coheigea opened a new pull request, #3679: URL: https://github.com/apache/cxf/pull/3679
When no rule applied to a method's signature, every role annotation recorded for its name applied. A method implementing a generic interface method, whose erased signature differs, therefore needed the roles of every method with the same name, an unannotated overload needed the roles of its annotated overloads, and an implementation's class-level @RolesAllowed, which applies to its own signature, hid the method-level @RolesAllowed of the generic interface method. As in OAuthScopesFilter and ClaimsAuthorizingInterceptor, the generic parameter types of the superclass and interface methods are now resolved against the class's type arguments (ReflectionUtil.getGenericallyOverriddenMethods), so a method also gets the rules of exactly the generic methods it overrides, and the name-based fallback is only used for methods which are not part of the secured object. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
