jbossas/jboss-as — pull request #4036 by jaikiran (2013-02-08 13:18:19+00:00)
Title: Fix for AS7-6476

(Please let Jason decide about merge this one)

Related JIRA: https://issues.jboss.org/browse/AS7-6476

The commits here fixes a change in behaviour compared to our previous AS versions where a secured bean with methods having no explicit security configurations were being allowed access. In earlier version, such methods were denied access by default and the user had the option to configure whether such methods should be allowed access (via the use of missing-method-permissions-excluded-mode element in jboss.xml http://anil-identity.blogspot.in/2010/02/tip-interpretation-of-missing-ejb.html)

The commits here introduce a "missing-method-permissions-deny-access" element in jboss-ejb3.xml which can be used to configure whether such methods should be allowed access or not. A value of false allows access and a value of true denies access.

By default the absence of this element, causes such methods to be denied access. In theory, this is a change in behaviour compared to previous *AS 7* releases but at the same time, this default now aligns with what we used to do in pre-AS7 versions.

An example configuration in jboss-ejb3.xml will look like:

*
false