(tomee) branch tomee-10.x updated: evaluate ejb method permissions through the installed policy on all jdks

[jungm]

This is an automated email from the ASF dual-hosted git repository.

jungm pushed a commit to branch tomee-10.x
in repository https://gitbox.apache.org/repos/asf/tomee.git


The following commit(s) were added to refs/heads/tomee-10.x by this push:
     new 782da332a0 evaluate ejb method permissions through the installed 
policy on all jdks
782da332a0 is described below

commit 782da332a02b5318bedda86ba158ff391fa74635
Author: Markus Jung <ju...@apache.org>
AuthorDate: Mon Sep 7 17:49:44 2026 +0200

    evaluate ejb method permissions through the installed policy on all jdks
---
 .../core/security/AbstractSecurityService.java     | 58 +++++++++-------------
 1 file changed, 24 insertions(+), 34 deletions(-)

diff --git 
a/container/openejb-core/src/main/java/org/apache/openejb/core/security/AbstractSecurityService.java
 
b/container/openejb-core/src/main/java/org/apache/openejb/core/security/AbstractSecurityService.java
index 5664a14a71..c773a30213 100644
--- 
a/container/openejb-core/src/main/java/org/apache/openejb/core/security/AbstractSecurityService.java
+++ 
b/container/openejb-core/src/main/java/org/apache/openejb/core/security/AbstractSecurityService.java
@@ -43,7 +43,6 @@ import javax.security.auth.login.LoginException;
 import java.io.Serializable;
 import java.lang.reflect.Method;
 import java.security.AccessControlContext;
-import java.security.AccessControlException;
 import java.security.AccessController;
 import java.security.CodeSource;
 import java.security.Policy;
@@ -60,7 +59,6 @@ import java.util.Properties;
 import java.util.Set;
 import java.util.UUID;
 import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.atomic.AtomicBoolean;
 
 import static java.util.Arrays.asList;
 
@@ -84,7 +82,6 @@ public abstract class AbstractSecurityService implements 
DestroyableResource, Se
     private String realmName = "PropertiesLogin";
     protected Subject defaultSubject;
     protected SecurityContext defaultContext;
-    private static final AtomicBoolean jaccWarningLogged = new 
AtomicBoolean(false);
 
     public AbstractSecurityService() {
         this(autoJaccProvider());
@@ -373,41 +370,34 @@ public abstract class AbstractSecurityService implements 
DestroyableResource, Se
 
     @Override
     public boolean isCallerAuthorized(final Method method, final InterfaceType 
type) {
-        if 
(System.getProperty("java.vm.specification.version").compareTo("21") < 0) {
-            final ThreadContext threadContext = 
ThreadContext.getThreadContext();
-            final BeanContext beanContext = threadContext.getBeanContext();
-            try {
-
-                final String ejbName = beanContext.getEjbName();
-                String name = type == null ? null : type.getSpecName();
-                if ("LocalBean".equals(name) || "LocalBeanHome".equals(name)) {
-                    name = null;
-                }
+        final ThreadContext threadContext = ThreadContext.getThreadContext();
+        final BeanContext beanContext = threadContext.getBeanContext();
 
-                final Identity currentIdentity = clientIdentity.get();
-                final SecurityContext securityContext;
-                if (currentIdentity == null) {
-                    securityContext = threadContext.get(SecurityContext.class);
-                } else {
-                    securityContext = new 
SecurityContext(currentIdentity.getSubject());
-                }
+        final String ejbName = beanContext.getEjbName();
+        String name = type == null ? null : type.getSpecName();
+        if ("LocalBean".equals(name) || "LocalBeanHome".equals(name)) {
+            name = null;
+        }
 
-                securityContext.getAccessControlContext().checkPermission(new 
EJBMethodPermission(ejbName, name, method));
-            } catch (final AccessControlException e) {
-                return false;
-            }
+        final Identity currentIdentity = clientIdentity.get();
+        final SecurityContext securityContext;
+        if (currentIdentity == null) {
+            securityContext = threadContext.get(SecurityContext.class);
         } else {
-            if (!jaccWarningLogged.getAndSet(true)) {
-                LOGGER.warning("Skipping JACC authorization checks as TomEE 
running on JDK 21+ does not support method security at the moment.");
-            }
-            if (LOGGER.isDebugEnabled()) {
-                LOGGER.debug("Skipping JACC authorization checks for method '"
-                        + (method == null ? "null" : method.getName())
-                        + "' on type '" + (type == null ? "null" : 
type.getSpecName())
-                        + "'.");
-            }
+            securityContext = new 
SecurityContext(currentIdentity.getSubject());
         }
-        return true;
+
+        final Policy policy = getPolicy();
+        if (policy == null) {
+            return false;
+        }
+
+        final ProtectionDomain protectionDomain = new ProtectionDomain(
+            new CodeSource(null, (java.security.cert.Certificate[]) null),
+            null, null,
+            securityContext.subject.getPrincipals().toArray(new Principal[0])
+        );
+        return policy.implies(protectionDomain, new 
EJBMethodPermission(ejbName, name, method));
     }
 
     protected static String autoJaccProvider() {