public class PermissionsParseProcessor extends Object implements DeploymentUnitProcessor
DeploymentUnitProcessor
that parses security permission files that might be
included in application components.
The EE7 specification (section EE6.2.2.6) allows application components to specify required security permissions:
"Permission declarations must be stored in META-INF/permissions.xml file within an EJB, web, application client, or
resource adapter archive in order for them to be located and processed.
The permissions for a packaged library are the same as the permissions for the module. Thus, if a library is packaged
in a .war file, it gets the permissions of the .war file.
For applications packaged in an .ear file, the declaration of permissions must be at .ear file level. This permission
set is applied to all modules and libraries packaged within the .ear file or within its contained modules. Any
permissions.xml files within such packaged modules are ignored, regardless of whether a permissions.xml file has been
supplied for the .ear file itself."
As can be noted, the EE spec doesn't allow sub-deployments to override permissions set at the .ear level. We find it
a bit too restrictive, so we introduced the META-INF/jboss-permissions.xml descriptor. It uses the same schema as the
standard permissions.xml file but, unlike the latter, is always processed and the permissions contained in it override
any permissions set by a parent deployment. If a deployment contains both permissions files, jboss-permissions.xml
takes precedence over the standard permissions.xml.Constructor and Description |
---|
PermissionsParseProcessor(List<org.jboss.modules.security.PermissionFactory> minPermissions,
List<org.jboss.modules.security.PermissionFactory> maxPermissions)
Creates an instance of
PermissionsParseProcessor with the specified minimum and maximum set of permissions. |
Modifier and Type | Method and Description |
---|---|
void |
deploy(DeploymentPhaseContext phaseContext)
Perform a single step in processing the deployment phase.
|
void |
undeploy(DeploymentUnit context)
Undo the deployment processing.
|
public PermissionsParseProcessor(List<org.jboss.modules.security.PermissionFactory> minPermissions, List<org.jboss.modules.security.PermissionFactory> maxPermissions)
PermissionsParseProcessor
with the specified minimum and maximum set of permissions.minPermissions
- a List
containing the permissions that are to be granted to all deployments.maxPermissions
- a List
containing the maximum set of permissions a deployment can have. In other words,
all permissions in the minimum set plus the permissions parsed in META-INF/permissions.xml
must be implied by the maximum set.public void deploy(DeploymentPhaseContext phaseContext) throws DeploymentUnitProcessingException
DeploymentUnitProcessor
Data stored on the phase context only exists until the end of the phase. The deployment unit context
which is persistent is available via context.getDeploymentUnitContext()
.
deploy
in interface DeploymentUnitProcessor
phaseContext
- the deployment unit contextDeploymentUnitProcessingException
- if an error occurs during processingpublic void undeploy(DeploymentUnit context)
DeploymentUnitProcessor
deploy()
; however, if
the deploy()
method added services, they need not be removed here (they will automatically be removed).
This method should avoid throwing exceptions; any exceptions thrown are logged and ignored. Implementations of this
method cannot assume that the deployment process has (or has not) proceeded beyond the current processor, nor can they
assume that the undeploy()
method will be called from the same thread as the deploy()
method.
undeploy
in interface DeploymentUnitProcessor
context
- the deployment unit contextCopyright © 2015 JBoss by Red Hat. All rights reserved.