reta commented on code in PR #3664:
URL: https://github.com/apache/cxf/pull/3664#discussion_r4443625451
##########
core/src/main/java/org/apache/cxf/interceptor/security/SecureAnnotationsInterceptor.java:
##########
@@ -58,10 +67,41 @@ public void setAnnotationClassName(String name) {
ex.printStackTrace();
throw new IllegalArgumentException("Annotation class " + name + "
is not available");
}
+ resolveSecuredObjectRoles();
}
public void setSecuredObject(Object object) {
Class<?> cls = ClassHelper.getRealClass(object);
+ securedObjectClasses.add(cls);
+ addRoles(cls, Collections.emptyMap());
+ }
+
+ /**
+ * The roles are read from the annotations when the secured object is set,
so read them
+ * again with the new annotation class for any secured object which was
set before it.
+ * Otherwise the roles would come from the default annotation class, and a
service using
+ * another annotation would be left unprotected.
+ */
+ private void resolveSecuredObjectRoles() {
+ if (securedObjectClasses.isEmpty()) {
+ return;
+ }
+ for (Map.Entry<String, List<String>> entry :
annotationRoles.entrySet()) {
+ // Keep an entry which setMethodRolesMap has replaced since
+ if (methodRolesMap.get(entry.getKey()) == entry.getValue()) {
Review Comment:
Oh I see, so you really needed identity check, 👍
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
