jbossas/jboss-as — pull request #3075 by jaikiran (2012-09-18 15:18:28+00:00)
Title: [master only] AS7-5581 - Enable security on beans if any security metadata is configured but security domain isn't

The commit in this pull request implements the feature request https://issues.jboss.org/browse/AS7-5581:

Consider the following example:

@Stateless
public class SecureBean
{

@RolesAllowed("role1")
public void restrictedRoles()
{
...
}

@DenyAll
public void denyEveryone()
{
...
}

}

Notice that the bean methods use EJB security annotations to restrict access however the bean doesn't have any explicit @SecurityDomain configured (not even in jboss-ejb3.xml). Right now, AS7 ignores the security restriction on that bean allows everyone to invoke on it, as if security wasn't configured for that bean. This has confused users who expect the invocations to fail since they have used the javax.ejb.* security annotations to restrict access. Many users have asked for a feature where the security domain is defaulted (if not explicitly specified) in cases like this.

The commit here defaults the security domain for such beans to "other". The default security domain itself can be configured (or even removed) from the EJB3 subsystem:

The presence of this default security domain adds a dependency on the appropriate security domain service from the security subsystem. The default-security-domain element can be removed from the EJB3 subsystem if the users want to disable this feature.