[jira] [Comment Edited] (DELTASPIKE-1294) Secured Stereotypes are not applied to inherited methods

["Gerhard Petracek (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/DELTASPIKE-1294?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16266687#comment-16266687 ] 

Gerhard Petracek edited comment on DELTASPIKE-1294 at 11/27/17 11:54 AM:
-------------------------------------------------------------------------

we could adjust SecuredAnnotationAuthorizer#extractMetadata to get rid of the inconsistency, however, we need a way to limit the evaluation to the mode we have currently.
as always both approaches have advantages and disadvantages.
i guess the reason for the inconsistency is caused by the origin of both annotations.
(@Secures came from seam3 whereas @Secured came from codi)

for now just annotate the base-class as well.
in case that isn't possible, because it is e.g. a class provided by a 3rd party library, it should be possible to override the methods (combined with a simple delegation to the method of the base class).


was (Author: gpetracek):
we could adjust SecuredAnnotationAuthorizer#extractMetadata to get rid of the inconsistency, however, we need a way to limit the evaluation to the mode we have currently.

for now just annotate the base-class as well.
in case that isn't possible, because it is e.g. a class provided by a 3rd party library, it should be possible to override the methods (combined with a simple delegation to the method of the base class).

> Secured Stereotypes are not applied to inherited methods
> --------------------------------------------------------
>
>                 Key: DELTASPIKE-1294
>                 URL: https://issues.apache.org/jira/browse/DELTASPIKE-1294
>             Project: DeltaSpike
>          Issue Type: Bug
>          Components: Security-Module
>    Affects Versions: 1.8.0
>            Reporter: Andrew Schmidt
>
> I have a @Secured @Stereotype annotation
> {code:java}
> @Retention( RUNTIME )
> @Stereotype
> @Inherited
> @Secured( CustomAccessDecisionVoter.class ) 
> @Target( { ElementType.TYPE, ElementType.METHOD } ) 
> public @interface Permission {
> }
> {code}
> And my decision voter:
> {code:java}
> @ApplicationScoped
> public class CustomAccessDecisionVoter extends AbstractAccessDecisionVoter {
>     @Override
>     protected void checkPermission( AccessDecisionVoterContext voterContext, Set<SecurityViolation> violations )
>     {
>         System.out.println( "Checking permission for " + voterContext.<InvocationContext> getSource().getMethod().getName() );
>     }
> }
> {code}
> And now a bean that inherits from another class
> {code:java}
> public class Animal
> {
>     public String getParentName()
>     {
>         return "parent";
>     }
> }
> {code}
> {code:java}
> @Named
> @Permission
> public class Dog extends Animal
> {
>     public String getChildName()
>     {
>         return "dog";
>     }
> }
> {code}
> In JSF dogName: 
> {code}#{dog.childName}{code} will invoke the checkPermission whereas   {code}#{dog.parentName}{code} will not
> This is in contrast to the @SecurityBindingType 
> {code:java}
> @Retention( value = RetentionPolicy.RUNTIME ) 
> @Target( { ElementType.TYPE, ElementType.METHOD } ) 
> @Documented 
> @SecurityBindingType
> public @interface UserLoggedIn {
> }
> {code}
> {code:java}
> @ApplicationScoped
> public class LoginAuthorizer
> {
>     @Secures
>     @UserLoggedIn
>     public boolean doSecuredCheck( InvocationContext invocationContext ) throws Exception
>     {
>         System.out.println( "doSecuredCheck called for: " + invocationContext.getMethod().getName() );
>         return true;
>     }
> }
> {code}
> Now applying @UserLoggedIn to  the Dog class will cause the doSecuredCheck to fire for both getChildName and getParentName



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)