Uploaded image for project: 'IronJacamar'
  1. IronJacamar
  2. JBJCA-1304

Subject.doAs should be invoked inside of doPrivileged block

    XMLWordPrintable

Details

    Description

      If the server is running with Security Manager enabled and a deployment invokes getConnection() method a DataSource, it fails with the following exception:

      &amp#27;[0m&amp#27;[33m15:08:52,138 WARN  [org.jboss.jca.core.connectionmanager.pool.strategy.PoolBySubject] (pool-2-thread-1) IJ000604: Throwable while attempting to get a new connection: null: java.security.AccessControlException: WFSM000001: Permission check failed (permission "("javax.security.auth.AuthPermission" "doAs")" in code source "(vfs:/content/test.ear/lib/single.jar <no signer certificates>)" of "null")
	at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:273)
	at org.wildfly.security.manager.WildFlySecurityManager.checkPermission(WildFlySecurityManager.java:175)
	at javax.security.auth.Subject.doAs(Subject.java:410)
	at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createManagedConnection(LocalManagedConnectionFactory.java:243)
	at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.createConnectionEventListener(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:1336)
	at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.getConnection(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:501)
	at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getSimpleConnection(AbstractPool.java:633)
	at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getConnection(AbstractPool.java:605)
	at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:603)
	at org.jboss.jca.core.connectionmanager.tx.TxConnectionManagerImpl.getManagedConnection(TxConnectionManagerImpl.java:430)
	at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:761)
	at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
	at org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:66)
	at org.jboss.as.test.integration.jca.security.DsWithSecurityDomainTestCase.deploymentTest(DsWithSecurityDomainTestCase.java:101)

      LocalManagedConnectionFactory#createManagedConnection(Subject, ConnectionRequestInfo) invokes Subject.doAs() without doPrivileged block. Hence, the deployment needs to have doAs permissions.

      Subject.doAs should be invoked within doPrivileged.

      Attachments

        Issue Links

          causes

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-1898 getConnection() method on a datasource needs extra permissions when Security Manager is enabled

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed

          Activity

            People

              istudens@redhat.com Ivo Studensky
              istudens@redhat.com Ivo Studensky
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: