[jira] [Commented] (TOMEE-3725) Returns invalid principal - javax.security.enterprise.SecurityContext

["Richard Zowalla (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/TOMEE-3725?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17330020#comment-17330020 ] 

Richard Zowalla commented on TOMEE-3725:
----------------------------------------

There is currently active development targeting 8.0.7-SNAPSHOT / 9.0.0-M7 to pass the related TCK, which also includes security-related stuff. [~jlmonteiro] did some work on the security impl recently. Might work in a 8.0.7-SNAPSHOT build -> maybe give it a try and report back?

> Returns invalid principal -  javax.security.enterprise.SecurityContext
> ----------------------------------------------------------------------
>
>                 Key: TOMEE-3725
>                 URL: https://issues.apache.org/jira/browse/TOMEE-3725
>             Project: TomEE
>          Issue Type: Bug
>          Components: TomEE Core Server
>    Affects Versions: 8.0.6
>            Reporter: Pramod
>            Priority: Major
>             Fix For: 8.0.6
>
>
> We used apache-tomee-plume-8.0.6 for this issue reproduce.
> We use our own JASPIC implementation for security, which works fine so far. It creates a CallerPrincipalCallback with subject and our own AuthenticatedUser principal. But if we call in an EJB ctx.getCallerPrincipal we get "GenericPrincipal"
> "getCallerPrincipal >[TomcatUser: GenericPrincipal[XXXXX(JFOXXXST.administrator,JFOXXXST.users,)]]"
>  
> & NOT AuthenticatedUser principal- It seems our REQUIRED principal is not propagated correctly from servlet container to EJB container, the same works fine in OpenLiberty 21.0.0.X
>  
> After spending some more check in security - looks like tomee-security-8.0.6.jar has below implementation which is returning empty set - is this expected? or future implementation will be provided?
>  public Principal getCallerPrincipal()
>  {
>  return this.securityService.getCallerPrincipal();
>  }
> public <T extends Principal> Set<T> getPrincipalsByType(Class<T> pType)
> { return Collections.emptySet(); }



--
This message was sent by Atlassian Jira
(v8.3.4#803005)