[jboss-jira] [JBoss JIRA] (WFLY-981) @RunAs/@RunAsPrincipal are ignored for @Startup/@Singleton bean

[Emmanuel Hugonnet (JIRA)]

     [ https://issues.jboss.org/browse/WFLY-981?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Emmanuel Hugonnet reassigned WFLY-981:
--------------------------------------

    Assignee: Emmanuel Hugonnet  (was: Derek Horton)

    
> @RunAs/@RunAsPrincipal are ignored for @Startup/@Singleton bean
> ---------------------------------------------------------------
>
>                 Key: WFLY-981
>                 URL: https://issues.jboss.org/browse/WFLY-981
>             Project: WildFly
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) 
>          Components: EJB
>            Reporter: Derek Horton
>            Assignee: Emmanuel Hugonnet
>             Fix For: 8.0.0.CR1
>
>
> The @RunAs/@RunAsPrincipal annotations get ignored when used on a singleton
> bean that is annotated with @Startup.  This means the the singleton bean
> is not able to call protected EJBs.
> If the protected EJB is annotated with @PermitAll, then the
> singleton is able to invoke the method because the
> AuthorizationInterceptor create an "anonymous" user that is treated as
> authenticated.  However, the @RunAsPrincipal is ignored as the
> getCallerPrincipal() returns anonymous instead of the @RunAsPrincipal.
> I dug around in the code and it looks like the @RunAs/@RunAsPrincipal
> annotations are getting handled correctly during deployment:
> Step completed: "thread=MSC service thread 1-3", org.jboss.as.ejb3.deployment.processors.merging.RunAsMergingProcessor.handleDeploymentDescriptor(), line=126 bci=249
> MSC service thread 1-3[1] print componentConfiguration.getRunAs()
>  componentConfiguration.getRunAs() = "JBossAdmin"
> MSC service thread 1-3[1] print componentConfiguration.getRunAsPrincipal()
>  componentConfiguration.getRunAsPrincipal() = "fred"
> However, by the time the SecurityContextInterceptor is called, the
> runAs/runAsPrincipal settings are null.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira