Check if the principal is authorized to call the method by verifying that
the it containes at least one of the required roles.
// If there is not a security manager then there is no authorization
// required
if (securityManager == null)
{
return invocation.invokeNext();
}
if (realmMapping == null)
{
throw new SecurityException("Role mapping manager has not been set");
}
Set roles = getRoleSet(invocation);
if (roles == null)
{
/*
REVISIT: for better message
String message = "No method permissions assigned. to " +
"method=" + invocation.getMethod().getName() +
", interface=" + invocation.getType();
*/
String message = "No method permissions assigned.";
log.error(message);
throw new SecurityException(message);
}
// Check if the caller is allowed to access the method
RunAsIdentity callerRunAsIdentity = SecurityActions.peekRunAsIdentity();
if (roles.contains(AnybodyPrincipal.ANYBODY_PRINCIPAL) == false)
{
// The caller is using a the caller identity
if (callerRunAsIdentity == null)
{
Principal principal = SecurityActions.getPrincipal();
// Now actually check if the current caller has one of the required method roles
if (realmMapping.doesUserHaveRole(principal, roles) == false)
{
Set userRoles = realmMapping.getUserRoles(principal);
String msg = "Insufficient permissions, principal=" + principal
+ ", requiredRoles=" + roles + ", principalRoles=" + userRoles;
log.error(msg);
throw new SecurityException(msg);
}
}
// The caller is using a run-as identity
else
{
// Check that the run-as role is in the set of method roles
if (callerRunAsIdentity.doesUserHaveRole(roles) == false)
{
String msg = "Insufficient permissions, runAsPrincipal=" + callerRunAsIdentity.getName()
+ ", requiredRoles=" + roles + ", runAsRoles=" + callerRunAsIdentity.getRunAsRoles();
log.error(msg);
throw new SecurityException(msg);
}
}
}
return invocation.invokeNext();
