org.glassfish.ejb.security.application
Class EJBSecurityManager

java.lang.Object
  org.glassfish.ejb.security.application.EJBSecurityManager

All Implemented Interfaces:

SecurityManager

public final class EJBSecurityManager
extends java.lang.Object
implements SecurityManager

This class is used by the EJB server to manage security. All the container object only call into this object for managing security. This class cannot be subclassed.

An instance of this class should be created per deployment unit.

Author:

Harpreet Singh, monzillo

Constructor Summary

EJBSecurityManager(EjbDescriptor ejbDescriptor, InvocationManager invMgr, EJBSecurityManagerFactory fact)
This method iniitalizes the EJBSecurityManager

Method Summary

boolean	authorize(ComponentInvocation compInv) This method is called by the EJB container to decide whether or not a method specified in the Invocation should be allowed.
void	destroy()
java.lang.Object	doAsPrivileged(java.security.PrivilegedExceptionAction pea)
java.security.Principal	getCallerPrincipal() This method returns the Client Principal who initiated the current Invocation.
static java.lang.String	getContextID(EjbDescriptor ejbDesc)
javax.security.auth.Subject	getCurrentSubject() This will return the subject associated with the current call.
boolean	getUsesCallerIdentity()
java.lang.Object	invoke(java.lang.reflect.Method beanClassMethod, boolean isLocal, java.lang.Object o, java.lang.Object[] oa) This method is similiar to the runMethod, except it keeps the semantics same as the one in reflection.
boolean	isCallerInRole(java.lang.String role) This method returns a boolean value indicating whether or not the caller is in the specified role.
void	loadPolicyConfiguration(EjbDescriptor eDescriptor)
void	postInvoke(ComponentInvocation inv) This method is used by Message Driven Bean Container to remove the run-as identity information that was set up using the preSetRunAsIdentity method
void	preInvoke(ComponentInvocation inv) This method is used by MDB Container - Invocation Manager to setup the run-as identity information.
void	resetPolicyContext()
java.lang.Object	runMethod(java.lang.reflect.Method beanClassMethod, java.lang.Object obj, java.lang.Object[] oa) Runs a business method of an EJB withint the bean's policy context.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

EJBSecurityManager

public EJBSecurityManager(EjbDescriptor ejbDescriptor,
                          InvocationManager invMgr,
                          EJBSecurityManagerFactory fact)
                   throws java.lang.Exception

This method iniitalizes the EJBSecurityManager

Throws:

java.lang.Exception

Method Detail

getUsesCallerIdentity

public boolean getUsesCallerIdentity()

loadPolicyConfiguration

public void loadPolicyConfiguration(EjbDescriptor eDescriptor)
                             throws java.lang.Exception

Throws:

java.lang.Exception

getContextID

public static java.lang.String getContextID(EjbDescriptor ejbDesc)

authorize

public boolean authorize(ComponentInvocation compInv)

This method is called by the EJB container to decide whether or not a method specified in the Invocation should be allowed.

Specified by:

authorize in interface SecurityManager

Parameters:

compInv - invocation object that contains all the details of the invocation.

Returns:

A boolean value indicating if the client should be allowed to invoke the EJB.

preInvoke

public void preInvoke(ComponentInvocation inv)

This method is used by MDB Container - Invocation Manager to setup the run-as identity information. It has to be coupled with the postSetRunAsIdentity method. This method is called for EJB/MDB Containers

Specified by:

preInvoke in interface SecurityManager

postInvoke

public void postInvoke(ComponentInvocation inv)

This method is used by Message Driven Bean Container to remove the run-as identity information that was set up using the preSetRunAsIdentity method

Specified by:

postInvoke in interface SecurityManager

isCallerInRole

public boolean isCallerInRole(java.lang.String role)

This method returns a boolean value indicating whether or not the caller is in the specified role.

Specified by:

isCallerInRole in interface SecurityManager

Parameters:

role - role name in the form of java.lang.String

Returns:

A boolean true/false depending on whether or not the caller has the specified role.

getCallerPrincipal

public java.security.Principal getCallerPrincipal()

This method returns the Client Principal who initiated the current Invocation.

Specified by:

getCallerPrincipal in interface SecurityManager

Returns:

A Principal object of the client who made this invocation. or null if the SecurityContext has not been established by the client.

destroy

public void destroy()

Specified by:

destroy in interface SecurityManager

getCurrentSubject

public javax.security.auth.Subject getCurrentSubject()

This will return the subject associated with the current call. If the run as subject is in effect. It will return that subject. This is done to support the JACC specification which says if the runas principal is in effect, that principal should be used for making a component call.

Specified by:

getCurrentSubject in interface SecurityManager

Returns:

Subject the current subject. Null if this is not the run-as case

doAsPrivileged

public java.lang.Object doAsPrivileged(java.security.PrivilegedExceptionAction pea)
                                throws java.lang.Throwable

Specified by:

doAsPrivileged in interface SecurityManager

Throws:

java.lang.Throwable

runMethod

public java.lang.Object runMethod(java.lang.reflect.Method beanClassMethod,
                                  java.lang.Object obj,
                                  java.lang.Object[] oa)
                           throws java.lang.Throwable

Runs a business method of an EJB withint the bean's policy context. The original policy context is restored after method execution. This method should only be used by com.sun.enterprise.security.SecurityUtil.

Parameters:

beanClassMethod - the EJB business method

obj - the EJB bean instance

oa - parameters passed to beanClassMethod

Returns:

return value from beanClassMethod

Throws:

java.lang.reflect.InvocationTargetException - if the underlying method throws an exception

java.lang.Throwable - other throwables in other cases

invoke

public java.lang.Object invoke(java.lang.reflect.Method beanClassMethod,
                               boolean isLocal,
                               java.lang.Object o,
                               java.lang.Object[] oa)
                        throws java.lang.Throwable

This method is similiar to the runMethod, except it keeps the semantics same as the one in reflection. On failure, if the exception is caused due to reflection, it returns the InvocationTargetException. This method is called from the containers for ejbTimeout, WebService and MDBs.

Specified by:

invoke in interface SecurityManager

Parameters:

beanClassMethod, - the bean class method to be invoked

isLocal, - true if this invocation is through the local EJB view

o - the object on which this method is to be invoked in this case the ejb,

oa - the parameters for the method,

c, - the container instance can be a null value, where in the container will be queried to find its security manager.

Returns:

Object, the result of the execution of the method.

Throws:

java.lang.Throwable

resetPolicyContext

public void resetPolicyContext()

Specified by:

resetPolicyContext in interface SecurityManager