User: starksm
Date: 01/06/11 00:04:15
Modified: src/main/org/jboss/ejb/plugins SecurityInterceptor.java
Added: src/main/org/jboss/ejb/plugins SecurityProxyInterceptor.java
Log:
Break out the cutom security proxy integration into a seperate interceptor
Revision Changes Path
1.16 +9 -109 jboss/src/main/org/jboss/ejb/plugins/SecurityInterceptor.java
Index: SecurityInterceptor.java
===================================================================
RCS file:
/cvsroot/jboss/jboss/src/main/org/jboss/ejb/plugins/SecurityInterceptor.java,v
retrieving revision 1.15
retrieving revision 1.16
diff -u -r1.15 -r1.16
--- SecurityInterceptor.java 2001/05/10 03:19:54 1.15
+++ SecurityInterceptor.java 2001/06/11 07:04:15 1.16
@@ -6,48 +6,30 @@
*/
package org.jboss.ejb.plugins;
-import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
-import java.lang.reflect.UndeclaredThrowableException;
import java.rmi.RemoteException;
-import java.security.AccessControlContext;
-import java.security.AccessController;
import java.security.Principal;
import java.util.Iterator;
import java.util.Set;
-import javax.ejb.EJBContext;
-import javax.ejb.EntityContext;
-import javax.ejb.SessionContext;
import javax.naming.InitialContext;
-import javax.security.auth.Subject;
import org.jboss.ejb.Container;
-import org.jboss.ejb.ContainerInvokerContainer;
import org.jboss.ejb.MethodInvocation;
-
import org.jboss.logging.Logger;
import org.jboss.security.EJBSecurityManager;
import org.jboss.security.RealmMapping;
import org.jboss.security.SecurityAssociation;
-import org.jboss.security.SecurityProxy;
-import org.jboss.security.SecurityProxyFactory;
-/** The SecurityInterceptor is where the EJB declarative security model
-is enforced. It is also the layer where user's can introduce custom
-security via the SecurityProxy delegation model.
+/** The SecurityInterceptor is where the EJB 2.0 declarative security model
+is enforced.
@author <a href="[EMAIL PROTECTED]">Oleg Nitz</a>
@author [EMAIL PROTECTED]
-@version $Revision: 1.15 $
+@version $Revision: 1.16 $
*/
public class SecurityInterceptor extends AbstractInterceptor
{
- /** The JNDI name of the SecurityProxyFactory used to wrap security
- proxy objects that do not implement the SecurityProxy interface
- */
- public final String SECURITY_PROXY_FACTORY_NAME = "java:/SecurityProxyFactory";
-
/**
* @clientCardinality 0..1
* @supplierCardinality 1
@@ -68,13 +50,6 @@
*/
protected RealmMapping realmMapping;
- /**
- * @supplierCardinality 0..1
- * @clientCardinality 1
- * @supplierQualifier custom security
- */
- protected SecurityProxy securityProxy;
-
public SecurityInterceptor()
{
}
@@ -84,47 +59,6 @@
this.container = container;
securityManager = container.getSecurityManager();
realmMapping = container.getRealmMapping();
- Object secProxy = container.getSecurityProxy();
- if( secProxy != null )
- {
- /* If this is not a SecurityProxy instance then use the default
- SecurityProxy implementation
- */
- if( (secProxy instanceof SecurityProxy) == false )
- {
- try
- {
- // Get default SecurityProxyFactory from JNDI at
- InitialContext iniCtx = new InitialContext();
- SecurityProxyFactory proxyFactory = (SecurityProxyFactory)
iniCtx.lookup(SECURITY_PROXY_FACTORY_NAME);
- securityProxy = proxyFactory.create(secProxy);
- }
- catch(Exception e)
- {
- System.out.println("Failed to initialze DefaultSecurityProxy");
- e.printStackTrace();
- }
- }
- else
- {
- securityProxy = (SecurityProxy) secProxy;
- }
-
- // Initialize the securityProxy
- try
- {
- ContainerInvokerContainer ic = (ContainerInvokerContainer)
container;
- Class beanHome = ic.getHomeClass();
- Class beanRemote = ic.getRemoteClass();
