org.wildfly.extension.security.manager.deployment

Class PermissionsParseProcessor

java.lang.Object

org.wildfly.extension.security.manager.deployment.PermissionsParseProcessor

All Implemented Interfaces:

org.jboss.as.server.deployment.DeploymentUnitProcessor

public class PermissionsParseProcessor
extends Object
implements org.jboss.as.server.deployment.DeploymentUnitProcessor

This class implements a DeploymentUnitProcessor that parses security permission files that might be included in application components.

The EE7 specification (section EE6.2.2.6) allows application components to specify required security permissions:

"Permission declarations must be stored in META-INF/permissions.xml file within an EJB, web, application client, or resource adapter archive in order for them to be located and processed.

The permissions for a packaged library are the same as the permissions for the module. Thus, if a library is packaged in a .war file, it gets the permissions of the .war file.

For applications packaged in an .ear file, the declaration of permissions must be at .ear file level. This permission set is applied to all modules and libraries packaged within the .ear file or within its contained modules. Any permissions.xml files within such packaged modules are ignored, regardless of whether a permissions.xml file has been supplied for the .ear file itself."

As can be noted, the EE spec doesn't allow sub-deployments to override permissions set at the .ear level. We find it a bit too restrictive, so we introduced the META-INF/jboss-permissions.xml descriptor. It uses the same schema as the standard permissions.xml file but, unlike the latter, is always processed and the permissions contained in it override any permissions set by a parent deployment. If a deployment contains both permissions files, jboss-permissions.xml takes precedence over the standard permissions.xml.

Author:

Stefan Guilhen

Constructor Summary

Constructors

Constructor and Description
PermissionsParseProcessor(List<org.jboss.modules.security.PermissionFactory> minPermissions, List<org.jboss.modules.security.PermissionFactory> maxPermissions) Creates an instance of PermissionsParseProcessor with the specified minimum and maximum set of permissions.

Method Summary

Modifier and Type	Method and Description
void	deploy(org.jboss.as.server.deployment.DeploymentPhaseContext phaseContext)
void	undeploy(org.jboss.as.server.deployment.DeploymentUnit context)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

PermissionsParseProcessor

public PermissionsParseProcessor(List<org.jboss.modules.security.PermissionFactory> minPermissions,
                                 List<org.jboss.modules.security.PermissionFactory> maxPermissions)

Creates an instance of PermissionsParseProcessor with the specified minimum and maximum set of permissions.

Parameters:

minPermissions - a List containing the permissions that are to be granted to all deployments.

maxPermissions - a List containing the maximum set of permissions a deployment can have. In other words, all permissions in the minimum set plus the permissions parsed in META-INF/permissions.xml must be implied by the maximum set.

Method Detail

deploy

public void deploy(org.jboss.as.server.deployment.DeploymentPhaseContext phaseContext)
            throws org.jboss.as.server.deployment.DeploymentUnitProcessingException

Specified by:

deploy in interface org.jboss.as.server.deployment.DeploymentUnitProcessor

Throws:

org.jboss.as.server.deployment.DeploymentUnitProcessingException

undeploy

public void undeploy(org.jboss.as.server.deployment.DeploymentUnit context)

Specified by:

undeploy in interface org.jboss.as.server.deployment.DeploymentUnitProcessor