tomee-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Arjan Tijms (JIRA)" <>
Subject [jira] [Commented] (TOMEE-1912) Enable JACC for Servlet
Date Mon, 16 Jul 2018 17:43:00 GMT


Arjan Tijms commented on TOMEE-1912:

Currently have a test setup that almost works for TomEE, most work has been done by Guillermo,
with extra thanks to the people at Geronimo who worked on this all these years ago.

> Enable JACC for Servlet
> -----------------------
>                 Key: TOMEE-1912
>                 URL:
>             Project: TomEE
>          Issue Type: New Feature
>    Affects Versions: 7.0.1
>            Reporter: Arjan Tijms
>            Priority: Major
>              Labels: security
> Currently JACC is only enabled for the EJB container in TomEE, but not for the Servlet
> Practically this means that for the EJB container permissions are collected and put into
the {{PolicyConfiguration}} and that for access decisions for protected EJB beans the {{Policy}}
is called. For the Servlet container neither happens.
> I would like to request to enable JACC for the Servlet container as well.
> As Geronimo implemented this earlier for Tomcat, it may be possible to look at how Geronimo
did this (especially the web.xml constraints to {{Permission}} collection transformation is
not exactly trivial and would be beneficial if it could be re-used from Geronimo).
> The Tomcat community itself also demonstrated a mild interest in JACC (very small interest
perhaps, but it appeared on their roadmap for consideration a couple of times), so perhaps
some coordination with Mark is possible.
> See also a discussion about this on the [TomEE mailing list|].

This message was sent by Atlassian JIRA

View raw message