}
return value;
}
private void processSecurityAnnotations(Class<?> beanClass, String ejbName, EjbModule ejbModule, AnnotationFinder annotationFinder, EnterpriseBean bean) {
AssemblyDescriptor assemblyDescriptor = ejbModule.getEjbJar().getAssemblyDescriptor();
List<String> classPermissions = getDeclaredClassPermissions(assemblyDescriptor, ejbName);
for (Class<?> clazzz : Classes.ancestors(beanClass)) {
final MetaAnnotatedClass<?> clazz = new MetaAnnotatedClass(clazzz);
/*
* Process annotations at the class level
*/
if (!classPermissions.contains("*") || !classPermissions.contains(clazz.getName())) {
RolesAllowed rolesAllowed = clazz.getAnnotation(RolesAllowed.class);
PermitAll permitAll = clazz.getAnnotation(PermitAll.class);
/*
* @RolesAllowed
*/
if (rolesAllowed != null && permitAll != null) {
ejbModule.getValidation().fail(ejbName, "permitAllAndRolesAllowedOnClass", clazz.getName());
}
if (rolesAllowed != null) {
MethodPermission methodPermission = new MethodPermission();
methodPermission.getRoleName().addAll(asList(rolesAllowed.value()));
methodPermission.getMethod().add(new org.apache.openejb.jee.Method(ejbName, clazz.getName(), "*"));
assemblyDescriptor.getMethodPermission().add(methodPermission);
// Automatically add a role ref for any role listed in RolesAllowed
RemoteBean remoteBean = (RemoteBean) bean;
List<SecurityRoleRef> securityRoleRefs = remoteBean.getSecurityRoleRef();
for (String role : rolesAllowed.value()) {
securityRoleRefs.add(new SecurityRoleRef(role));
}
}
/*
* @PermitAll
*/
if (permitAll != null) {
MethodPermission methodPermission = new MethodPermission();
methodPermission.setUnchecked(true);
methodPermission.getMethod().add(new org.apache.openejb.jee.Method(ejbName, clazz.getName(), "*"));
assemblyDescriptor.getMethodPermission().add(methodPermission);
}
}
/*
* @RunAs
*/
RunAs runAs = clazz.getAnnotation(RunAs.class);
if (runAs != null && bean.getSecurityIdentity() == null) {
SecurityIdentity securityIdentity = new SecurityIdentity();
securityIdentity.setRunAs(runAs.value());
bean.setSecurityIdentity(securityIdentity);
}
/*
* @DeclareRoles
*/
DeclareRoles declareRoles = clazz.getAnnotation(DeclareRoles.class);
if (declareRoles != null && bean instanceof RemoteBean) {
RemoteBean remoteBean = (RemoteBean) bean;
List<SecurityRoleRef> securityRoleRefs = remoteBean.getSecurityRoleRef();
for (String role : declareRoles.value()) {
securityRoleRefs.add(new SecurityRoleRef(role));
}
}
}
/*
* Process annotations at the method level
*/
List<Method> seen = new ArrayList<Method>();
/*
* @RolesAllowed
*/
for (Annotated<Method> method : annotationFinder.findMetaAnnotatedMethods(RolesAllowed.class)) {
checkConflictingSecurityAnnotations(method, ejbName, ejbModule, seen);
RolesAllowed rolesAllowed = method.getAnnotation(RolesAllowed.class);
MethodPermission methodPermission = new MethodPermission();
methodPermission.getRoleName().addAll(asList(rolesAllowed.value()));
methodPermission.getMethod().add(new org.apache.openejb.jee.Method(ejbName, method.get()));
assemblyDescriptor.getMethodPermission().add(methodPermission);
// Automatically add a role ref for any role listed in RolesAllowed
RemoteBean remoteBean = (RemoteBean) bean;
List<SecurityRoleRef> securityRoleRefs = remoteBean.getSecurityRoleRef();
for (String role : rolesAllowed.value()) {
securityRoleRefs.add(new SecurityRoleRef(role));
}
}
/*
* @PermitAll
*/
for (Annotated<Method> method : annotationFinder.findMetaAnnotatedMethods(PermitAll.class)) {
checkConflictingSecurityAnnotations(method, ejbName, ejbModule, seen);
MethodPermission methodPermission = new MethodPermission();
methodPermission.setUnchecked(true);
methodPermission.getMethod().add(new org.apache.openejb.jee.Method(ejbName, method.get()));
assemblyDescriptor.getMethodPermission().add(methodPermission);
}
/*
* @DenyAll
*/
for (Annotated<Method> method : annotationFinder.findMetaAnnotatedMethods(DenyAll.class)) {
checkConflictingSecurityAnnotations(method, ejbName, ejbModule, seen);
ExcludeList excludeList = assemblyDescriptor.getExcludeList();
excludeList.addMethod(new org.apache.openejb.jee.Method(ejbName, method.get()));
}
}