- securityProxy.init(beanHome, beanRemote, securityManager);
- }
- catch(Exception e)
- {
- System.out.println("Failed to initialze SecurityProxy");
- e.printStackTrace();
- }
- System.out.println("Initialized SecurityProxy="+securityProxy);
- }
}
public Container getContainer()
@@ -142,54 +76,20 @@
{
// Authenticate the subject and apply any declarative security checks
checkSecurityAssociation(mi, true);
- // Apply any custom security checks
- if( securityProxy != null )
- {
- EJBContext ctx = mi.getEnterpriseContext().getEJBContext();
- Object[] args = mi.getArguments();
- securityProxy.setEJBContext(ctx);
- try
- {
- securityProxy.invokeHome(mi.getMethod(), args);
- }
- catch(SecurityException e)
- {
- Principal principal = mi.getPrincipal();
- String msg = "SecurityProxy.invokeHome exception,
principal="+principal;
- Logger.error(msg);
- SecurityException se = new SecurityException(msg);
- throw new RemoteException("SecurityProxy.invokeHome failure", se);
- }
- }
return getNext().invokeHome(mi);
}
public Object invoke(MethodInvocation mi) throws Exception
{
// Authenticate the subject and apply any declarative security checks
checkSecurityAssociation(mi, false);
- // Apply any custom security checks
- if( securityProxy != null )
- {
- Object bean = mi.getEnterpriseContext().getInstance();
- EJBContext ctx = mi.getEnterpriseContext().getEJBContext();
- Object[] args = mi.getArguments();
- securityProxy.setEJBContext(ctx);
- try
- {
- securityProxy.invoke(mi.getMethod(), args, bean);
- }
- catch(SecurityException e)
- {
- Principal principal = mi.getPrincipal();
- String msg = "SecurityProxy.invoke exception, principal="+principal;
- Logger.error(msg);
- SecurityException se = new SecurityException(msg);
- throw new RemoteException("SecurityProxy.invoke failure", se);
- }
- }
return getNext().invoke(mi);
}
+ /** The EJB 2.0 declarative security algorithm:
+ 1. Authenticate the caller using the principal and credentials in the
MethodInfocation
+ 2. Validate access to the method by checking the principal's roles against
+ those required to access the method.
+ */
private void checkSecurityAssociation(MethodInvocation mi, boolean home)
throws Exception
{
@@ -206,7 +106,7 @@
// Check the security info from the method invocation
Principal principal = mi.getPrincipal();
Object credential = mi.getCredential();
- if( principal == null || securityManager.isValid(principal, credential) ==
false )
+ if( securityManager.isValid(principal, credential) == false )
{
String msg = "Authentication exception, principal="+principal;
Logger.error(msg);
1.1
jboss/src/main/org/jboss/ejb/plugins/SecurityProxyInterceptor.java
Index: SecurityProxyInterceptor.java
===================================================================
/*
* JBoss, the OpenSource EJB server
*
* Distributable under LGPL license.
* See terms of license at gnu.org.
*/
package org.jboss.ejb.plugins;
import java.lang.reflect.Method;
import java.rmi.RemoteException;
import java.security.Principal;
import javax.ejb.EJBContext;
import javax.naming.InitialContext;
import org.jboss.ejb.Container;
import org.jboss.ejb.ContainerInvokerContainer;
import org.jboss.ejb.MethodInvocation;
import org.jboss.security.EJBSecurityManager;
import org.jboss.security.SecurityProxy;
import org.jboss.security.SecurityProxyFactory;
/** The SecurityProxyInterceptor is where the EJB custom security proxy
integration is performed. This interceptor is dynamically added to container
interceptors when the deployment descriptors specifies a security
proxy. It is added just before the container interceptor so that the
interceptor has access to the EJB instance and context.
