mx4j/src/core/mx4j/remote MX4JRemoteUtils.java,1.16,1.17

Update of /cvsroot/mx4j/mx4j/src/core/mx4j/remote
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv31553/src/core/mx4j/remote

Modified Files:
	MX4JRemoteUtils.java 
Log Message:
Modified to incorporate the suggestion from Luis-Miguel Alventosa: check the SubjectDelegationPermission for the authenticated subject in every case, and not using anymore the delegate when it's present

Index: MX4JRemoteUtils.java
===================================================================
RCS file: /cvsroot/mx4j/mx4j/src/core/mx4j/remote/MX4JRemoteUtils.java,v
retrieving revision 1.16
retrieving revision 1.17
diff -C2 -d -r1.16 -r1.17
*** MX4JRemoteUtils.java	9 Oct 2004 14:52:40 -0000	1.16
--- MX4JRemoteUtils.java	13 Oct 2004 07:48:17 -0000	1.17
***************
*** 132,136 ****
        {
           if (subject == null) throw new SecurityException("There is no authenticated subject to delegate to");
!          checkSubjectDelegationPermission(delegate, getSubjectContext(subject, context, environment));
        }
  
--- 132,136 ----
        {
           if (subject == null) throw new SecurityException("There is no authenticated subject to delegate to");
!          checkSubjectDelegationPermission(delegate, getSubjectContext(subject, null, context, environment));
        }
  
***************
*** 143,148 ****
        // if it wants to.
        // Here, I just execute the action and trust the transport library to do its job right.
!       if (logger.isEnabledFor(Logger.TRACE)) logger.trace("No authenticated subject, invoking action without using Subject.doAs");
!       if (subject == null) return action.run();
  
        // The precedent stack frames have normally AllPermission, since - for example in RMI - they
--- 143,151 ----
        // if it wants to.
        // Here, I just execute the action and trust the transport library to do its job right.
!       if (subject == null)
!       {
!          if (logger.isEnabledFor(Logger.TRACE)) logger.trace("No authenticated subject, invoking action without using Subject.doAs");
!          return action.run();
!       }
  
        // The precedent stack frames have normally AllPermission, since - for example in RMI - they
***************
*** 157,166 ****
           {
              if (logger.isEnabledFor(Logger.TRACE)) logger.trace("Invoking Subject.doAs using authenticated subject " + subject);
!             return Subject.doAsPrivileged(subject, action, getSubjectContext(subject, context, environment));
           }
           else
           {
              if (logger.isEnabledFor(Logger.TRACE)) logger.trace("Invoking Subject.doAs using delegate subject " + delegate);
!             return Subject.doAsPrivileged(delegate, action, getSubjectContext(delegate, context, environment));
           }
        }
--- 160,169 ----
           {
              if (logger.isEnabledFor(Logger.TRACE)) logger.trace("Invoking Subject.doAs using authenticated subject " + subject);
!             return Subject.doAsPrivileged(subject, action, getSubjectContext(subject, delegate, context, environment));
           }
           else
           {
              if (logger.isEnabledFor(Logger.TRACE)) logger.trace("Invoking Subject.doAs using delegate subject " + delegate);
!             return Subject.doAsPrivileged(delegate, action, getSubjectContext(subject, delegate, context, environment));
           }
        }
***************
*** 242,246 ****
      * and the permissions needed by clients.
      */
!    private static AccessControlContext getSubjectContext(final Subject subject, final AccessControlContext context, Map environment)
     {
        final Logger logger = getLogger();
--- 245,249 ----
      * and the permissions needed by clients.
      */
!    private static AccessControlContext getSubjectContext(final Subject subject, Subject delegate, final AccessControlContext context, Map environment)
     {
        final Logger logger = getLogger();
***************
*** 251,255 ****
           if (logger.isEnabledFor(Logger.TRACE)) logger.trace("No security manager, injecting JSR 160 domain only");
           // Just return the injected domain, to allow Subject.getSubject() return correct values
!          InjectingDomainCombiner combiner = new InjectingDomainCombiner(subject);
           return new AccessControlContext(new ProtectionDomain[]{combiner.getInjectedProtectionDomain()});
        }
--- 254,258 ----
           if (logger.isEnabledFor(Logger.TRACE)) logger.trace("No security manager, injecting JSR 160 domain only");
           // Just return the injected domain, to allow Subject.getSubject() return correct values
!          InjectingDomainCombiner combiner = new InjectingDomainCombiner(delegate != null ? delegate : subject);
           return new AccessControlContext(new ProtectionDomain[]{combiner.getInjectedProtectionDomain()});
        }
***************
*** 262,265 ****
--- 265,269 ----
              try
              {
+                // Here use the authenticated subject, not the delegate
                 checkSubjectDelegationPermission(subject, context);
                 if (logger.isEnabledFor(Logger.TRACE)) logger.trace("Check for SubjectDelegationPermission passed, avoiding security domains combination");
***************
*** 276,280 ****
        if (combine)
        {
!          final InjectingDomainCombiner combiner = new InjectingDomainCombiner(subject);
           AccessControlContext acc = (AccessControlContext)AccessController.doPrivileged(new PrivilegedAction()
           {
--- 280,284 ----
        if (combine)
        {
!          final InjectingDomainCombiner combiner = new InjectingDomainCombiner(delegate != null ? delegate : subject);
           AccessControlContext acc = (AccessControlContext)AccessController.doPrivileged(new PrivilegedAction()
           {
***************
*** 304,308 ****
        else
        {
!          InjectingDomainCombiner combiner = new InjectingDomainCombiner(subject);
           return new AccessControlContext(new ProtectionDomain[]{combiner.getInjectedProtectionDomain()});
        }
--- 308,312 ----
        else
        {
!          InjectingDomainCombiner combiner = new InjectingDomainCombiner(delegate != null ? delegate : subject);
           return new AccessControlContext(new ProtectionDomain[]{combiner.getInjectedProtectionDomain()});
        }



-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl