security bugs in openejb integration
------------------------------------
Key: GERONIMO-3072
URL: https://issues.apache.org/jira/browse/GERONIMO-3072
Project: Geronimo
Issue Type: Bug
Security Level: public (Regular issues)
Components: OpenEJB
Affects Versions: 2.0-M4
Reporter: David Jencks
Assigned To: David Jencks
Fix For: 2.0-M5
There are a few problems in the security setup:
- role-links are not required any more, if missing a value equal to the role
name is assumed
- if methodIntf is null don't try to turn it into a string
- need to actually construct set of all possible ejb method permissions, not
the empty set
- need to actually set whether or not security is enabled
- run-as processing requires all calls to push the run-as subject, even if it
is null. Otherwise the next ejb won't get called with the previous ejbs run-as
subject.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
