coheigea opened a new pull request, #3646: URL: https://github.com/apache/cxf/pull/3646
…ature Claims discovered via @Claim/@Claims were stored under the bare method name, with an empty list registered for every method without annotations. Overloaded methods therefore shared one rule, and an unannotated overload could replace an annotated one's claims with an empty list, which permits any caller with a ClaimsSecurityContext. The empty entries also stopped the superclass and interfaces from being scanned, so claims declared on an interface (e.g. a JAX-WS SEI) were silently ignored. Annotation-derived claims are now recorded per method signature across the class, its superclasses and interfaces, with the most specific declaration winning and a method-level annotation taking precedence over a class-level one. When the invoked method's signature has no rule of its own, every annotation rule recorded for that method name has to be satisfied. Claims configured explicitly via setClaims are enforced in addition to the annotation rules, and a method with no rule which is not part of the secured object is now denied instead of failing with a NullPointerException. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
