coheigea opened a new pull request, #3684: URL: https://github.com/apache/cxf/pull/3684
…ptor SimpleAuthorizingInterceptor.isUserInRole ignored the deny flag when a user roles map was set or only the configured roles were checked. For the deny roles returned by a getDenyRoles override, a user with a deny role in the user roles map was therefore authorized, while a user without one, or not in the map, was denied; with checkConfiguredRolesOnly and no user roles map every user was denied. For deny roles, a user is now authorized only if they have none of them, whether from the security context (unless only the configured roles are checked) or from the user roles map, and "*" denies every user. The check of the expected roles is unchanged. This also applies to OperationInfoAuthorizingInterceptor. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
