coheigea opened a new pull request, #3664: URL: https://github.com/apache/cxf/pull/3664
…ured object setSecuredObject reads the roles from the annotations straight away, using the annotation class configured at that moment. If setAnnotationClassName was called afterwards, the roles stayed those of the default @RolesAllowed, so a service secured with another annotation, such as Spring's @Secured, had no roles at all and could be invoked by any user, including anonymous ones. Spring applies properties in the order they are declared, and the documented example sets securedObject first. Read the roles of the secured objects again whenever the annotation class changes, replacing only the entries the annotations added, so roles configured via setMethodRolesMap are kept and take the same precedence as when the annotation class is set first. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