@author [EMAIL PROTECTED]
@version $Revision: 1.1 $
*/
public class SecurityProxyInterceptor extends AbstractInterceptor
{
/** The JNDI name of the SecurityProxyFactory used to wrap security
proxy objects that do not implement the SecurityProxy interface
*/
public final String SECURITY_PROXY_FACTORY_NAME = "java:/SecurityProxyFactory";
/**
* @clientCardinality 0..1
* @supplierCardinality 1
*/
protected Container container;
protected EJBSecurityManager securityManager;
/**
* @supplierCardinality 0..1
* @clientCardinality 1
* @supplierQualifier custom security
*/
protected SecurityProxy securityProxy;
public SecurityProxyInterceptor()
{
}
public void setContainer(Container container)
{
this.container = container;
securityManager = container.getSecurityManager();
Object secProxy = container.getSecurityProxy();
if( secProxy != null )
{
/* If this is not a SecurityProxy instance then use the default
SecurityProxy implementation
*/
if( (secProxy instanceof SecurityProxy) == false )
{
try
{
// Get default SecurityProxyFactory from JNDI at
InitialContext iniCtx = new InitialContext();
SecurityProxyFactory proxyFactory = (SecurityProxyFactory)
iniCtx.lookup(SECURITY_PROXY_FACTORY_NAME);
securityProxy = proxyFactory.create(secProxy);
}
catch(Exception e)
{
System.out.println("Failed to initialze DefaultSecurityProxy");
e.printStackTrace();
}
}
else
{
securityProxy = (SecurityProxy) secProxy;
}
// Initialize the securityProxy
try
{
ContainerInvokerContainer ic = (ContainerInvokerContainer) container;
Class beanHome = ic.getHomeClass();
Class beanRemote = ic.getRemoteClass();
securityProxy.init(beanHome, beanRemote, securityManager);
}
catch(Exception e)
{
System.out.println("Failed to initialze SecurityProxy");
e.printStackTrace();
}
System.out.println("Initialized SecurityProxy="+securityProxy);
}
}
public Container getContainer()
{
return container;
}
// Container implementation --------------------------------------
public void start() throws Exception
{
super.start();
}
public Object invokeHome(MethodInvocation mi) throws Exception
{
// Apply any custom security checks
if( securityProxy != null )
{
EJBContext ctx = mi.getEnterpriseContext().getEJBContext();
Object[] args = mi.getArguments();
securityProxy.setEJBContext(ctx);
try
{
securityProxy.invokeHome(mi.getMethod(), args);
}
catch(SecurityException e)
{
Principal principal = mi.getPrincipal();
String msg = "SecurityProxy.invokeHome exception,
principal="+principal;
System.err.println(msg);
SecurityException se = new SecurityException(msg);
throw new RemoteException("SecurityProxy.invokeHome failure", se);
}
}
return getNext().invokeHome(mi);
}
public Object invoke(MethodInvocation mi) throws Exception
{
// Apply any custom security checks
if( securityProxy != null )
{
Object bean = mi.getEnterpriseContext().getInstance();
EJBContext ctx = mi.getEnterpriseContext().getEJBContext();
Object[] args = mi.getArguments();
securityProxy.setEJBContext(ctx);
try
{
securityProxy.invoke(mi.getMethod(), args, bean);
}
catch(SecurityException e)
{
Principal principal = mi.getPrincipal();
String msg = "SecurityProxy.invoke exception, principal="+principal;
System.err.println(msg);
SecurityException se = new SecurityException(msg);
throw new RemoteException("SecurityProxy.invoke failure", se);
}
}
return getNext().invoke(mi);
}
}
_______________________________________________
Jboss-development mailing list
[EMAIL PROTECTED]
http://lists.sourceforge.net/lists/listinfo/jboss-development
