coheigea commented on code in PR #3664:
URL: https://github.com/apache/cxf/pull/3664#discussion_r4443140319
##########
core/src/main/java/org/apache/cxf/interceptor/security/SecureAnnotationsInterceptor.java:
##########
@@ -58,10 +67,41 @@ public void setAnnotationClassName(String name) {
ex.printStackTrace();
throw new IllegalArgumentException("Annotation class " + name + "
is not available");
}
+ resolveSecuredObjectRoles();
}
public void setSecuredObject(Object object) {
Class<?> cls = ClassHelper.getRealClass(object);
+ securedObjectClasses.add(cls);
+ addRoles(cls, Collections.emptyMap());
+ }
+
+ /**
+ * The roles are read from the annotations when the secured object is set,
so read them
+ * again with the new annotation class for any secured object which was
set before it.
+ * Otherwise the roles would come from the default annotation class, and a
service using
+ * another annotation would be left unprotected.
+ */
+ private void resolveSecuredObjectRoles() {
+ if (securedObjectClasses.isEmpty()) {
+ return;
+ }
+ for (Map.Entry<String, List<String>> entry :
annotationRoles.entrySet()) {
+ // Keep an entry which setMethodRolesMap has replaced since
+ if (methodRolesMap.get(entry.getKey()) == entry.getValue()) {
Review Comment:
@reta The interceptor has to tell apart two kinds of entry in
methodRolesMap: ones the annotations put there, and ones the user configured
with setMethodRolesMap. The only reliable way to tell is “is this the exact
list object the annotations stored?”. Comparing contents with equals() confuses
the two whenever a configured entry happens to have the same roles as an
annotation entry.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
