Class level @RunAs is ignored

[igorfie]

... and here is a patch to fix this

Index: RunAsSecurityInterceptor.java
===================================================================
RCS file: /cvsroot/jboss/jboss-ejb3/src/main/org/jboss/ejb3/security/RunAsSecurityInterceptor.java,v
retrieving revision 1.3
diff -u -r1.3 RunAsSecurityInterceptor.java
--- RunAsSecurityInterceptor.java 22 Jun 2004 02:41:22 -0000 1.3
+++ RunAsSecurityInterceptor.java 18 Oct 2004 17:00:42 -0000
@@ -23,6 +23,9 @@
protected RunAsIdentity getRunAsIdentity(Invocation invocation)
{
RunAs runAs = (RunAs) invocation.resolveAnnotation(RunAs.class);
+ if (runAs == null) {
+ runAs = (RunAs) invocation.resolveClassAnnotation(RunAs.class);
+ }
if (runAs == null) return null;
RunAsIdentity runAsRole = new RunAsIdentity(runAs.value(), null);
return runAsRole;

BTW, there is no standard way to recover caller's principal hidden by RunAs, is there?

[igorfie]

To answer my own question, according to EJB 2.1 section 21.2.5.1, which applies to EJB3 as far as I understood

Note that getCallerPrincipal returns the principal that represents the caller of the
enterprise bean, not the principal that corresponds to the run-as security identity for the bean,
if any.

Currently JBoss returns RunAs identity, which looks like a bug.

[bill.burke]

Both are fixed in CVS. I'll do another EJB 3 release once JBoss 4.0.1 goes out to make it official.

Bill

[igorfie]

When do you plan to do another preview? I have couple of small changes to Entity Beans implementation and want to make them available too.

[bill.burke]

Next week right after 4.0.1 release. Do you have CVS access?

Email me: [e-mail]