Bugs item #1054897, was opened at 2004-10-26 15:15 Message generated for change (Comment added) made by starksm You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=376685&aid=1054897&group_id=22866
Category: JBossSX Group: v4.0 >Status: Closed >Resolution: Fixed Priority: 5 Submitted By: Stephen Kinser (skinser) Assigned to: Scott M Stark (starksm) >Summary: JACC incorrect when checking auth for WebResourcePermission Initial Comment: During deployment When a WebResourcePermission or a WebUserDataPermission is constructed by the AbstractWebDeployer for a security-constraint that doesn't specify a http-method element, the httpMethods instance variable will be empty. JBoss does this correctly and conforms to section 3.1.3.1 of the JACC 1.0 specification. The defect occurs when the JaccAuthorizationRealm's hasResourcePermission consults the policy for the authorization decision. For example, when a user sends a HTTP Get Request to a resource, the hasResourcePermission correctly constructs a new WebResourcePermission object with the actions set to GET. The JaccAuthorizationRealm then passes this object to the policy for the authorization decision. The policy matches the target WebResourcePermission with a WebResourcePermission inside of the ContextPolicy, but the implies method of the WebResourcePermission checks that GET is included in its httpMethods and returns false since httpMethods is empty. The WebResourcePermission class improperly handles an empty httpMethods. The proper way is to check for an empty httpMethods before checking that all of the httpMethods in the desired WebResourcePermission are contained in the granted WebResourcePermission. The defect in the WebResourcePermission implies method is also in the implies method of the WebUserDataPermission class. An alternative to modifying the implies methods would be to modify the AbstractWebDeployer class to explicitly populate the httpMethods in the permission objects with all of the http methods. To duplicate, take a fresh install of JBoss 4.0.0, install the tomcat50-service.jar patch, unzip the webapp.zip file, and run JBoss default server. Open http://localhost:8080/webapp/index.jsp and authenticate as admin with a password of test (see user.properties file in zip). You should be granted access according to web.xml, but will be denied access due to this defect. See the log for more confirmation. ---------------------------------------------------------------------- >Comment By: Scott M Stark (starksm) Date: 2004-11-05 19:00 Message: Logged In: YES user_id=175228 This has been fixed by nulling the actions set returned from canonicalMethods(TreeSet actions) when actions.equals(ALL_HTTP_METHODS) || actions.size() == 0 It will be in the 4.0.1 final release. ---------------------------------------------------------------------- Comment By: Scott M Stark (starksm) Date: 2004-10-28 09:04 Message: Logged In: YES user_id=175228 I'll look into this shortly and I have seen the related 1055650 patch. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=376685&aid=1054897&group_id=22866 ------------------------------------------------------- This SF.Net email is sponsored by: Sybase ASE Linux Express Edition - download now for FREE LinuxWorld Reader's Choice Award Winner for best database on Linux. http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click _______________________________________________ JBoss-Development mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-development
