You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@geronimo.apache.org by "Han Hong Fang (JIRA)" <ji...@apache.org> on 2010/09/07 18:40:32 UTC
[jira] Created: (GERONIMO-5577) Support ServeltSecurity annotation
when the servlets are added by ServletContext.addServlet methods
Support ServeltSecurity annotation when the servlets are added by ServletContext.addServlet methods
---------------------------------------------------------------------------------------------------
Key: GERONIMO-5577
URL: https://issues.apache.org/jira/browse/GERONIMO-5577
Project: Geronimo
Issue Type: New Feature
Security Level: public (Regular issues)
Components: web
Affects Versions: 3.0
Reporter: Han Hong Fang
Assignee: Han Hong Fang
Servlet 3.0 spec has following statements in chapter 13.4.1.
The @ServletSecurity annotation provides an alternative mechanism for
defining access control constraints equivalent to those that could otherwise have
been expressed declaratively via security-constraint elements in the portable
deployment descriptor or programmatically via the setServletSecurity method
of the ServletRegistration interface. Servlet containers MUST support the use
of the @ServletSecurity annotation on classes (and subclasses thereof) that
implement the javax.servlet.Servlet interface.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (GERONIMO-5577) Support ServeltSecurity
annotation when the servlets are added by ServletContext.addServlet methods
Posted by "David Jencks (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/GERONIMO-5577?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12915392#action_12915392 ]
David Jencks commented on GERONIMO-5577:
----------------------------------------
rev 1001836 uses some proposed changes in tomcat security contracts (GERONIMO-5626) to avoid the need to wrap ServletContext and ServletRegistration.Dynamic.
> Support ServeltSecurity annotation when the servlets are added by ServletContext.addServlet methods
> ---------------------------------------------------------------------------------------------------
>
> Key: GERONIMO-5577
> URL: https://issues.apache.org/jira/browse/GERONIMO-5577
> Project: Geronimo
> Issue Type: New Feature
> Security Level: public(Regular issues)
> Components: web
> Affects Versions: 3.0
> Reporter: Han Hong Fang
> Assignee: Ivan
> Fix For: 3.0
>
> Attachments: GERONIMO-5577.patch
>
>
> Servlet 3.0 spec has following statements in chapter 13.4.1.
> The @ServletSecurity annotation provides an alternative mechanism for
> defining access control constraints equivalent to those that could otherwise have
> been expressed declaratively via security-constraint elements in the portable
> deployment descriptor or programmatically via the setServletSecurity method
> of the ServletRegistration interface. Servlet containers MUST support the use
> of the @ServletSecurity annotation on classes (and subclasses thereof) that
> implement the javax.servlet.Servlet interface.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (GERONIMO-5577) Support ServeltSecurity annotation
when the servlets are added by ServletContext.addServlet methods
Posted by "Ivan (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/GERONIMO-5577?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ivan resolved GERONIMO-5577.
----------------------------
Fix Version/s: 3.0
Resolution: Fixed
This patch is included in the commit at rev. 1000329, thanks, Han Hong Fang !
> Support ServeltSecurity annotation when the servlets are added by ServletContext.addServlet methods
> ---------------------------------------------------------------------------------------------------
>
> Key: GERONIMO-5577
> URL: https://issues.apache.org/jira/browse/GERONIMO-5577
> Project: Geronimo
> Issue Type: New Feature
> Security Level: public(Regular issues)
> Components: web
> Affects Versions: 3.0
> Reporter: Han Hong Fang
> Assignee: Ivan
> Fix For: 3.0
>
> Attachments: GERONIMO-5577.patch
>
>
> Servlet 3.0 spec has following statements in chapter 13.4.1.
> The @ServletSecurity annotation provides an alternative mechanism for
> defining access control constraints equivalent to those that could otherwise have
> been expressed declaratively via security-constraint elements in the portable
> deployment descriptor or programmatically via the setServletSecurity method
> of the ServletRegistration interface. Servlet containers MUST support the use
> of the @ServletSecurity annotation on classes (and subclasses thereof) that
> implement the javax.servlet.Servlet interface.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (GERONIMO-5577) Support ServeltSecurity
annotation when the servlets are added by ServletContext.addServlet methods
Posted by "Han Hong Fang (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/GERONIMO-5577?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12907116#action_12907116 ]
Han Hong Fang commented on GERONIMO-5577:
-----------------------------------------
Automatic test case is provided to test the implementation: https://issues.apache.org/jira/browse/GERONIMO-5581
> Support ServeltSecurity annotation when the servlets are added by ServletContext.addServlet methods
> ---------------------------------------------------------------------------------------------------
>
> Key: GERONIMO-5577
> URL: https://issues.apache.org/jira/browse/GERONIMO-5577
> Project: Geronimo
> Issue Type: New Feature
> Security Level: public(Regular issues)
> Components: web
> Affects Versions: 3.0
> Reporter: Han Hong Fang
> Assignee: Han Hong Fang
>
> Servlet 3.0 spec has following statements in chapter 13.4.1.
