This is an automated email from the ASF dual-hosted git repository.
jungm pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomee.git
The following commit(s) were added to refs/heads/main by this push:
new 672810c91b always apply the internal beans role check
672810c91b is described below
commit 672810c91b732dde00ea58e83f6e91fdcf44554d
Author: Markus Jung <[email protected]>
AuthorDate: Sun Aug 23 20:55:17 2026 +0200
always apply the internal beans role check
---
.../arquillian/remote/RemoteTomEEContainer.java | 6 +-
.../internal/InternalSecurityInterceptor.java | 2 +-
.../internal/InternalSecurityInterceptorTest.java | 140 +++++++++++++++++++++
docs/admin/configuration/server.adoc | 1 +
.../openejb/maven/plugin/UpdatableTomEEMojo.java | 1 +
.../apache/openejb/server/cli/command/Deploy.java | 4 +-
.../openejb/server/cli/command/Undeploy.java | 4 +-
.../org/apache/tomee/RemoteTomEEEJBContainer.java | 3 +-
.../apache/tomee/catalina/TomcatWebAppBuilder.java | 24 +---
.../catalina/cluster/TomEEClusterListener.java | 18 +--
10 files changed, 158 insertions(+), 45 deletions(-)
diff --git
a/arquillian/arquillian-tomee-remote/src/main/java/org/apache/tomee/arquillian/remote/RemoteTomEEContainer.java
b/arquillian/arquillian-tomee-remote/src/main/java/org/apache/tomee/arquillian/remote/RemoteTomEEContainer.java
index 58850fb718..4a63836987 100644
---
a/arquillian/arquillian-tomee-remote/src/main/java/org/apache/tomee/arquillian/remote/RemoteTomEEContainer.java
+++
b/arquillian/arquillian-tomee-remote/src/main/java/org/apache/tomee/arquillian/remote/RemoteTomEEContainer.java
@@ -172,7 +172,8 @@ public class RemoteTomEEContainer extends
TomEEContainer<RemoteTomEEConfiguratio
return Arrays.asList(
"-Dorg.apache.catalina.STRICT_SERVLET_COMPLIANCE=false",
ARQUILLIAN_FILTER,
- "-Dopenejb.system.apps=true", "-Dtomee.remote.support=true"
+ "-Dopenejb.system.apps=true",
"-Dtomee.remote.support=true",
+ "-Dopenejb.internal.beans.security.enabled=false"
);
}
@@ -189,6 +190,9 @@ public class RemoteTomEEContainer extends
TomEEContainer<RemoteTomEEConfiguratio
splitOnSpace.add(ARQUILLIAN_FILTER);
splitOnSpace.add("-Dopenejb.system.apps=true");
splitOnSpace.add("-Dtomee.remote.support=true");
+ if (splitOnSpace.stream().noneMatch(s ->
s.startsWith("-Dopenejb.internal.beans.security.enabled="))) {
+
splitOnSpace.add("-Dopenejb.internal.beans.security.enabled=false");
+ }
return splitOnSpace;
}
diff --git
a/container/openejb-core/src/main/java/org/apache/openejb/security/internal/InternalSecurityInterceptor.java
b/container/openejb-core/src/main/java/org/apache/openejb/security/internal/InternalSecurityInterceptor.java
index c659232450..b36a28bd26 100644
---
a/container/openejb-core/src/main/java/org/apache/openejb/security/internal/InternalSecurityInterceptor.java
+++
b/container/openejb-core/src/main/java/org/apache/openejb/security/internal/InternalSecurityInterceptor.java
@@ -31,7 +31,7 @@ public class InternalSecurityInterceptor {
@AroundInvoke
public Object invoke(final InvocationContext ic) throws Exception {
- if (SystemInstance.get().isDefaultProfile() ||
!SystemInstance.get().getOptions().get(OPENEJB_INTERNAL_BEANS_SECURITY_ENABLED,
true)) {
+ if
(!SystemInstance.get().getOptions().get(OPENEJB_INTERNAL_BEANS_SECURITY_ENABLED,
true)) {
return ic.proceed();
}
diff --git
a/container/openejb-core/src/test/java/org/apache/openejb/security/internal/InternalSecurityInterceptorTest.java
b/container/openejb-core/src/test/java/org/apache/openejb/security/internal/InternalSecurityInterceptorTest.java
new file mode 100644
index 0000000000..0e49d02ada
--- /dev/null
