This is an automated email from the ASF dual-hosted git repository. rzo1 pushed a commit to branch tomee-10.x in repository https://gitbox.apache.org/repos/asf/tomee.git
commit 536bf33693b93df4216250a2540e84de4678ff62 Author: Markus Jung <[email protected]> AuthorDate: Sun Aug 23 20:55:17 2026 +0200 always apply the internal beans role check (cherry picked from commit 672810c91b732dde00ea58e83f6e91fdcf44554d) --- .../arquillian/remote/RemoteTomEEContainer.java | 6 +- .../internal/InternalSecurityInterceptor.java | 2 +- .../internal/InternalSecurityInterceptorTest.java | 140 +++++++++++++++++++++ docs/admin/configuration/server.adoc | 1 + .../openejb/maven/plugin/UpdatableTomEEMojo.java | 1 + .../apache/openejb/server/cli/command/Deploy.java | 4 +- .../openejb/server/cli/command/Undeploy.java | 4 +- .../org/apache/tomee/RemoteTomEEEJBContainer.java | 3 +- .../apache/tomee/catalina/TomcatWebAppBuilder.java | 24 +--- .../catalina/cluster/TomEEClusterListener.java | 18 +-- 10 files changed, 158 insertions(+), 45 deletions(-) diff --git a/arquillian/arquillian-tomee-remote/src/main/java/org/apache/tomee/arquillian/remote/RemoteTomEEContainer.java b/arquillian/arquillian-tomee-remote/src/main/java/org/apache/tomee/arquillian/remote/RemoteTomEEContainer.java index 58850fb718..4a63836987 100644 --- a/arquillian/arquillian-tomee-remote/src/main/java/org/apache/tomee/arquillian/remote/RemoteTomEEContainer.java +++ b/arquillian/arquillian-tomee-remote/src/main/java/org/apache/tomee/arquillian/remote/RemoteTomEEContainer.java @@ -172,7 +172,8 @@ public class RemoteTomEEContainer extends TomEEContainer<RemoteTomEEConfiguratio return Arrays.asList( "-Dorg.apache.catalina.STRICT_SERVLET_COMPLIANCE=false", ARQUILLIAN_FILTER, - "-Dopenejb.system.apps=true", "-Dtomee.remote.support=true" + "-Dopenejb.system.apps=true", "-Dtomee.remote.support=true", + "-Dopenejb.internal.beans.security.enabled=false" ); } @@ -189,6 +190,9 @@ public class RemoteTomEEContainer extends TomEEContainer<RemoteTomEEConfiguratio splitOnSpace.add(ARQUILLIAN_FILTER); splitOnSpace.add("-Dopenejb.system.apps=true"); splitOnSpace.add("-Dtomee.remote.support=true"); + if (splitOnSpace.stream().noneMatch(s -> s.startsWith("-Dopenejb.internal.beans.security.enabled="))) { + splitOnSpace.add("-Dopenejb.internal.beans.security.enabled=false"); + } return splitOnSpace; } diff --git a/container/openejb-core/src/main/java/org/apache/openejb/security/internal/InternalSecurityInterceptor.java b/container/openejb-core/src/main/java/org/apache/openejb/security/internal/InternalSecurityInterceptor.java index c659232450..b36a28bd26 100644 --- a/container/openejb-core/src/main/java/org/apache/openejb/security/internal/InternalSecurityInterceptor.java +++ b/container/openejb-core/src/main/java/org/apache/openejb/security/internal/InternalSecurityInterceptor.java @@ -31,7 +31,7 @@ public class InternalSecurityInterceptor { @AroundInvoke public Object invoke(final InvocationContext ic) throws Exception { - if (SystemInstance.get().isDefaultProfile() || !SystemInstance.get().getOptions().get(OPENEJB_INTERNAL_BEANS_SECURITY_ENABLED, true)) { + if (!SystemInstance.get().getOptions().get(OPENEJB_INTERNAL_BEANS_SECURITY_ENABLED, true)) { return ic.proceed(); } diff --git a/container/openejb-core/src/test/java/org/apache/openejb/security/internal/InternalSecurityInterceptorTest.java b/container/openejb-core/src/test/java/org/apache/openejb/security/internal/InternalSecurityInterceptorTest.java new file mode 100644 index 0000000000..0e49d02ada --- /dev/null +++ b/container/openejb-core/src/test/java/org/apache/openejb/security/internal/InternalSecurityInterceptorTest.java @@ -0,0 +1,140 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.openejb.security.internal; + +import org.apache.openejb.loader.SystemInstance; +import org.apache.openejb.ri.sp.PseudoSecurityService; +import org.apache.openejb.spi.Assembler; +import org.apache.openejb.spi.ContainerSystem; +import org.apache.openejb.spi.SecurityService; +import