coheigea opened a new pull request, #3669:
URL: https://github.com/apache/cxf/pull/3669
The problem: SecureAnnotationsInterceptor looks for @RolesAllowed on the
service class, then its parent classes, then its interfaces. But it stopped as
soon as it found any @RolesAllowed. So once the class annotated even one
method, these were silently ignored:
- @RolesAllowed on interface methods, which is common for JAX-WS service
interfaces;
- a parent class method’s @RolesAllowed, when the class overrides that
method without re-annotating it;
- a parent class’s class-wide @RolesAllowed.
A method with no roles is allowed by default, including for anonymous
callers, so those methods were open to everyone.
The fix: roles work the same way as @Scopes and @Claim in the earlier fixes:
- Every applicable @RolesAllowed must be met: on the class, parent classes
and interfaces.
- Class-wide defaults can be replaced: a method’s own @RolesAllowed
replaces a class-wide one from its class, or from a parent class or interface.
- Method rules can’t be weakened: an override can add roles but can’t
remove a parent method’s roles.
- Generic interface methods stay protected for now: they need the roles of
every method with the same name. That’s fail-closed, and the next patch makes
it exact.
- Configured roles add to annotations: roles set with setMethodRolesMap
apply in addition to annotations, as for OAuthScopesFilter, instead of one
replacing the other depending on setter order.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
