Skip to content

Commit 20d17ec

Browse files
ggamvladmihalcea
ggam
authored and
vladmihalcea
committed
HHH-11805 Fix JACC cannot be enabled
1 parent f2c83c9 commit 20d17ec

File tree

3 files changed

+185
-9
lines changed

3 files changed

+185
-9
lines changed

‎hibernate-core/hibernate-core.gradle‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ dependencies {
7272
testCompile( project(':hibernate-testing') )
7373
testCompile( libraries.shrinkwrap_api )
7474
testCompile( libraries.shrinkwrap )
75+
testCompile( libraries.jacc )
7576
testCompile( libraries.validation )
7677
testCompile( libraries.jandex )
7778
testCompile( libraries.classmate )

‎hibernate-core/src/main/java/org/hibernate/jpa/boot/internal/EntityManagerFactoryBuilderImpl.java‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@
8787
import static org.hibernate.cfg.AvailableSettings.DATASOURCE;
8888
import static org.hibernate.cfg.AvailableSettings.DRIVER;
8989
import static org.hibernate.cfg.AvailableSettings.JACC_CONTEXT_ID;
90+
import static org.hibernate.cfg.AvailableSettings.JACC_ENABLED;
9091
import static org.hibernate.cfg.AvailableSettings.JACC_PREFIX;
9192
import static org.hibernate.cfg.AvailableSettings.JPA_JDBC_DRIVER;
9293
import static org.hibernate.cfg.AvailableSettings.JPA_JDBC_PASSWORD;
@@ -483,15 +484,17 @@ private MergedSettings mergeSettings(
483484
final String valueString = (String) entry.getValue();
484485

485486
if ( keyString.startsWith( JACC_PREFIX ) ) {
486-
if ( jaccContextId == null ) {
487-
LOG.debug(
488-
"Found JACC permission grant [%s] in properties, but no JACC context id was specified; ignoring"
489-
);
490-
}
491-
else {
492-
mergedSettings.getJaccPermissions( jaccContextId ).addPermissionDeclaration(
493-
parseJaccConfigEntry( keyString, valueString )
494-
);
487+
if( !JACC_CONTEXT_ID.equals( keyString ) && !JACC_ENABLED.equals( keyString )) {
488+
if ( jaccContextId == null ) {
489+
LOG.debug(
490+
"Found JACC permission grant [%s] in properties, but no JACC context id was specified; ignoring"
491+
);
492+
}
493+
else {
494+
mergedSettings.getJaccPermissions( jaccContextId ).addPermissionDeclaration(
495+
parseJaccConfigEntry( keyString, valueString )
496+
);
497+
}
495498
}
496499
}
497500
else if ( keyString.startsWith( CLASS_CACHE_PREFIX ) ) {

