or to use a ReadWriteLock accessing that array...

From what I recall changing it is a really rare event...

It would be better to protect it with a oswego.ReadWriteLock than synchronize the whole thing.

Remy has fixed the synchronization for tc6. We have to find a way by which we can push the run-as identity on to the SecurityAssociation, if we need to get away from instance stuff.

I see Remy's fix now that you mention it. He fixed it shortly after replying to Dominik.

http://mail-archives.apache.org/mod_mbox/tomcat-dev/200702.mbox/%3c20070222122404.F32BA1A981A@eris.apache.org%3e

He removed the lock completely. That was easy. ;-)

But it begs the question as to whether the Tomcat team will support this usage of InstanceListener.

 <!-- Install an InstanceListener to handle the establishment of the run-as
 role for servlet init/destroy events.
 -->
<InstanceListener>org.jboss.web.tomcat.security.RunAsListener</InstanceListener>

Yes, I see the requirement for this, no question there.

If Remy can't suggest a replacement, he needs to do the work required to make this a fully supported feature instead of claiming it is "just for debugging purposes."

Agreed, we should remove the synchronized block from TC5 as well, for updates to Branch_4_0.

If there is an InstanceEvent fired for every single touch of a web component then we need a better way to integrate the security state into the component lifecycle callouts. Removing the synchronization via a copy on write structure should be done regardless.

I am seeing an issue that is a bit perplexing. I do not know how it was working before in JBoss4.

Here is the use case:
Testcase: org.jboss.test.web.test.WebIntegrationUnitTestCase
Scenarios: testUnsecureRunAsServlet, testUnsecureRunAsServletWithPrincipalName,testUnsecureRunAsServletWithPrincipalNameAndRoles

In my current pass at JBoss5, I am making use of a single threadlocal to contain the security context with push/pop mechanism.

Servlet: RunAsServlet

init()
{
 //I have a run-as defined, I am going to call a secure ejb
}

service()
{
 //I am going to call a secure ejb. run-as will be propagated
}

JaccContextValve - set the security context
SecurityAssociationValve - push run as
load the servlet
instanceevent:before-init - push run as
init()
instanceevent:after-init - pop run as

At this time my thread local is devoid of any run as

instanceevent:before_filter
instanceevent:after_filter
instanceevent:before_service
service()
instanceevent:after_service