[jboss-jira] [JBoss JIRA] Commented: (JBAS-8600) An EJB invocation with runas-identity causes that runas-identity to be used for all invocations of that EJB

[Magnus Grimsell (JIRA)]

    [ https://jira.jboss.org/browse/JBAS-8600?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12565936#comment-12565936 ] 

Magnus Grimsell commented on JBAS-8600:
---------------------------------------

We need this bug fix for JBoss 5.1. Are there any plans for a JBoss 5.1.1?

> An EJB invocation with runas-identity causes that runas-identity to be used for all invocations of that EJB
> -----------------------------------------------------------------------------------------------------------
>
>                 Key: JBAS-8600
>                 URL: https://jira.jboss.org/browse/JBAS-8600
>             Project: JBoss Application Server
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) 
>          Components: EJB2
>    Affects Versions: JBossAS-5.1.0.GA
>            Reporter: Magnus Lind
>            Assignee: Marcus Moyses
>             Fix For: 6.0.0.Final
>
>
> If a context associated with a runas-identity invokes a method on a (non-runas deployed) stateless session EJB then subsequent invocations from any authenticated context will be performed as if the EJB was runas-deployed using that identity.
> Only a restart of the application server will help.
> A runas-identity context is usually established within invocations of Servlets or EJBs with runas-deployment. All non-runas deployed EJBs invoked from such a servlet, EJB (or MDB) will be affected.
> This behavior is probably caused by a bug in org.jboss.ejb.plugins.SecurityInterceptor. The following patch solves the problem for us:
> Index: org/jboss/ejb/plugins/SecurityInterceptor.java
> ===================================================================
> --- org/jboss/ejb/plugins/SecurityInterceptor.java	(revision 109035)
> +++ org/jboss/ejb/plugins/SecurityInterceptor.java	(arbetskopia)
> @@ -248,18 +248,19 @@
>           throw e;
>        }
>  
> +      RunAs runAsIdentityToPush = runAsIdentity;
>        /**
>         * Special case: if <use-caller-identity> configured and
>         * the caller is arriving with a run-as, we need to push that run-as
>         */
>        if (callerRunAsIdentity != null && this.isUseCallerIdentity)
> -         this.runAsIdentity = callerRunAsIdentity;
> +         runAsIdentityToPush = callerRunAsIdentity;
>  
>        /* If a run-as role was specified, push it so that any calls made
>         by this bean will have the runAsRole available for declarative
>         security checks.
>        */
> -      SecurityActions.pushRunAsIdentity(runAsIdentity);
> +      SecurityActions.pushRunAsIdentity(runAsIdentityToPush);
>  
>        try
>        {

-- 
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira