You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2020/10/07 19:34:40 UTC
[tomcat] branch 8.5.x updated (0d0a5c6 -> 7c50a4f)
This is an automated email from the ASF dual-hosted git repository.
markt pushed a change to branch 8.5.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git.
from 0d0a5c6 Update .travis.yml
new 51586d2 Increment version for next development cycle
new 7c50a4f Fix BZ 55559. Add local JNDI support to the UserDatabaseRealm
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
build.properties.default | 2 +-
.../apache/catalina/realm/UserDatabaseRealm.java | 112 ++++++++++++++++-----
.../apache/catalina/realm/mbeans-descriptors.xml | 4 +
res/maven/mvn.properties.default | 2 +-
webapps/docs/changelog.xml | 15 ++-
webapps/docs/config/realm.xml | 7 ++
6 files changed, 116 insertions(+), 26 deletions(-)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[tomcat] 01/02: Increment version for next development cycle
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch 8.5.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 51586d2c3573b3eaa90749fe3c9ea7043aeb14f2
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Wed Oct 7 20:31:51 2020 +0100
Increment version for next development cycle
---
build.properties.default | 2 +-
res/maven/mvn.properties.default | 2 +-
webapps/docs/changelog.xml | 4 +++-
3 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/build.properties.default b/build.properties.default
index 761e161..d19e2eb 100644
--- a/build.properties.default
+++ b/build.properties.default
@@ -25,7 +25,7 @@
# ----- Version Control Flags -----
version.major=8
version.minor=5
-version.build=59
+version.build=60
version.patch=0
version.suffix=-dev
diff --git a/res/maven/mvn.properties.default b/res/maven/mvn.properties.default
index e44bcff..b8d9762 100644
--- a/res/maven/mvn.properties.default
+++ b/res/maven/mvn.properties.default
@@ -39,7 +39,7 @@ maven.asf.release.repo.url=https://repository.apache.org/service/local/staging/d
maven.asf.release.repo.repositoryId=apache.releases.https
# Release version info
-maven.asf.release.deploy.version=8.5.59
+maven.asf.release.deploy.version=8.5.60
#Where do we load the libraries from
tomcat.lib.path=../../output/build/lib
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index ba638f4..0755aba 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -44,7 +44,9 @@
They eventually become mixed with the numbered issues (i.e., numbered
issues do not "pop up" wrt. others).
-->
-<section name="Tomcat 8.5.59 (markt)" rtext="in development">
+<section name="Tomcat 8.5.60 (markt)" rtext="in development">
+</section>
+<section name="Tomcat 8.5.59 (markt)" rtext="release in progress">
<subsection name="Catalina">
<changelog>
<fix>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[tomcat] 02/02: Fix BZ 55559. Add local JNDI support to the
UserDatabaseRealm
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch 8.5.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 7c50a4f36b3b8dcdff4e1b57ab649d65f09bd8dd
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Wed Oct 7 20:21:56 2020 +0100
Fix BZ 55559. Add local JNDI support to the UserDatabaseRealm
---
.../apache/catalina/realm/UserDatabaseRealm.java | 112 ++++++++++++++++-----
.../apache/catalina/realm/mbeans-descriptors.xml | 4 +
webapps/docs/changelog.xml | 11 ++
webapps/docs/config/realm.xml | 7 ++
4 files changed, 111 insertions(+), 23 deletions(-)
diff --git a/java/org/apache/catalina/realm/UserDatabaseRealm.java b/java/org/apache/catalina/realm/UserDatabaseRealm.java
index bd2a7aa..418f8fd 100644
--- a/java/org/apache/catalina/realm/UserDatabaseRealm.java
+++ b/java/org/apache/catalina/realm/UserDatabaseRealm.java
@@ -30,13 +30,14 @@ import org.apache.catalina.User;
import org.apache.catalina.UserDatabase;
import org.apache.catalina.Wrapper;
import org.apache.catalina.users.MemoryUserDatabase;
+import org.apache.naming.ContextBindings;
import org.apache.tomcat.util.ExceptionUtils;
/**
* Implementation of {@link org.apache.catalina.Realm} that is based on an
- * implementation of {@link UserDatabase} made available through the global JNDI
+ * implementation of {@link UserDatabase} made available through the JNDI
* resources configured for this instance of Catalina. Set the
- * <code>resourceName</code> parameter to the global JNDI resources name for the
+ * <code>resourceName</code> parameter to the JNDI resources name for the
* configured instance of <code>UserDatabase</code> that we should consult.
