@Override
public void configure(final DeploymentPhaseContext context, final ComponentDescription description, final ComponentConfiguration configuration) throws DeploymentUnitProcessingException {
final DeploymentUnit deploymentUnit = context.getDeploymentUnit();
final DeploymentClassIndex classIndex = deploymentUnit.getAttachment(Attachments.CLASS_INDEX);
final EJBComponentDescription component = EJBComponentDescription.class.cast(description);
final EjbJaccConfig config = new EjbJaccConfig();
context.getDeploymentUnit().addToAttachmentList(EjbDeploymentAttachmentKeys.JACC_PERMISSIONS, config);
String ejbClassName = component.getEJBClassName();
String ejbName = component.getEJBName();
// Process the exclude-list and method-permission
// check class level
boolean denyOnAllViews = true;
boolean permitOnAllViews = true;
List<EJBMethodPermission> permissions = new ArrayList<EJBMethodPermission>();
List<EJBMethodPermission> uncheckedPermissions = new ArrayList<EJBMethodPermission>();
final ApplicableMethodInformation<EJBMethodSecurityAttribute> perms = component.getDescriptorMethodPermissions();
for (ViewDescription view : component.getViews()) {
String viewClassName = view.getViewClassName();
final ClassIndex viewClass;
try {
viewClass = classIndex.classIndex(viewClassName);
} catch (ClassNotFoundException e) {
throw EjbMessages.MESSAGES.failToLoadEjbViewClass(e);
}
MethodIntf methodIntf = ((EJBViewDescription) view).getMethodIntf();
MethodInterfaceType type = getMethodInterfaceType(methodIntf);
EJBMethodSecurityAttribute classLevel = perms.getClassLevelAttribute(ejbClassName);
if (classLevel != null && !classLevel.isDenyAll()) {
denyOnAllViews = false;
} else {
EJBMethodPermission p = new EJBMethodPermission(ejbName, null, type.name(), null);
permissions.add(p);
}
if (classLevel != null && !classLevel.isPermitAll()) {
permitOnAllViews = false;
} else {
EJBMethodPermission p = new EJBMethodPermission(ejbName, null, type.name(), null);
uncheckedPermissions.add(p);
}
if (classLevel != null) {
for (String role : classLevel.getRolesAllowed()) {
config.addRole(role, new EJBMethodPermission(ejbName, null, null, null));
}
}
for (Method method : viewClass.getClassMethods()) {
final MethodIdentifier identifier = MethodIdentifier.getIdentifierForMethod(method);
EJBMethodSecurityAttribute methodLevel = component.getDescriptorMethodPermissions().getAttribute(methodIntf, method.getDeclaringClass().getName(), method.getName(), identifier.getParameterTypes());
// check method level
if (methodLevel == null) {
methodLevel = component.getAnnotationMethodPermissions().getAttribute(methodIntf, method.getDeclaringClass().getName(), method.getName(), identifier.getParameterTypes());
if (methodLevel == null) {
continue;
}
}
EJBMethodPermission p = new EJBMethodPermission(ejbName, identifier.getName(), type.name(), identifier.getParameterTypes());
if (methodLevel.isDenyAll()) {
config.addDeny(p);
}
if (methodLevel.isPermitAll()) {
config.addPermit(p);
}
for (String role : methodLevel.getRolesAllowed()) {
config.addRole(role, p);
}
}
}
// if deny is on all views, we add permission with null as the interface
if (denyOnAllViews) {
permissions = new ArrayList<EJBMethodPermission>();
permissions.add(new EJBMethodPermission(ejbName, null, null, null));
}
// add exclude-list permissions
for (EJBMethodPermission ejbMethodPermission : permissions) {
config.addDeny(ejbMethodPermission);
}
// if permit is on all views, we add permission with null as the interface
if (permitOnAllViews) {
uncheckedPermissions = new ArrayList<EJBMethodPermission>();
uncheckedPermissions.add(new EJBMethodPermission(ejbName, null, null, null));
}
// add method-permission permissions
for (EJBMethodPermission ejbMethodPermission : uncheckedPermissions) {
config.addPermit(ejbMethodPermission);
}
// Process the security-role-ref
Map<String, Collection<String>> securityRoles = component.getSecurityRoleLinks();
for (Map.Entry<String, Collection<String>> entry : securityRoles.entrySet()) {
String roleName = entry.getKey();
for (String roleLink : entry.getValue()) {
EJBRoleRefPermission p = new EJBRoleRefPermission(ejbName, roleName);
config.addRole(roleLink, p);