org.junit.After; +import org.junit.Before; +import org.junit.Test; + +import jakarta.interceptor.InvocationContext; +import jakarta.transaction.TransactionManager; +import java.lang.reflect.Constructor; +import java.lang.reflect.Method; +import java.util.HashMap; +import java.util.Map; +import java.util.Properties; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; +import static org.junit.Assert.fail; + +public class InternalSecurityInterceptorTest { + private Assembler previousAssembler; + + @Before + public void setUp() { + previousAssembler = SystemInstance.get().setComponent(Assembler.class, new NoRoleAssembler()); + } + + @After + public void tearDown() { + SystemInstance.get().getProperties().remove(InternalSecurityInterceptor.OPENEJB_INTERNAL_BEANS_SECURITY_ENABLED); + if (previousAssembler == null) { + SystemInstance.get().removeComponent(Assembler.class); + } else { + SystemInstance.get().setComponent(Assembler.class, previousAssembler); + } + } + + @Test + public void disabledCheckProceeds() throws Exception { + SystemInstance.get().setProperty(InternalSecurityInterceptor.OPENEJB_INTERNAL_BEANS_SECURITY_ENABLED, "false"); + assertEquals("proceeded", new InternalSecurityInterceptor().invoke(new ProceedingContext())); + } + + private static final class NoRoleAssembler implements Assembler { + private final SecurityService<?> securityService = new PseudoSecurityService(); + + @Override + public void init(final Properties props) { + // no-op + } + + @Override + public void build() { + // no-op + } + + @Override + public ContainerSystem getContainerSystem() { + return null; + } + + @Override + public TransactionManager getTransactionManager() { + return null; + } + + @Override + public SecurityService getSecurityService() { + return securityService; + } + + @Override + public void destroy() { + // no-op + } + } + + private static final class ProceedingContext implements InvocationContext { + @Override + public Object getTarget() { + return null; + } + + @Override + public Object getTimer() { + return null; + } + + @Override + public Method getMethod() { + return null; + } + + @Override + public Constructor<?> getConstructor() { + return null; + } + + @Override + public Object[] getParameters() { + return new Object[0]; + } + + @Override + public void setParameters(final Object[] params) { + // no-op + } + + @Override + public Map<String, Object> getContextData() { + return new HashMap<>(); + } + + @Override + public Object proceed() { + return "proceeded"; + } + } +} diff --git a/docs/admin/configuration/server.adoc b/docs/admin/configuration/server.adoc index 744172fd91..0ca9af76fd 100644 --- a/docs/admin/configuration/server.adoc +++ b/docs/admin/configuration/server.adoc @@ -57,6 +57,7 @@ |tomee.serialization.class.blacklist| string |default list of packages/classnames excluded for EJBd deserialization (needs to be set on server and client sides). Please see the description of Ejbd Transport for details. |tomee.serialization.class.whitelist| string| default list of packages/classnames allowed for EJBd deserialization (blacklist wins over whitelist, needs to be set on server and client sides). Please see the description of Ejbd Transport for details. |tomee.remote.support |boolean |if true /tomee webapp is auto-deployed and EJBd is active (true by default for 1.x, false for 7.x excepted for tomee maven plugin and arquillian) +|openejb.internal.beans.security.enabled |boolean |if true (default) the internal EJBs (Deployer, ConfigurationInfo, ...) can only be invoked by a caller in the tomee-admin or openejb-admin role |openejb.crosscontext |bool| set the cross context property on tomcat context (can be done in the traditional way if the deployment is done through the webapp discovery and not the OpenEJB Deployer EJB) |openejb.jsessionid-support |bool| remove URL from session tracking modes for this context (see jakarta.servlet.SessionTrackingMode) |openejb.myfaces.disable-default-values |bool| by default TomEE will initialize myfaces with some