+++
b/container/openejb-core/src/test/java/org/apache/openejb/security/internal/InternalSecurityInterceptorTest.java
@@ -0,0 +1,140 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.openejb.security.internal;
+
+import org.apache.openejb.loader.SystemInstance;
+import org.apache.openejb.ri.sp.PseudoSecurityService;
+import org.apache.openejb.spi.Assembler;
+import org.apache.openejb.spi.ContainerSystem;
+import org.apache.openejb.spi.SecurityService;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+
+import jakarta.interceptor.InvocationContext;
+import jakarta.transaction.TransactionManager;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Method;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Properties;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+public class InternalSecurityInterceptorTest {
+ private Assembler previousAssembler;
+
+ @Before
+ public void setUp() {
+ previousAssembler = SystemInstance.get().setComponent(Assembler.class,
new NoRoleAssembler());
+ }
+
+ @After
+ public void tearDown() {
+
SystemInstance.get().getProperties().remove(InternalSecurityInterceptor.OPENEJB_INTERNAL_BEANS_SECURITY_ENABLED);
+ if (previousAssembler == null) {
+ SystemInstance.get().removeComponent(Assembler.class);
+ } else {
+ SystemInstance.get().setComponent(Assembler.class,
previousAssembler);
+ }
+ }
+
+ @Test
+ public void disabledCheckProceeds() throws Exception {
+
SystemInstance.get().setProperty(InternalSecurityInterceptor.OPENEJB_INTERNAL_BEANS_SECURITY_ENABLED,
"false");
+ assertEquals("proceeded", new InternalSecurityInterceptor().invoke(new
ProceedingContext()));
+ }
+
+ private static final class NoRoleAssembler implements Assembler {
+ private final SecurityService<?> securityService = new
PseudoSecurityService();
+
+ @Override
+ public void init(final Properties props) {
+ // no-op
+ }
+
+ @Override
+ public void build() {
+ // no-op
+ }
+
+ @Override
+ public ContainerSystem getContainerSystem() {
+ return null;
+ }
+
+ @Override
+ public TransactionManager getTransactionManager() {
+ return null;
+ }
+
+ @Override
+ public SecurityService getSecurityService() {
+ return securityService;
+ }
+
+ @Override
+ public void destroy() {
+ // no-op
+ }
+ }
+
+ private static final class ProceedingContext implements InvocationContext {
+ @Override
+ public Object getTarget() {
+ return null;
+ }
+
+ @Override
+ public Object getTimer() {
+ return null;
+ }
+
+ @Override
+ public Method getMethod() {
+ return null;
+ }
+
+ @Override
+ public Constructor<?> getConstructor() {
+ return null;
+ }
+
+ @Override
+ public Object[] getParameters() {
+ return new Object[0];
+ }
+
+ @Override
+ public void setParameters(final Object[] params) {
+ // no-op
+ }
+
+ @Override
+ public Map<String, Object> getContextData() {
+ return new HashMap<>();
+ }
+
+ @Override
+ public Object proceed() {
+ return "proceeded";
+ }
+ }
+}
diff --git a/docs/admin/configuration/server.adoc
b/docs/admin/configuration/server.adoc
index 744172fd91..0ca9af76fd 100644
--- a/docs/admin/configuration/server.adoc
+++ b/docs/admin/configuration/server.adoc
@@ -57,6 +57,7 @@
|tomee.serialization.class.blacklist| string |default list of
packages/classnames excluded for EJBd deserialization (needs to be set on
server and client sides). Please see the description of Ejbd Transport for
details.
|tomee.serialization.class.whitelist| string| default list of
packages/classnames allowed for EJBd deserialization (blacklist wins over
whitelist, needs to be set on server and client sides). Please see the
description of Ejbd Transport for details.
