[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
[equinox-dev] Subject.doAsPrivileged not working with security enabled?!

Hi!

 

In our application we want to use JAAS to authenticate and authorise users and their access to defined functions.

Therefore I have activated OSGi Security and added the correct AllPermission-Policy and the Equinox FrameworkSecurityManager while starting the application.

 

Performing “normal” checkPermission-Operations all security evaluations are executed as expected. You can use the specific bundle permissions and the call stack is considered in the right way.

 

However, using a Subject.doAsPrivileged call to perform operations as a specific user, the ProtectionDomains of the bundles are not considered and the user has always AllPermission.

Googling for this behaviour I found a bug report in the Felix bug database https://issues.apache.org/jira/browse/FELIX-654 describing this problem.

 

Using Equinox, can this happen the same way? And is there a proper workaround for this problem or is it not possible to use Subject.doAsPrivileged at the moment?

 

Thanks for your help

 

Florian Pepping

 

By the way, here are the AccessControlContexts before the Subject.doAsPrivileged and within the Subject.doAsPrivileged call:

 

Before the Subject.doAsPrivileged call:

ProtectionDomain  (file:/D:/Sandboxes/DS/src/com.test/classes/ <no signer certificates>)

 null

 <no principals>

 org.eclipse.osgi.framework.internal.core.BundleCombinedPermissions@5d72e2 (      à here I have a BundleCombinedPermission

)

 

With the Subject.doAsPrivileged call:

ProtectionDomain  (file:/D:/Sandboxes/DS/src/com.test/classes/ <no signer certificates>)

 null

 <no principals>

 java.security.Permissions@39d3d3 (                                               à here I have a “normal” PermissionCollection for this CodeBase

 (java.security.AllPermission <all permissions> <all actions>)

)

 

 

 


WINCOR NIXDORF International GmbH
Sitz der Gesellschaft: Paderborn
Registergericht Paderborn HRB 3507
Geschäftsführer: Eckard Heidloff (Vorsitzender), Stefan Auerbach, Dr. Jürgen Wunram
Vorsitzender des Aufsichtsrats: Karl-Heinz Stiller
Steuernummer: 339/5884/0020 - Ust-ID Nr.: DE812927716 - WEEE-Reg.-Nr. DE44477193

Diese E-Mail enthält vertrauliche Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese E-Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser E-Mail ist nicht gestattet.

This e-mail may contain confidential information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden.