001: /*
002: * JBoss, Home of Professional Open Source.
003: * Copyright 2006, Red Hat Middleware LLC, and individual contributors
004: * as indicated by the @author tags. See the copyright.txt file in the
005: * distribution for a full listing of individual contributors.
006: *
007: * This is free software; you can redistribute it and/or modify it
008: * under the terms of the GNU Lesser General Public License as
009: * published by the Free Software Foundation; either version 2.1 of
010: * the License, or (at your option) any later version.
011: *
012: * This software is distributed in the hope that it will be useful,
013: * but WITHOUT ANY WARRANTY; without even the implied warranty of
014: * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
015: * Lesser General Public License for more details.
016: *
017: * You should have received a copy of the GNU Lesser General Public
018: * License along with this software; if not, write to the Free
019: * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
020: * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
021: */
022: package org.jboss.test.security.ejb;
023:
024: import java.rmi.RemoteException;
025: import java.util.Iterator;
026: import java.util.Set;
027: import javax.ejb.CreateException;
028: import javax.ejb.SessionBean;
029: import javax.ejb.SessionContext;
030: import javax.naming.InitialContext;
031:
032: import org.jboss.logging.Logger;
033: import org.jboss.test.security.interfaces.SecurityContext;
034: import org.jboss.test.security.interfaces.SecurityContextHome;
035:
036: /**
037: * @author Scott.Stark@jboss.org
038: * @version $Revision: 57211 $
039: */
040: public class SecurityContextBean implements SessionBean {
041: static Logger log = Logger.getLogger(SecurityContextBean.class);
042:
043: private SessionContext sessionContext;
044:
045: public void ejbCreate() throws CreateException {
046: log.debug("ejbCreate() called");
047: }
048:
049: public void ejbActivate() {
050: log.debug("ejbActivate() called");
051: }
052:
053: public void ejbPassivate() {
054: log.debug("ejbPassivate() called");
055: }
056:
057: public void ejbRemove() {
058: log.debug("ejbRemove() called");
059: }
060:
061: public void setSessionContext(SessionContext context) {
062: sessionContext = context;
063: }
064:
065: public void testDomainInteraction(Set expectedRoles) {
066: // Validate that caller has the expected roles
067: validateRoles(expectedRoles, true);
068: // Access a bean from another security-domain
069: try {
070: InitialContext ctx = new InitialContext();
071: SecurityContextHome home = (SecurityContextHome) ctx
072: .lookup("java:comp/env/ejb/CalledBean");
073: SecurityContext bean = home.create();
074: SecurityContext this Bean = (SecurityContext) sessionContext
075: .getEJBObject();
076: bean.nestedInteraction(this Bean, expectedRoles);
077: } catch (Exception e) {
078: SecurityException se = new SecurityException(
079: "DataSource connection failed");
080: se.initCause(e);
081: throw se;
082: }
083: // Validate that caller still has the expected roles
084: validateRoles(expectedRoles, true);
085: }
086:
087: public void nestedInteraction(SecurityContext caller,
088: Set expectedRoles) throws RemoteException {
089: validateRoles(expectedRoles, false);
090: }
091:
092: /**
093: * Validate that the current caller has every role from expectedRoles in the
094: * context isCallerInRole set.
095: *
096: * @param expectedRoles - Set<String> of the role names
097: * @param isCallerInRoleFlag - Should isCallerInRole return true
098: * @throws SecurityException - thrown if sessionContext.isCallerInRole(name)
099: * fails for any name in expectedRoles
100: */
101: private void validateRoles(Set expectedRoles,
102: boolean isCallerInRoleFlag) throws SecurityException {
103: Iterator names = expectedRoles.iterator();
104: while (names.hasNext()) {
105: String name = (String) names.next();
106: boolean hasRole = sessionContext.isCallerInRole(name);
107: if (hasRole != isCallerInRoleFlag)
108: throw new SecurityException(
109: "Caller does not have role: " + name);
110: }
111: }
112: }
|