|tomee.remote.support |boolean |if true /tomee webapp is auto-deployed
and EJBd is active (true by default for 1.x, false for 7.x excepted for tomee
maven plugin and arquillian)
+|openejb.internal.beans.security.enabled |boolean |if true
(default) the internal EJBs (Deployer, ConfigurationInfo, ...) can only be
invoked by a caller in the tomee-admin or openejb-admin role
|openejb.crosscontext |bool| set the cross context property on tomcat
context (can be done in the traditional way if the deployment is done through
the webapp discovery and not the OpenEJB Deployer EJB)
|openejb.jsessionid-support |bool| remove URL from session tracking modes
for this context (see jakarta.servlet.SessionTrackingMode)
|openejb.myfaces.disable-default-values |bool| by default TomEE will
initialize myfaces with some its default values to avoid useless logging
diff --git
a/maven/tomee-maven-plugin/src/main/java/org/apache/openejb/maven/plugin/UpdatableTomEEMojo.java
b/maven/tomee-maven-plugin/src/main/java/org/apache/openejb/maven/plugin/UpdatableTomEEMojo.java
index 474b94f829..21f0fb45d9 100644
---
a/maven/tomee-maven-plugin/src/main/java/org/apache/openejb/maven/plugin/UpdatableTomEEMojo.java
+++
b/maven/tomee-maven-plugin/src/main/java/org/apache/openejb/maven/plugin/UpdatableTomEEMojo.java
@@ -119,6 +119,7 @@ public abstract class UpdatableTomEEMojo extends
AbstractTomEEMojo {
if (systemVariables == null) {
systemVariables = new HashMap<>();
systemVariables.put("tomee.remote.support", "true");
+ systemVariables.put("openejb.internal.beans.security.enabled",
"false");
}
}
}
diff --git
a/server/openejb-common-cli/src/main/java/org/apache/openejb/server/cli/command/Deploy.java
b/server/openejb-common-cli/src/main/java/org/apache/openejb/server/cli/command/Deploy.java
index 2ffe178b18..9dc486fda9 100644
---
a/server/openejb-common-cli/src/main/java/org/apache/openejb/server/cli/command/Deploy.java
+++
b/server/openejb-common-cli/src/main/java/org/apache/openejb/server/cli/command/Deploy.java
@@ -17,14 +17,14 @@
package org.apache.openejb.server.cli.command;
-import org.apache.openejb.assembler.Deployer;
+import org.apache.openejb.assembler.DeployerEjb;
@Command(name = "deploy", usage = "deploy <location>", description = "deploy
an application")
public class Deploy extends AbstractCommand {
@Override
public void execute(String cmd) {
try {
- lookup(Deployer.class,
"openejb/DeployerBusinessRemote").deploy(cmd.trim());
+ new DeployerEjb().deploy(cmd.trim());
} catch (Exception e) {
streamManager.writeErr(e);
}
diff --git
a/server/openejb-common-cli/src/main/java/org/apache/openejb/server/cli/command/Undeploy.java
b/server/openejb-common-cli/src/main/java/org/apache/openejb/server/cli/command/Undeploy.java
index 53a45833bd..d9bcf2c309 100644
---
a/server/openejb-common-cli/src/main/java/org/apache/openejb/server/cli/command/Undeploy.java
+++
b/server/openejb-common-cli/src/main/java/org/apache/openejb/server/cli/command/Undeploy.java
@@ -17,14 +17,14 @@
package org.apache.openejb.server.cli.command;
-import org.apache.openejb.assembler.Deployer;
+import org.apache.openejb.assembler.DeployerEjb;
@Command(name = "undeploy", usage = "undeploy <location>", description =
"undeploy an application. Note the location should be the same than for deploy")
public class Undeploy extends AbstractCommand {
@Override
public void execute(String cmd) {
try {
- lookup(Deployer.class,
"openejb/DeployerBusinessRemote").undeploy(cmd.trim());
+ new DeployerEjb().undeploy(cmd.trim());
} catch (Exception e) {
streamManager.writeErr(e);
}
diff --git
a/tomee/apache-tomee/src/main/java/org/apache/tomee/RemoteTomEEEJBContainer.java
b/tomee/apache-tomee/src/main/java/org/apache/tomee/RemoteTomEEEJBContainer.java
index 011b8178e6..4f650ab37f 100644
---
a/tomee/apache-tomee/src/main/java/org/apache/tomee/RemoteTomEEEJBContainer.java
+++
b/tomee/apache-tomee/src/main/java/org/apache/tomee/RemoteTomEEEJBContainer.java
@@ -112,7 +112,8 @@ public class RemoteTomEEEJBContainer extends EJBContainer {
try {
instance.container.start(Arrays.asList(
"-Dtomee.serialization.class.blacklist=" +
System.getProperty("tomee.serialization.class.blacklist"),
- "-Dopenejb.system.apps=true",
"-Dtomee.remote.support=true"),
+ "-Dopenejb.system.apps=true",
"-Dtomee.remote.support=true",
+ "-Dopenejb.internal.beans.security.enabled=false"),
"start", true);
} catch (final Exception e) {
instance.container.destroy();
diff --git