*
* @author Craig R. McClanahan
@@ -50,7 +51,8 @@ public class UserDatabaseRealm extends RealmBase {
* The <code>UserDatabase</code> we will use to authenticate users and
* identify associated roles.
*/
- protected UserDatabase database = null;
+ protected volatile UserDatabase database = null;
+ private final Object databaseLock = new Object();
/**
* Descriptive information about this Realm implementation.
@@ -66,6 +68,11 @@ public class UserDatabaseRealm extends RealmBase {
*/
protected String resourceName = "UserDatabase";
+ /**
+ * Obtain the UserDatabase from the context (rather than global) JNDI.
+ */
+ private boolean localJndiResource = false;
+
// ------------------------------------------------------------- Properties
@@ -89,6 +96,31 @@ public class UserDatabaseRealm extends RealmBase {
}
+ /**
+ * Determines whether this Realm is configured to obtain the associated
+ * {@link UserDatabase} from the global JNDI context or a local (web
+ * application) JNDI context.
+ *
+ * @return {@code true} if a local JNDI context will be used, {@code false}
+ * if the the global JNDI context will be used
+ */
+ public boolean getLocalJndiResource() {
+ return localJndiResource;
+ }
+
+
+ /**
+ * Configure whether this Realm obtains the associated {@link UserDatabase}
+ * from the global JNDI context or a local (web application) JNDI context.
+ *
+ * @param localJndiResource {@code true} to use a local JNDI context,
+ * {@code false} to use the global JNDI context
+ */
+ public void setLocalJndiResource(boolean localJndiResource) {
+ this.localJndiResource = localJndiResource;
+ }
+
+
// --------------------------------------------------------- Public Methods
/**
@@ -103,6 +135,12 @@ public class UserDatabaseRealm extends RealmBase {
*/
@Override
public boolean hasRole(Wrapper wrapper, Principal principal, String role) {
+
+ UserDatabase database = getUserDatabase();
+ if (database == null) {
+ return false;
+ }
+
// Check for a role alias defined in a <security-role-ref> element
if (wrapper != null) {
String realRole = wrapper.findSecurityReference(role);
@@ -156,6 +194,7 @@ public class UserDatabaseRealm extends RealmBase {
@Override
public void backgroundProcess() {
+ UserDatabase database = getUserDatabase();
if (database instanceof MemoryUserDatabase) {
((MemoryUserDatabase) database).backgroundProcess();
}
@@ -167,6 +206,11 @@ public class UserDatabaseRealm extends RealmBase {
*/
@Override
protected String getPassword(String username) {
+ UserDatabase database = getUserDatabase();
+ if (database == null) {
+ return null;
+ }
+
User user = database.findUser(username);
if (user == null) {
@@ -182,6 +226,10 @@ public class UserDatabaseRealm extends RealmBase {
*/
@Override
protected Principal getPrincipal(String username) {
+ UserDatabase database = getUserDatabase();
+ if (database == null) {
+ return null;
+ }
User user = database.findUser(username);
if (user == null) {
@@ -207,30 +255,48 @@ public class UserDatabaseRealm extends RealmBase {
}
+ /*
+ * Can't do this in startInternal() with local JNDI as the local JNDI
+ * context won't be initialised at this point.
