[jboss-jira] [JBoss JIRA] Created: (JBAS-7171) InvokerAdaptorService overwrites existing SecurityContext and clears it after invocation

[Anil Saldhana (JIRA)]

InvokerAdaptorService overwrites existing SecurityContext and clears it after invocation
----------------------------------------------------------------------------------------

                 Key: JBAS-7171
                 URL: https://jira.jboss.org/jira/browse/JBAS-7171
             Project: JBoss Application Server
          Issue Type: Bug
      Security Level: Public (Everyone can see)
          Components: Security
    Affects Versions: JBossAS-5.0.0.GA
         Environment: Windows Vista, JBoss 5.0.0 GA
            Reporter: Anil Saldhana
            Assignee: Anil Saldhana
             Fix For: JBossAS-5.2.0.Beta1


The InvokerAdaptorService always creates a new SecurityContext even if there is already one created by components called earlier in invocation stack. After invoking the desired MBean method the SecurityContext will be cleared with a call to: SecurityActions.clearSecurityContext();
This leads to several problems:
In our project we have a secured EJB (annotated with @SecurityDomain) which is calling an MBean Service and a local (secured) EJB. After the invocation of the mbean there is no security context anymore which leads to an IllegalStateException "Security Context has not been set" thrown by RoleBasedAuthorizationInterceptorv2) when we try to call the local EJB.
Following steps are possible to fix the problem:
1. call to SecurityActions.getSecurityContext();
2. if there is currently no SecurityContext create a new one and set it.
3. if there already is a SecurityContext set, do nothing.
4. call the mbean method.
5. only if we created the SecurityContext, we should clear it with SecurityActions.clearSecurityContext(), otherwise, do nothing.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira