[jboss-jira] [JBoss JIRA] Created: (JBAS-7405) use-caller-identity should be default if no explicit security-identity is set in

Mon Oct 26 18:32:05 EDT 2009

use-caller-identity should be default if no explicit security-identity is set in 
---------------------------------------------------------------------------------

                 Key: JBAS-7405
                 URL: https://jira.jboss.org/jira/browse/JBAS-7405
             Project: JBoss Application Server
          Issue Type: Bug
      Security Level: Public (Everyone can see)
          Components: EJB2
    Affects Versions: JBossAS-5.1.0.GA
            Reporter: Sverker Abrahamsson
            Assignee: Alexey Loubyansky

According to 
http://www.redhat.com/docs/manuals/jboss/jboss-eap-4.2/doc/Server_Configuration_Guide/J2EE_Declarative_Security_Overview-Security_Identity.html if no explicit security-identity is set in ejb-jar on a bean, then propagation of the caller identity should be the default. 

That is not currently the case, if no security-identity is set then useCallerIdentity remains false. I believe the bug is in org.jboss.ejb.plugins.SecurityInterceptor#setContainer and that adding the follwing at line 160 (on the JBossAS 5.1.0.GA version) should solve the problem:

         if (secMetaData == null)
            this.isUseCallerIdentity = true;

Could be that this bug was introduced with the fix for JBAS-5011, for some reason I can't get fisheye to work right now to check it out.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira