Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-10428

(7.0.z) custom java security permission does not work

    XMLWordPrintable

Details

    • EAP 7.0.7

    Description

      Description of problem:

      We have a custom permission (extends java.security.Permission) that we want to check at runtime.

      The permission should be granted to a user with a specific Principal (org.jboss.security.SimplePrincipal "admin") in my testing:

        grant principal org.jboss.security.SimplePrincipal "admin" {
          permission org.jboss.example.CustomPermission "/Hello";
        };
      

      We have coded our servlet to check this permission at run time with code that looks like the following:

          javax.security.auth.Subject subj = (javax.security.auth.Subject) javax.security.jacc.PolicyContext.getContext("javax.security.auth.Subject.container");  
      
          org.jboss.example.CustomPermission permission = new org.jboss.example.CustomPermission("/Hello");
      
          try {
            Subject.doAsPrivileged(subj, new PrivilegedAction() {
              public Object run() {
                AccessController.checkPermission(p);
                return null;
              }
            }, null);
            return true;
          } catch (SecurityException se) {
            log.warn("AuthUtils.permitted(): Subject " + subj + " not authorized for permission " + p);
            return false;
          }
      

      The subj above contains a org.jboss.security.SimplePrincipal instance with the username of "admin" in its principal set.

      Actual results:

      The permission check always returns "denied".

      Expected results:

      The permission check should return "granted" when the subject contains a SimplePrincipal instance with "admin" as the username.

      Attachments

        Issue Links

          Activity

            People

              rhn-cservice-bbaranow Bartosz Baranowski
              jondruse@redhat.com Jiri Ondrusek
              Ivo Hradek Ivo Hradek (Inactive)
              Ivo Hradek Ivo Hradek (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: