You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@cxf.apache.org by "Sergey Beryozkin (JIRA)" <ji...@apache.org> on 2011/02/09 17:33:58 UTC
[jira] Created: (CXF-3322) Introduce the interface which CXF
SecurityContexts can optionally implement
Introduce the interface which CXF SecurityContexts can optionally implement
---------------------------------------------------------------------------
Key: CXF-3322
URL: https://issues.apache.org/jira/browse/CXF-3322
Project: CXF
Issue Type: Improvement
Components: Core
Affects Versions: 2.3.2
Reporter: Sergey Beryozkin
Fix For: 2.4, 2.3.3
As discussed with Christian, it would be handy to have an access to the list of roles and possibly Subject representing a current authenticated Principal. That will be useful for the advanced context propagation cases work better.
CXF SecurityContexts can optionally implement it and then CXF interceptors sitting after JAASLoginInterceptor or WS-Security related authorization interceptors can get the list of roles or the Subject and wrap into Spring Security contexts, etc, etc
--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Commented: (CXF-3322) Introduce the extended SecurityContext
interface
Posted by "Christian Schneider (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/CXF-3322?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12992782#comment-12992782 ]
Christian Schneider commented on CXF-3322:
------------------------------------------
Hi Sergey,
I propose to express roles simply as String. That should be enough for most contexts. I think roles should not be of type Principal.
So I propose to add Set<String> getRoles() to SecurityContext are to interface that implements SecurityContext.
Additionally we could have a JaasLoginContext implements the above and also has Subject getSubject().
What do you think?
Christian
> Introduce the extended SecurityContext interface
> ------------------------------------------------
>
> Key: CXF-3322
> URL: https://issues.apache.org/jira/browse/CXF-3322
> Project: CXF
> Issue Type: Improvement
> Components: Core
> Affects Versions: 2.3.2
> Reporter: Sergey Beryozkin
> Fix For: 2.4, 2.3.3
>
>
> As discussed with Christian, it would be handy to have an access to the list of roles and possibly Subject representing a current authenticated Principal. That will be useful for the advanced context propagation cases work better.
> CXF SecurityContexts can optionally implement it and then CXF interceptors sitting after JAASLoginInterceptor or WS-Security related authorization interceptors can get the list of roles or the Subject and wrap into Spring Security contexts, etc, etc
--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Resolved: (CXF-3322) Introduce the extended SecurityContext
interface
Posted by "Sergey Beryozkin (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/CXF-3322?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Sergey Beryozkin resolved CXF-3322.
-----------------------------------
Resolution: Fixed
Assignee: Sergey Beryozkin
We will update this interface if it proves to be incomplete
> Introduce the extended SecurityContext interface
> ------------------------------------------------
>
> Key: CXF-3322
> URL: https://issues.apache.org/jira/browse/CXF-3322
> Project: CXF
> Issue Type: Improvement
> Components: Core
> Affects Versions: 2.3.2
> Reporter: Sergey Beryozkin
> Assignee: Sergey Beryozkin
> Fix For: 2.4, 2.3.3
>
>
> As discussed with Christian, it would be handy to have an access to the list of roles and possibly Subject representing a current authenticated Principal. That will be useful for the advanced context propagation cases work better.
> CXF SecurityContexts can optionally implement it and then CXF interceptors sitting after JAASLoginInterceptor or WS-Security related authorization interceptors can get the list of roles or the Subject and wrap into Spring Security contexts, etc, etc
--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] Updated: (CXF-3322) Introduce the extended SecurityContext
interface
Posted by "Sergey Beryozkin (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/CXF-3322?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Sergey Beryozkin updated CXF-3322:
----------------------------------
Summary: Introduce the extended SecurityContext interface (was: Introduce the interface which CXF SecurityContexts can optionally implement)
> Introduce the extended SecurityContext interface
> ------------------------------------------------
>
> Key: CXF-3322
> URL: https://issues.apache.org/jira/browse/CXF-3322
> Project: CXF
> Issue Type: Improvement
> Components: Core
> Affects Versions: 2.3.2
> Reporter: Sergey Beryozkin
> Fix For: 2.4, 2.3.3
>
>
> As discussed with Christian, it would be handy to have an access to the list of roles and possibly Subject representing a current authenticated Principal. That will be useful for the advanced context propagation cases work better.
> CXF SecurityContexts can optionally implement it and then CXF interceptors sitting after JAASLoginInterceptor or WS-Security related authorization interceptors can get the list of roles or the Subject and wrap into Spring Security contexts, etc, etc
--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira