Examples with RolesAllowed javax.annotation.security.RolesAllowed used on opensource projects

Example 36 with RolesAllowed

use of javax.annotation.security.RolesAllowed in project Payara by payara.

the class JwtAuthCdiExtension method findRoles.

/**
 * Find all the roles used by the <code>@RolesAllowed</code> annotation, so these can be programmatically
 * declared later on.
 */
public <T> void findRoles(@Observes ProcessManagedBean<T> eventIn, BeanManager beanManager) {
    // JDK8 u60 workaround
    ProcessManagedBean<T> event = eventIn;
    if (event instanceof ProcessSessionBean) {
        // @RolesAllowed on session beans is already handled
        return;
    }
    List<Annotated> annotatedElements = new ArrayList<>(event.getAnnotatedBeanClass().getMethods());
    annotatedElements.add(event.getAnnotatedBeanClass());
    for (Annotated annotated : annotatedElements) {
        RolesAllowed rolesAllowed = annotated.getAnnotation(RolesAllowed.class);
        if (rolesAllowed != null) {
            roles.addAll(Arrays.asList(rolesAllowed.value()));
        }
    }
}

Example 37 with RolesAllowed

use of javax.annotation.security.RolesAllowed in project Payara by payara.

the class AbstractAuthAnnotationHandler method validateAccessControlAnnotations.

/**
 * This method checks whether annotations are compatible.
 * One cannot have two or more of the @DenyAll, @PermitAll, @RoleAllowed.
 *
 * @param ainfo
 * @return validity
 */
private boolean validateAccessControlAnnotations(AnnotationInfo ainfo) throws AnnotationProcessorException {
    boolean validity = true;
    AnnotatedElement ae = (AnnotatedElement) ainfo.getAnnotatedElement();
    int count = 0;
    boolean hasDenyAll = false;
    count += (ae.isAnnotationPresent(RolesAllowed.class) ? 1 : 0);
    if (ae.isAnnotationPresent(DenyAll.class)) {
        count += 1;
        hasDenyAll = true;
    }
    // continue the checking if not already more than one
    if (count < 2 && ae.isAnnotationPresent(PermitAll.class)) {
        count++;
    }
    if (count > 1) {
        log(Level.SEVERE, ainfo, localStrings.getLocalString("enterprise.deployment.annotation.handlers.morethanoneauthannotation", "One cannot have more than one of @RolesAllowed, @PermitAll, @DenyAll in the same AnnotatedElement."));
        validity = false;
    }
    return validity;
}

Example 38 with RolesAllowed

use of javax.annotation.security.RolesAllowed in project Payara by payara.

the class RolesAllowedHandler method processEjbMethodSecurity.

/**
 * Add roles and permissions to given method in EjbDescriptor.
 * @param annotation
 * @param ejbDesc
 * @param md
 */
@Override
protected void processEjbMethodSecurity(Annotation authAnnotation, MethodDescriptor md, EjbDescriptor ejbDesc) {
    RolesAllowed rolesAllowedAn = (RolesAllowed) authAnnotation;
    for (String roleName : rolesAllowedAn.value()) {
        Role role = new Role(roleName);
        // add role if not exists
        ejbDesc.getEjbBundleDescriptor().addRole(role);
        ejbDesc.addPermissionedMethod(new MethodPermission(role), md);
    }
}

Example 39 with RolesAllowed

use of javax.annotation.security.RolesAllowed in project irontest by zheng-wang.

the class UserResource method delete.

@DELETE
@Path("{userId}")
@RolesAllowed(IronTestConstants.USER_ROLE_ADMIN)
public void delete(@PathParam("userId") long userId) {
    User user = userDAO.findById(userId);
    if (user != null && IronTestConstants.SYSADMIN_USER.equals(user.getUsername())) {
        throw new RuntimeException("Can not delete " + IronTestConstants.SYSADMIN_USER);
    }
    userDAO.deleteById(userId);
}

Example 40 with RolesAllowed

use of javax.annotation.security.RolesAllowed in project jeeshop by remibantos.

the class Catalogs method findPresentationsLocales.

@GET
@Path("/{catalogId}/presentationslocales")
@Produces(MediaType.APPLICATION_JSON)
@RolesAllowed({ ADMIN, STORE_ADMIN, ADMIN_READONLY })
public Set<String> findPresentationsLocales(@Context SecurityContext securityContext, @PathParam("catalogId") @NotNull Long catalogId) {
    Catalog catalog = entityManager.find(Catalog.class, catalogId);
    checkNotNull(catalog);
    if (!isAdminUser(securityContext) && !isOwner(securityContext, catalog.getOwner()))
        throw new WebApplicationException(Response.Status.FORBIDDEN);
    return catalog.getPresentationByLocale().keySet();
}