String[] roleRefs = servlet.findSecurityReferences();
// Perform the unreferenced roles processing for every servlet name
for (int j = 0; j < roleRefs.length; j++) {
String roleRef = roleRefs[j];
String roleName = servlet.findSecurityReference(roleRef);
WebRoleRefPermission wrrp = new WebRoleRefPermission(servletName, roleRef);
pc.addToRole(roleName, wrrp);
/*
* A bit of a hack due to how tomcat calls out to its Realm.hasRole() with a role name that has been mapped to
* the role-link value. We may need to handle this with a custom request wrapper.
*/
wrrp = new WebRoleRefPermission(servletName, roleName);
pc.addToRole(roleRef, wrrp);
// Remove the role from the unreferencedRoles
unRefRoles.remove(roleName);
}
// Spec 3.1.3.2: For each servlet element in the deployment descriptor
// a WebRoleRefPermission must be added to each security-role of the
// application whose name does not appear as the rolename
// in a security-role-ref within the servlet element.
for (String unrefRole : unRefRoles) {
WebRoleRefPermission unrefP = new WebRoleRefPermission(servletName, unrefRole);
pc.addToRole(unrefRole, unrefP);
}
}
// JACC 1.1:Spec 3.1.3.2: For each security-role defined in the deployment descriptor, an
// additional WebRoleRefPermission must be added to the corresponding role by
// calling the addToRole method on the PolicyConfiguration object. The
// name of all such permissions must be the empty string, and the actions of each
// such permission must be the role-name of the corresponding role.
for (int i = 0; i < unreferencedRoles.length; i++) {
String unreferencedRole = unreferencedRoles[i];
WebRoleRefPermission wrrep = new WebRoleRefPermission("", unreferencedRole);
pc.addToRole(unreferencedRole, wrrep);
}
// Now build the cross product of the unreferencedRoles and servlets
for (int i = 0; i < servlets.length; i++) {
Wrapper servlet = (Wrapper) servlets[i];
String servletName = servlet.getName();
for (int j = 0; j < unreferencedRoles.length; j++) {
String role = unreferencedRoles[j];
WebRoleRefPermission wrrp = new WebRoleRefPermission(servletName, role);
pc.addToRole(role, wrrp);
}
}
}