You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@geronimo.apache.org by "David Jencks (JIRA)" <ji...@apache.org> on 2007/04/07 08:37:32 UTC
[jira] Created: (GERONIMO-3072) security bugs in openejb
integration
security bugs in openejb integration
------------------------------------
Key: GERONIMO-3072
URL: https://issues.apache.org/jira/browse/GERONIMO-3072
Project: Geronimo
Issue Type: Bug
Security Level: public (Regular issues)
Components: OpenEJB
Affects Versions: 2.0-M4
Reporter: David Jencks
Assigned To: David Jencks
Fix For: 2.0-M5
There are a few problems in the security setup:
- role-links are not required any more, if missing a value equal to the role name is assumed
- if methodIntf is null don't try to turn it into a string
- need to actually construct set of all possible ejb method permissions, not the empty set
- need to actually set whether or not security is enabled
- run-as processing requires all calls to push the run-as subject, even if it is null. Otherwise the next ejb won't get called with the previous ejbs run-as subject.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Closed: (GERONIMO-3072) security bugs in openejb integration
Posted by "David Jencks (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/GERONIMO-3072?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
David Jencks closed GERONIMO-3072.
----------------------------------
Resolution: Fixed
These issues fixed in rev 526376.
> security bugs in openejb integration
> ------------------------------------
>
> Key: GERONIMO-3072
> URL: https://issues.apache.org/jira/browse/GERONIMO-3072
> Project: Geronimo
> Issue Type: Bug
> Security Level: public(Regular issues)
> Components: OpenEJB
> Affects Versions: 2.0-M4
> Reporter: David Jencks
> Assigned To: David Jencks
> Fix For: 2.0-M5
>
>
> There are a few problems in the security setup:
> - role-links are not required any more, if missing a value equal to the role name is assumed
> - if methodIntf is null don't try to turn it into a string
> - need to actually construct set of all possible ejb method permissions, not the empty set
> - need to actually set whether or not security is enabled
> - run-as processing requires all calls to push the run-as subject, even if it is null. Otherwise the next ejb won't get called with the previous ejbs run-as subject.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.