Skip to main content
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [glassfish-dev] Dropping org.glassfish.security.services.common.Secure
Hi,

I agree, right now I am experiencing the weird situation when I have SecurityManager disabled in unit test, but AuthorizationServiceImpl still fails to pass security validations. I believe it is a bug, but I am not sure. If it is a bug (?), we can just fix it for GlassFish6, it should be simple.

At least I can use mock as an alternative now, but ...

Kind regards,
David Matějček

On 30. 08. 21 17:44, arjan tijms wrote:
Hi,

GlassFish internally uses the @Security annotation to set code level security for a small number of services. This is directly based on the SecurityManager machinery, which is deprecated for removal.

It's not used on many services, around 9 or so. For instance:

@Service (name="simpleAuthorization")
@Secure(accessPermissionName = "security/service/authorization/provider/simple")
public class SimpleAuthorizationProviderImpl implements AuthorizationProvider {
    // ...
}

The Javadoc is:

/**
 * Qualifier used to enable a security check at the point of service injection or lookup.
 * Security Services, which are to protected against unqualified injection/look-up, should be annotated as something below
 *   e.g.,   @Secure(accessPermissionName = "security/service/<service-type>/<some-specific-name>")
 *
 * Any caller which injects or looks up the protected security service, the caller's jar/class should be granted the following policy
 *   e.g.,
 *     grant codeBase "file:<path>/<to>/<caller-jar>" {
 *         permission org.glassfish.security.services.common.SecureServiceAccessPermission "security/service/<service-type>/<some-specific-name>";
 *     };
 *
 */

There's a couple of things we can do:

* For GlassFish 7 just remove @Secure. Pull off the band-aid quickly, feel the pain (or not, who really cares about them?) and move on.
* Introduce an explicit parameter to disable the security manager check (disable by default on 7, enable by default on 6) while deprecating for removal @Secure 
* For GlassFish 7, decide being enabled or not on whether the SecurityManager is actually enabled or not (I feel that it maybe had to be like that from the start, but alas)

Thoughts?

Kind regards,
Arjan Tijms


_______________________________________________
glassfish-dev mailing list
glassfish-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/glassfish-dev


Back to the top