‎hibernate-core/src/test/java/org/hibernate/secure/JaccIntegratorTest.java‎

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
/*
2+
* Hibernate, Relational Persistence for Idiomatic Java
3+
*
4+
* License: GNU Lesser General Public License (LGPL), version 2.1 or later.
5+
* See the lgpl.txt file in the root directory or <http://www.gnu.org/licenses/lgpl-2.1.html>.
6+
*/
7+
package org.hibernate.secure;
8+
9+
import java.security.CodeSource;
10+
import java.security.Permission;
11+
import java.security.PermissionCollection;
12+
import java.security.Policy;
13+
import java.security.ProtectionDomain;
14+
import java.security.Provider;
15+
import java.util.Collections;
16+
import java.util.Map;
17+
import javax.persistence.Entity;
18+
import javax.persistence.Id;
19+
import javax.security.auth.Subject;
20+
import javax.security.jacc.PolicyContext;
21+
import javax.security.jacc.PolicyContextException;
22+
import javax.security.jacc.PolicyContextHandler;
23+
24+
import org.hibernate.cfg.AvailableSettings;
25+
import org.hibernate.jpa.test.BaseEntityManagerFunctionalTestCase;
26+
27+
import org.hibernate.testing.TestForIssue;
28+
import org.junit.Test;
29+
30+
import static org.hibernate.testing.transaction.TransactionUtil.doInJPA;
31+
import static org.junit.Assert.assertTrue;
32+
import static org.junit.Assert.fail;
33+
34+
/**
35+
* @author Vlad Mihalcea
36+
*/
37+
@TestForIssue( jiraKey = "HHH-11805" )
38+
public class JaccIntegratorTest extends BaseEntityManagerFunctionalTestCase {
39+
40+
@Override
41+
protected Class<?>[] getAnnotatedClasses() {
42+
return new Class<?>[] {
43+
Person.class,
44+
};
45+
}
46+
47+
@Override
48+
protected void addConfigOptions(Map options) {
49+
options.put( AvailableSettings.JACC_ENABLED, Boolean.TRUE.toString() );
50+
options.put( AvailableSettings.JACC_CONTEXT_ID, "JACC_CONTEXT_ID" );
51+
options.put( "hibernate.jacc.allowed.org.hibernate.secure.Customer", "insert" );
52+
}
53+
54+
@Override
55+
protected void afterEntityManagerFactoryBuilt() {
56+
PolicyContextHandler policyContextHandler = new PolicyContextHandler() {
57+
@Override
58+
public Object getContext(String key, Object data) throws PolicyContextException {
59+
Subject subject = new Subject( true, Collections.singleton(new java.security.Principal() {
60+
61+
@Override
62+
public String getName() {
63+
return "org.hibernate.secure.JaccIntegratorTest$Person";
64+
}
65+
66+
@Override
67+
public boolean implies(Subject subject) {
68+
return true;
69+
}
70+
}), Collections.emptySet(), Collections.emptySet());
71+
return subject;
72+
}
73+
74+
@Override
75+
public String[] getKeys() throws PolicyContextException {
76+
return new String[0];
77+
}
78+
79+
@Override
80+
public boolean supports(String key) throws PolicyContextException {
81+
return true;
82+
}
83+
};
84+
try {
85+
PolicyContext.registerHandler( "javax.security.auth.Subject.container", policyContextHandler, true);
86+
}
87+
catch (PolicyContextException e) {
88+
fail(e.getMessage());
89+
}
90+
}
91+
92+
protected void setPolicy(boolean allow) {
93+
Policy.setPolicy( new Policy() {
94+
@Override
95+
public Provider getProvider() {
96+
return super.getProvider();
97+
}
98+
99+
@Override
100+
public String getType() {
101+
return super.getType();
102+
}
103+
104+
@Override
105+
public Parameters getParameters() {
106+
return super.getParameters();
107+
}
108+
109+
@Override
110+
public PermissionCollection getPermissions(CodeSource codesource) {
111+
return super.getPermissions( codesource );
112+
}
113+
114+
@Override
115+
public PermissionCollection getPermissions(ProtectionDomain domain) {
116+
return super.getPermissions( domain );
117+
}
118+
119+
@Override
120+
public boolean implies(ProtectionDomain domain, Permission permission) {
121+
return allow;
122+
}
123+
124+
@Override
125+
public void refresh() {
126+
super.refresh();
127+
}
128+
} );
129+
}
130+
131+
@Test
132+
public void testAllow() {
133+
setPolicy( true );
134+
135+
doInJPA( this::entityManagerFactory, entityManager -> {
136+
Person person = new Person();
137+
person.id = 1L;
138+
person.name = "John Doe";
139+
140+
entityManager.persist( person );
141+
} );
142+
}
143+
144+
@Test
145+
public void testDisallow() {
146+
setPolicy( false );
147+
148+
try {
149+
doInJPA( this::entityManagerFactory, entityManager -> {
150+
Person person = new Person();
151+
person.id = 1L;
152+
person.name = "John Doe";
153+
154+
entityManager.persist( person );
155+
} );
156+
157+
fail("Should have thrown SecurityException");
158+
}
159+
catch (Exception e) {
160+
assertTrue( e.getCause() instanceof SecurityException );
161+
}
162+
}
163+
164+
@Entity
165+
public static class Person {
166+
167+
@Id
168+
private Long id;
169+
170+
private String name;
171+
}
172+
}

0 commit comments

Comments
 (0)