a/tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/TomcatWebAppBuilder.java
b/tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/TomcatWebAppBuilder.java
index 33dae5986c..01da7ffe8a 100644
---
a/tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/TomcatWebAppBuilder.java
+++
b/tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/TomcatWebAppBuilder.java
@@ -427,29 +427,7 @@ public class TomcatWebAppBuilder implements WebAppBuilder,
ContextListener, Pare
}
@Override
- public void start(final StandardServer server) {
- if (SystemInstance.get().isDefaultProfile()) { // add user tomee is no
user are specified
- try {
- final NamingResourcesImpl resources =
server.getGlobalNamingResources();
- final ContextResource userDataBaseResource =
resources.findResource("UserDatabase");
- final UserDatabase db = (UserDatabase)
server.getGlobalNamingContext().lookup(userDataBaseResource.getName());
- if (!db.getUsers().hasNext() && db instanceof
MemoryUserDatabase mudb) {
- final boolean oldRo = mudb.getReadonly();
- try {
- mudb.setReadonly(false);
-
- db.createRole("tomee-admin", "tomee admin role");
- db.createUser("tomee", "tomee", "TomEE");
-
db.findUser("tomee").addRole(db.findRole("tomee-admin"));
- } finally {
- mudb.setReadonly(oldRo);
- }
- }
- } catch (final Throwable t) {
- // no-op
- }
- }
- }
+ public void start(final StandardServer server) { }
//
// OpenEJB WebAppBuilder
diff --git
a/tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/cluster/TomEEClusterListener.java
b/tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/cluster/TomEEClusterListener.java
index 63ccea05da..7e2ce2bbaf 100644
---
a/tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/cluster/TomEEClusterListener.java
+++
b/tomee/tomee-catalina/src/main/java/org/apache/tomee/catalina/cluster/TomEEClusterListener.java
@@ -22,8 +22,8 @@ import org.apache.openejb.NoSuchApplicationException;
import org.apache.openejb.OpenEJBException;
import org.apache.openejb.UndeployException;
import org.apache.openejb.assembler.Deployer;
+import org.apache.openejb.assembler.DeployerEjb;
import org.apache.openejb.assembler.classic.Assembler;
-import org.apache.openejb.core.LocalInitialContextFactory;
import org.apache.openejb.loader.Files;
import org.apache.openejb.loader.IO;
import org.apache.openejb.loader.SystemInstance;
@@ -31,9 +31,6 @@ import org.apache.openejb.util.DaemonThreadFactory;
import org.apache.openejb.util.LogCategory;
import org.apache.openejb.util.Logger;
-import javax.naming.Context;
-import javax.naming.InitialContext;
-import javax.naming.NamingException;
import java.io.File;
import java.util.Properties;
import java.util.concurrent.ExecutorService;
@@ -103,8 +100,8 @@ public class TomEEClusterListener extends ClusterListener {
return
SystemInstance.get().getComponent(Assembler.class).isDeployed(file);
}
- private static Deployer deployer() throws NamingException {
- return (Deployer) new
InitialContext(Static.IC_PROPS).lookup("openejb/DeployerBusinessRemote");
+ private static Deployer deployer() {
+ return new DeployerEjb();
}
@Override
@@ -141,8 +138,6 @@ public class TomEEClusterListener extends ClusterListener {
deployer().deploy(app, REMOTE_DEPLOY_PROPERTIES);
} catch (final OpenEJBException e) {
Static.LOGGER.warning("can't deploy: " + app, e);
- } catch (final NamingException e) {
- Static.LOGGER.warning("can't find deployer", e);
}
}
}
@@ -164,8 +159,6 @@ public class TomEEClusterListener extends ClusterListener {
Static.LOGGER.error("can't undeploy app", e);
} catch (final NoSuchApplicationException e) {
Static.LOGGER.warning("no app toi deploy", e);
- } catch (final NamingException e) {
- Static.LOGGER.warning("can't find deployer", e);
}
}
}
@@ -174,15 +167,10 @@ public class TomEEClusterListener extends ClusterListener
{
// lazy init of logger (can fail with shutdown hooks to kill the
container) and executor
private static final class Static {
private static final Logger LOGGER =
Logger.getInstance(LogCategory.OPENEJB, TomEEClusterListener.class);
- private static final Properties IC_PROPS = new Properties();
// async processing to avoid to make the cluster hanging
private static final ExecutorService SERVICE =
Executors.newSingleThreadExecutor(new
DaemonThreadFactory("TomEE-Cluster-Listener-thread-"));
- static {
- IC_PROPS.setProperty(Context.INITIAL_CONTEXT_FACTORY,
LocalInitialContextFactory.class.getName());
- }
-
private Static() {
// no-op
}
