JBAS-3595?page=comments#action_12390534 ] 
            
Anil Saldhana commented on JBAS-3595:
-------------------------------------

I merged the JBossSecurityMgrRealm and JaccAuthorizationRealm into one JBossWebRealm such that the authorization aspects are plugged in via authorization modules (just like PAM).

I have a bug in hasUserDataPermission such that the authorizationMgr returns true by default (such that the decision of the RealmBase is final).  Since ok=true, the realmbase was never consulted.

The correct logic is as in hasResourcePermission wherein authorizationdecisions can be done by the authorization framework (eg. Jacc logic).

I will fix it.

> Tomcat allows http access with transport guarantie CONFIDENTIAL
> ---------------------------------------------------------------
>
>                 Key: JBAS-3595
>                 URL: http://jira.jboss.com/jira/browse/JBAS-3595
>             Project: JBoss Application Server
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) 
>            Reporter: Thomas Diesler
>         Assigned To: Anil Saldhana
>             Fix For:  JBossAS-5.0.0.Beta3
>
>         Attachments: test.war
>
>
> The generated web.xml contains CONFIDENTIAL. Access via http:// should be denied.
> This woks in Branch_4_0
> /home/tdiesler/svn/jbossws/trunk/src/test
> [tdiesler at tdvaio test]$ ant -Dtest=org.jboss.test.ws.samples.secureejb.SecureEJBTestCase one-test
> one-test:
>     [junit] Running org.jboss.test.ws.samples.secureejb.SecureEJBTestCase
>     [junit] Tests run: 5, Failures: 1, Errors: 0, Time elapsed: 5.452 sec
>     [junit] Test org.jboss.test.ws.samples.secureejb.SecureEJBTestCase FAILED

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira