001: /*
002: * JBoss, Home of Professional Open Source.
003: * Copyright 2006, Red Hat Middleware LLC, and individual contributors
004: * as indicated by the @author tags. See the copyright.txt file in the
005: * distribution for a full listing of individual contributors.
006: *
007: * This is free software; you can redistribute it and/or modify it
008: * under the terms of the GNU Lesser General Public License as
009: * published by the Free Software Foundation; either version 2.1 of
010: * the License, or (at your option) any later version.
011: *
012: * This software is distributed in the hope that it will be useful,
013: * but WITHOUT ANY WARRANTY; without even the implied warranty of
014: * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
015: * Lesser General Public License for more details.
016: *
017: * You should have received a copy of the GNU Lesser General Public
018: * License along with this software; if not, write to the Free
019: * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
020: * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
021: */
022: package org.jboss.ejb.plugins;
023:
024: import org.jboss.ejb.Container;
025: import org.jboss.invocation.Invocation;
026: import org.jboss.metadata.ApplicationMetaData;
027: import org.jboss.metadata.AssemblyDescriptorMetaData;
028: import org.jboss.metadata.BeanMetaData;
029: import org.jboss.metadata.SecurityIdentityMetaData;
030: import org.jboss.security.RunAsIdentity;
031:
032: import java.util.Set;
033:
034: /**
035: * An interceptor that enforces the run-as identity declared by a bean.
036: *
037: * @author <a href="mailto:Scott.Stark@jboss.org">Scott Stark</a>.
038: * @author <a href="mailto:Thomas.Diesler@jboss.org">Thomas Diesler</a>.
039: * @version $Revision: 57209 $
040: */
041: public class RunAsSecurityInterceptor extends AbstractInterceptor {
042: protected RunAsIdentity runAsIdentity;
043:
044: public RunAsSecurityInterceptor() {
045: }
046:
047: /**
048: * Called by the super class to set the container to which this interceptor
049: * belongs. We obtain the security manager and runAs identity to use here.
050: */
051: public void setContainer(Container container) {
052: super .setContainer(container);
053: if (container != null) {
054: BeanMetaData beanMetaData = container.getBeanMetaData();
055: ApplicationMetaData application = beanMetaData
056: .getApplicationMetaData();
057: AssemblyDescriptorMetaData assemblyDescriptor = application
058: .getAssemblyDescriptor();
059:
060: SecurityIdentityMetaData secMetaData = beanMetaData
061: .getSecurityIdentityMetaData();
062: if (secMetaData != null
063: && secMetaData.getUseCallerIdentity() == false) {
064: String roleName = secMetaData.getRunAsRoleName();
065: String principalName = secMetaData
066: .getRunAsPrincipalName();
067: if (principalName == null)
068: principalName = application
069: .getUnauthenticatedPrincipal();
070: // the run-as principal might have extra roles mapped in the assembly-descriptor
071: Set extraRoleNames = assemblyDescriptor
072: .getSecurityRoleNamesByPrincipal(principalName);
073: runAsIdentity = new RunAsIdentity(roleName,
074: principalName, extraRoleNames);
075: }
076: }
077: }
078:
079: // Container implementation --------------------------------------
080: public void start() throws Exception {
081: super .start();
082: }
083:
084: public Object invokeHome(Invocation mi) throws Exception {
085: /* If a run-as role was specified, push it so that any calls made
086: by this bean will have the runAsRole available for declarative
087: security checks.
088: */
089: SecurityActions.pushRunAsIdentity(runAsIdentity);
090: try {
091: Object returnValue = getNext().invokeHome(mi);
092: return returnValue;
093: } finally {
094: SecurityActions.popRunAsIdentity();
095: }
096: }
097:
098: public Object invoke(Invocation mi) throws Exception {
099: /* If a run-as role was specified, push it so that any calls made
100: by this bean will have the runAsRole available for declarative
101: security checks.
102: */
103: SecurityActions.pushRunAsIdentity(runAsIdentity);
104: try {
105: Object returnValue = getNext().invoke(mi);
106: return returnValue;
107: } finally {
108: SecurityActions.popRunAsIdentity();
109: }
110: }
111:
112: }
|