> The @ServletSecurity annotation provides an alternative mechanism for
> defining access control constraints equivalent to those that could otherwise have
> been expressed declaratively via security-constraint elements in the portable
> deployment descriptor or programmatically via the setServletSecurity method
> of the ServletRegistration interface. Servlet containers MUST support the use
> of the @ServletSecurity annotation on classes (and subclasses thereof) that
> implement the javax.servlet.Servlet interface.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (GERONIMO-5577) Support ServeltSecurity annotation
when the servlets are added by ServletContext.addServlet methods
Posted by "Han Hong Fang (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/GERONIMO-5577?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Han Hong Fang updated GERONIMO-5577:
------------------------------------
Attachment: GERONIMO-5577.patch
Highlight some important statements in the spec for this topic.
- setServletSecurity of ServletRegistation.Dynamic: this method applies the security constraint to all mappings added to this ServletRegistration up until the point that the ServletContext from which it was obtained has been initialized.
- The @ServletSecurity annotation is not applied to the url-patterns of a ServletRegistration created using the addServlet(String, Servlet) method of the ServletContext interface, unless the Servlet was constructed by the createServlet method of the ServletContext interface.
- The @ServletSecurity annoation applies to the url-patterns of a ServletRegistration created using the addServlet(String, String) and addServlet(String, Class<?>) method of the ServletContext interface
- Security constraints on URLs has following priority from high to low: web.xml, ServletRegistration.Dynamic.setServletSecurity(), @ServletSecurity
BTW, the patch is for tomcat only. For jetty it is a todo item.
Please help to review. Thanks!
> Support ServeltSecurity annotation when the servlets are added by ServletContext.addServlet methods
> ---------------------------------------------------------------------------------------------------
>
> Key: GERONIMO-5577
> URL: https://issues.apache.org/jira/browse/GERONIMO-5577
> Project: Geronimo
> Issue Type: New Feature
> Security Level: public(Regular issues)
> Components: web
> Affects Versions: 3.0
> Reporter: Han Hong Fang
> Assignee: Han Hong Fang
> Attachments: GERONIMO-5577.patch
>
>
> Servlet 3.0 spec has following statements in chapter 13.4.1.
> The @ServletSecurity annotation provides an alternative mechanism for
> defining access control constraints equivalent to those that could otherwise have
> been expressed declaratively via security-constraint elements in the portable
> deployment descriptor or programmatically via the setServletSecurity method
> of the ServletRegistration interface. Servlet containers MUST support the use
> of the @ServletSecurity annotation on classes (and subclasses thereof) that
> implement the javax.servlet.Servlet interface.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Assigned: (GERONIMO-5577) Support ServeltSecurity annotation
when the servlets are added by ServletContext.addServlet methods
Posted by "Ivan (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/GERONIMO-5577?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ivan reassigned GERONIMO-5577:
------------------------------
Assignee: Ivan (was: Han Hong Fang)
> Support ServeltSecurity annotation when the servlets are added by ServletContext.addServlet methods
> ---------------------------------------------------------------------------------------------------
>
> Key: GERONIMO-5577
> URL: https://issues.apache.org/jira/browse/GERONIMO-5577
> Project: Geronimo
> Issue Type: New Feature
> Security Level: public(Regular issues)
> Components: web
> Affects Versions: 3.0
> Reporter: Han Hong Fang
> Assignee: Ivan
> Attachments: GERONIMO-5577.patch
>
>
> Servlet 3.0 spec has following statements in chapter 13.4.1.
> The @ServletSecurity annotation provides an alternative mechanism for
> defining access control constraints equivalent to those that could otherwise have
> been expressed declaratively via security-constraint elements in the portable
> deployment descriptor or programmatically via the setServletSecurity method
> of the ServletRegistration interface. Servlet containers MUST support the use
> of the @ServletSecurity annotation on classes (and subclasses thereof) that
> implement the javax.servlet.Servlet interface.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.