its default values to avoid useless logging diff --git a/maven/tomee-maven-plugin/src/main/java/org/apache/openejb/maven/plugin/UpdatableTomEEMojo.java b/maven/tomee-maven-plugin/src/main/java/org/apache/openejb/maven/plugin/UpdatableTomEEMojo.java index 474b94f829..21f0fb45d9 100644 --- a/maven/tomee-maven-plugin/src/main/java/org/apache/openejb/maven/plugin/UpdatableTomEEMojo.java +++ b/maven/tomee-maven-plugin/src/main/java/org/apache/openejb/maven/plugin/UpdatableTomEEMojo.java @@ -119,6 +119,7 @@ public abstract class UpdatableTomEEMojo extends AbstractTomEEMojo { if (systemVariables == null) { systemVariables = new HashMap<>(); systemVariables.put("tomee.remote.support", "true"); + systemVariables.put("openejb.internal.beans.security.enabled", "false"); } } } diff --git a/server/openejb-common-cli/src/main/java/org/apache/openejb/server/cli/command/Deploy.java b/server/openejb-common-cli/src/main/java/org/apache/openejb/server/cli/command/Deploy.java index 2ffe178b18..9dc486fda9 100644 --- a/server/openejb-common-cli/src/main/java/org/apache/openejb/server/cli/command/Deploy.java +++ b/server/openejb-common-cli/src/main/java/org/apache/openejb/server/cli/command/Deploy.java @@ -17,14 +17,14 @@ package org.apache.openejb.server.cli.command; -import org.apache.openejb.assembler.Deployer; +import org.apache.openejb.assembler.DeployerEjb; @Command(name = "deploy", usage = "deploy <location>", description = "deploy an application") public class Deploy extends AbstractCommand { @Override public void execute(String cmd) { try { - lookup(Deployer.class, "openejb/DeployerBusinessRemote").deploy(cmd.trim()); + new DeployerEjb().deploy(cmd.trim()); } catch (Exception e) { streamManager.writeErr(e); } diff --git a/server/openejb-common-cli/src/main/java/org/apache/openejb/server/cli/command/Undeploy.java b/server/openejb-common-cli/src/main/java/org/apache/openejb/server/cli/command/Undeploy.java index 53a45833bd..d9bcf2c309 100644 --- a/server/openejb-common-cli/src/main/java/org/apache/openejb/server/cli/command/Undeploy.java +++ b/server/openejb-common-cli/src/main/java/org/apache/openejb/server/cli/command/Undeploy.java @@ -17,14 +17,14 @@ package org.apache.openejb.server.cli.command; -import org.apache.openejb.assembler.Deployer; +import org.apache.openejb.assembler.DeployerEjb; @Command(name = "undeploy", usage = "undeploy <location>", description = "undeploy an application. Note the location should be the same than for deploy") public class Undeploy extends AbstractCommand { @Override public void execute(String cmd) { try { - lookup(Deployer.class, "openejb/DeployerBusinessRemote").undeploy(cmd.trim()); + new DeployerEjb().undeploy(cmd.trim()); } catch (Exception e) { streamManager.writeErr(e); } diff --git a/tomee/apache-tomee/src/main/java/org/apache/tomee/RemoteTomEEEJBContainer.java b/tomee/apache-tomee/src/main/java/org/apache/tomee/RemoteTomEEEJBContainer.java index 011b8178e6..4f650ab37f 100644 --- a/tomee/apache-tomee/src/main/java/org/apache/tomee/RemoteTomEEEJBContainer.java +++ b/tomee/apache-tomee/src/main/java/org/apache/tomee/RemoteTomEEEJBContainer.java @@ -112,7 +112,8 @@ public class RemoteTomEEEJBContainer extends EJBContainer { try { instance.container.start(Arrays.asList( "-Dtomee.serialization.class.blacklist=" + System.getProperty("tomee.serialization.class.blacklist"), - "-Dopenejb.system.apps=true", "-Dtomee.remote.support=true"), + "-Dopenejb.system.apps=true", "-Dtomee.remote.support=true", + "-Dopenejb.internal.beans.security.enabled=false"), "start", true); } catch (final Exception e) { instance.container.destroy(); diff --git a/tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/TomcatWebAppBuilder.java b/tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/TomcatWebAppBuilder.java index dd0079959d..302e346bfd 100644 --- a/tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/TomcatWebAppBuilder.java +++ b/tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/TomcatWebAppBuilder.java @@ -428,29 +428,7 @@ public