+ */
+ private UserDatabase getUserDatabase() {
+ // DCL so database MUST be volatile
+ if (database == null) {
+ synchronized (databaseLock) {
+ if (database == null) {
+ try {
+ Context context = null;
+ if (localJndiResource) {
+ context = ContextBindings.getClassLoader();
+ context = (Context) context.lookup("comp/env");
+ } else {
+ context = getServer().getGlobalNamingContext();
+ }
+ database = (UserDatabase) context.lookup(resourceName);
+ } catch (Throwable e) {
+ ExceptionUtils.handleThrowable(e);
+ containerLog.error(sm.getString("userDatabaseRealm.lookup", resourceName), e);
+ database = null;
+ }
+ }
+ }
+ }
+ return database;
+ }
+
+
// ------------------------------------------------------ Lifecycle Methods
- /**
- * Prepare for the beginning of active use of the public methods of this
- * component and implement the requirements of
- * {@link org.apache.catalina.util.LifecycleBase#startInternal()}.
- *
- * @exception LifecycleException if this component detects a fatal error
- * that prevents this component from being used
- */
@Override
protected void startInternal() throws LifecycleException {
-
- try {
- Context context = getServer().getGlobalNamingContext();
- database = (UserDatabase) context.lookup(resourceName);
- } catch (Throwable e) {
- ExceptionUtils.handleThrowable(e);
- containerLog.error(sm.getString("userDatabaseRealm.lookup", resourceName), e);
- database = null;
- }
- if (database == null) {
- throw new LifecycleException(
- sm.getString("userDatabaseRealm.noDatabase", resourceName));
+ // If the JNDI resource is global, check it here and fail the context
+ // start if it is not valid. Local JNDI resources can't be validated
+ // this way because the JNDI context isn't available at Realm start.
+ if (!localJndiResource) {
+ UserDatabase database = getUserDatabase();
+ if (database == null) {
+ throw new LifecycleException(sm.getString("userDatabaseRealm.noDatabase", resourceName));
+ }
}
super.startInternal();
diff --git a/java/org/apache/catalina/realm/mbeans-descriptors.xml b/java/org/apache/catalina/realm/mbeans-descriptors.xml
index a75a66d..031afce 100644
--- a/java/org/apache/catalina/realm/mbeans-descriptors.xml
+++ b/java/org/apache/catalina/realm/mbeans-descriptors.xml
@@ -400,6 +400,10 @@
description="The global JNDI name of the UserDatabase resource to use"
type="java.lang.String"/>
+ <attribute name="localJndiResource"
+ description="Configures if the UserDatabase JNDI definition is local to the webapp"
+ type="boolean"/>
+
<attribute name="realmPath"
description="The realm path"
type="java.lang.String"/>
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 0755aba..69ff0fb 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -45,6 +45,17 @@
issues do not "pop up" wrt. others).
-->
<section name="Tomcat 8.5.60 (markt)" rtext="in development">
+ <subsection name="Catalina">
+ <changelog>
+ <fix>
+ <bug>55559</bug>: Add a new attribute, <code>localJndiResource</code>,
+ that allows a UserDatabaseRealm to obtain a UserDatabase instance from
+ the local (web application) JNDI context rather than the global JNDI
+ context. This option is only useful when the Realm is defined on the
+ Context. (markt)
+ </fix>
+ </changelog>
+ </subsection>
</section>
<section name="Tomcat 8.5.59 (markt)" rtext="release in progress">
<subsection name="Catalina">
diff --git a/webapps/docs/config/realm.xml b/webapps/docs/config/realm.xml
index 8cf4381..db60315 100644
--- a/webapps/docs/config/realm.xml
+++ b/webapps/docs/config/realm.xml
@@ -640,6 +640,13 @@
one of those roles.</p>
</attribute>
+ <attribute name="localJndiResource" required="false">
+ <p>When the realm is nested inside a Context element, this allows the
+ realm to use a UserDatabase defined for the Context rather than a global
+ UserDatabase. If not specified, the default is <code>false</code>: use a
+ global UserDatabase.</p>
+ </attribute>
+
<attribute name="resourceName" required="true">
<p>The name of the global <code>UserDatabase</code> resource
that this realm will use for user, password and role information.</p>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org