Hi,

When i enable fine grained authorization all my users become non-admin, i am using tomcat 6 Drools Guvnor 5.5.0.Finali

I am not using authorization in my login module i only set one principal in my subject

there is no exceptions. everything works fine, user is authenticated has the admin role set from drools guvnor UI, but when i enable authorization, user stops being admin, in fact every user turns non-admin.

Any sugestions would be apreciated

Tahnx

beans.xml

 <security:jaas.JaasAuthenticator>
    <s:modifies/>
    <security:jaasConfigName>drools-guvnor550-final</security:jaasConfigName>
  </security:jaas.JaasAuthenticator>

  <!-- SECURITY AUTHORIZATION CONFIGURATION -->  
  <guvnorSecurity:RoleBasedPermissionResolver>
    <s:modifies/>
   <guvnorSecurity:enableRoleBasedAuthorization>true</guvnorSecurity:enableRoleBasedAuthorization>
  </guvnorSecurity:RoleBasedPermissionResolver>

My login module

public boolean login() throws LoginException {

        if (callbackHandler == null) {
            throw new LoginException("Error: no CallbackHandler available " + "to garner authentication information from the user");
        }
        Callback[] callbacks = new Callback[2];
        callbacks[0] = new NameCallback("user name: ");
        callbacks[1] = new PasswordCallback("password: ", false);

        try {
            callbackHandler.handle(callbacks);
            username = ((NameCallback) callbacks[0]).getName();
            char[] tmpPassword = ((PasswordCallback) callbacks[1]).getPassword();
            if (tmpPassword == null) {
                // treat a NULL password as an empty password
                tmpPassword = new char[0];
            }
            password = new char[tmpPassword.length];
            System.arraycopy(tmpPassword, 0, password, 0, tmpPassword.length);
            ((PasswordCallback) callbacks[1]).clearPassword();

        } catch (java.io.IOException ioe) {
            throw new LoginException(ioe.toString());
        } catch (UnsupportedCallbackException uce) {
            throw new LoginException("Error: " + uce.getCallback().toString() + " not available to garner authentication information " + "from the user");
        }

        String passStr = "";
        for (char p : password) {
            passStr = passStr + p;
        }

        // verify the username/password
        boolean usernameCorrect = false;
        boolean passwordCorrect = false;

        Properties props = new Properties();
        try {
            props.load(this.getClass().getClassLoader().getResourceAsStream("conf/guvnor-users.properties"));
        } catch (IOException e) {
            e.printStackTrace();
        }

        if (props.containsKey(username)) {
            usernameCorrect = true;
        }
        if (usernameCorrect && props.getProperty(username).equals(passStr)) {

            // authentication succeeded!!!
            passwordCorrect = true;
            if (debug) {
                System.out.println("\t\t[SampleLoginModule] " + "authentication succeeded");
            }
            succeeded = true;
            return true;
        } else {
            succeeded = false;
            username = null;
            for (int i = 0; i < password.length; i++)
                password[i] = ' ';
            password = null;
            if (!usernameCorrect) {
                return false;
            } else {
                throw new FailedLoginException("Password Incorrect");
            }
        }
    }
    public boolean commit() throws LoginException {
        try {
            if (succeeded == false) {
                return false;
            } else {
                // add a Principal (authenticated identity)
                // to the Subject

                // assume the user we authenticated is the SamplePrincipal
                userPrincipal = new User(username);
                System.out.println("USERNAME: " + username);
                if (!subject.getPrincipals().contains(userPrincipal)) {
                    subject.getPrincipals().add(userPrincipal);
                }
                // in any case, clean out state
                username = null;
                for (int i = 0; i < password.length; i++)
                    password[i] = ' ';
                password = null;

                commitSucceeded = true;
                return true;
            }
        } catch (Exception x) {
            x.printStackTrace();
            if (x instanceof LoginException) {
                throw (LoginException) x;
            }
        }
        return commitSucceeded;
    }

My guvnor/META-INF/context.xml

<Context>
  <Resource name="BeanManager"
            auth="Container"
            type="javax.enterprise.inject.spi.BeanManager"
            factory="org.jboss.weld.resources.ManagerObjectFactory"/>
<Realm className="org.apache.catalina.realm.JAASRealm" appName="drools-guvnor550-final" userClassNames="com.termmed.User"  />
</Context>

tomcat jaas.config file

drools-guvnor550-final {
        com.termmed.GuvnorLoginModule required debug=true;
};

I enabled debug and this was the result of the log

USERNAME: adminuser
        [LdapLoginModule] added UserPrincipal "Principal:  adminuser" to Subject
=============== session-adminuser-5
=============== session-adminuser-6
=============== session-adminuser-7
DEBUG 23-05 06:29:44,600 (LoggingHelper.java:debug:63)      Requested permission: admin, Permission granted: No
DEBUG 23-05 06:29:44,602 (LoggingHelper.java:debug:63)      Requested permission: package.readonly, Requested object: defaultPackage , Permission granted: Yes
DEBUG 23-05 06:29:44,623 (LoggingHelper.java:debug:63)      Requested permission: admin, Permission granted: No
DEBUG 23-05 06:29:44,624 (LoggingHelper.java:debug:63)      Requested permission: package.readonly, Requested object: ihtsdo-qa , Permission granted: No
DEBUG 23-05 06:29:44,607 (LoggingHelper.java:debug:63)      Requested permission: admin, Permission granted: No
DEBUG 23-05 06:29:44,628 (LoggingHelper.java:debug:63)      Requested permission: package.readonly, Requested object: defaultPackage , Permission granted: Yes
DEBUG 23-05 06:29:44,633 (LoggingHelper.java:debug:63)      Requested permission: admin, Permission granted: No