class TomcatWebAppBuilder implements WebAppBuilder, ContextListener, Pare } @Override - public void start(final StandardServer server) { - if (SystemInstance.get().isDefaultProfile()) { // add user tomee is no user are specified - try { - final NamingResourcesImpl resources = server.getGlobalNamingResources(); - final ContextResource userDataBaseResource = resources.findResource("UserDatabase"); - final UserDatabase db = (UserDatabase) server.getGlobalNamingContext().lookup(userDataBaseResource.getName()); - if (!db.getUsers().hasNext() && db instanceof MemoryUserDatabase mudb) { - final boolean oldRo = mudb.getReadonly(); - try { - mudb.setReadonly(false); - - db.createRole("tomee-admin", "tomee admin role"); - db.createUser("tomee", "tomee", "TomEE"); - db.findUser("tomee").addRole(db.findRole("tomee-admin")); - } finally { - mudb.setReadonly(oldRo); - } - } - } catch (final Throwable t) { - // no-op - } - } - } + public void start(final StandardServer server) { } // // OpenEJB WebAppBuilder diff --git a/tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/cluster/TomEEClusterListener.java b/tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/cluster/TomEEClusterListener.java index 63ccea05da..7e2ce2bbaf 100644 --- a/tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/cluster/TomEEClusterListener.java +++ b/tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/cluster/TomEEClusterListener.java @@ -22,8 +22,8 @@ import org.apache.openejb.NoSuchApplicationException; import org.apache.openejb.OpenEJBException; import org.apache.openejb.UndeployException; import org.apache.openejb.assembler.Deployer; +import org.apache.openejb.assembler.DeployerEjb; import org.apache.openejb.assembler.classic.Assembler; -import org.apache.openejb.core.LocalInitialContextFactory; import org.apache.openejb.loader.Files; import org.apache.openejb.loader.IO; import org.apache.openejb.loader.SystemInstance; @@ -31,9 +31,6 @@ import org.apache.openejb.util.DaemonThreadFactory; import org.apache.openejb.util.LogCategory; import org.apache.openejb.util.Logger; -import javax.naming.Context; -import javax.naming.InitialContext; -import javax.naming.NamingException; import java.io.File; import java.util.Properties; import java.util.concurrent.ExecutorService; @@ -103,8 +100,8 @@ public class TomEEClusterListener extends ClusterListener { return SystemInstance.get().getComponent(Assembler.class).isDeployed(file); } - private static Deployer deployer() throws NamingException { - return (Deployer) new InitialContext(Static.IC_PROPS).lookup("openejb/DeployerBusinessRemote"); + private static Deployer deployer() { + return new DeployerEjb(); } @Override @@ -141,8 +138,6 @@ public class TomEEClusterListener extends ClusterListener { deployer().deploy(app, REMOTE_DEPLOY_PROPERTIES); } catch (final OpenEJBException e) { Static.LOGGER.warning("can't deploy: " + app, e); - } catch (final NamingException e) { - Static.LOGGER.warning("can't find deployer", e); } } } @@ -164,8 +159,6 @@ public class TomEEClusterListener extends ClusterListener { Static.LOGGER.error("can't undeploy app", e); } catch (final NoSuchApplicationException e) { Static.LOGGER.warning("no app toi deploy", e); - } catch (final NamingException e) { - Static.LOGGER.warning("can't find deployer", e); } } } @@ -174,15 +167,10 @@ public class TomEEClusterListener extends ClusterListener { // lazy init of logger (can fail with shutdown hooks to kill the container) and executor private static final class Static { private static final Logger LOGGER = Logger.getInstance(LogCategory.OPENEJB, TomEEClusterListener.class); - private static final Properties IC_PROPS = new Properties(); // async processing to avoid to make the cluster hanging private static final ExecutorService SERVICE = Executors.newSingleThreadExecutor(new DaemonThreadFactory("TomEE-Cluster-Listener-thread-")); - static { - IC_PROPS.setProperty(Context.INITIAL_CONTEXT_FACTORY, LocalInitialContextFactory.class.getName()); - } - private Static() { // no-op }
