[ http://jira.jboss.com/jira/browse/JBAS-1309?page=history ]
Scott M Stark closed JBAS-1309:
-------------------------------
Resolution: Done
Fix Version: JBossAS-5.0 Alpha
A new addRunAsRoles option has been added to the
org.jboss.resource.security.CallerIdentityLoginModule. When true, if the caller
has assumed a run-as identity, the roles associated with the identity are added
to the jca Subject in a group called "Roles". The run-as principal name will be
used ad the PasswordCredential username, and the password login module option
will be used as the PasswordCredential password.
<application-policy name="RunAsIdentityFSRealm">
<authentication>
<login-module
code="org.jboss.resource.security.CallerIdentityLoginModule" flag="required">
<module-option name="userName">sa</module-option>
<module-option name="password"></module-option>
<module-option name="addRunAsRoles">true</module-option>
<module-option
name="managedConnectionFactoryName">jboss.jca:service=NoTxCM,name=RunAsIdentityFS</module-option>
</login-module>
</authentication>
</application-policy>
> Run as identity not used for JCA when using security-domain with caller
> identity
> --------------------------------------------------------------------------------
>
> Key: JBAS-1309
> URL: http://jira.jboss.com/jira/browse/JBAS-1309
> Project: JBoss Application Server
> Type: Bug
> Components: JCA service
> Versions: JBossAS-4.0.1 Final
> Reporter: Scott M Stark
> Assignee: Scott M Stark
> Priority: Critical
> Fix For: JBossAS-5.0 Alpha, JBossAS-4.0.2RC1, JBossAS-4.0.1 SP1
>
>
> If one tries to access a JCA resource in a context that is using a run-as
> identity, the run-as identity is not the Subject seen in the
> ManagedConnectionFactory createManagedConnection(Subject subject,
> ConnectionRequestInfo info) call.
> The understanding of the security layer in the BaseConnectionManager2 is too
> limited and should be refactored. This could be made to work with a custom
> login module, but that really is not the correct solution.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
If you want more information on JIRA, or have a bug to report see:
http://www.atlassian.com/software/jira
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
JBoss-Development mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/jboss-development
