Examples with PermitAll javax.annotation.security.PermitAll used on opensource projects

Example 36 with PermitAll

use of javax.annotation.security.PermitAll in project aries by apache.

the class AuthorizationInterceptor method preCall.

public Object preCall(ComponentMetadata cm, Method m, Object... parameters) throws Throwable {
    Annotation ann = new SecurityAnotationParser().getEffectiveAnnotation(beanClass, m);
    if (ann instanceof PermitAll) {
        return null;
    }
    // Also applies for @DenyAll
    String[] rolesAr = new String[] {};
    if (ann instanceof RolesAllowed) {
        rolesAr = ((RolesAllowed) ann).value();
    }
    Set<String> roles = new HashSet<String>(Arrays.asList(rolesAr));
    AccessControlContext acc = AccessController.getContext();
    Subject subject = Subject.getSubject(acc);
    if (subject == null) {
        throw new AccessControlException("Method call " + m.getDeclaringClass() + "." + m.getName() + " denied. No JAAS login present");
    }
    Set<Principal> principals = subject.getPrincipals();
    for (Principal principal : principals) {
        if (roles.contains(principal.getName())) {
            LOGGER.debug("Granting access to Method: {} for {}.", m, principal);
            return null;
        }
    }
    String msg = String.format("Method call %s.%s denied. Roles allowed are %s. Your principals are %s.", m.getDeclaringClass(), m.getName(), roles, getNames(principals));
    throw new AccessControlException(msg);
}