Community
Participate
Working Groups
The existing server tests should be run with security turned on in GlassFish, WebLogic, JBoss and WebSphere as we only now (29 Dec 2010) caught security issues during session deploy() on @PersistenceContext injection for code that was put into the stream back in July 2010 >Several security issues came up recently when EclipseLink was run with container security on GlassFish V 3.1 encountered several security API exceptions including the one in bug # 333336 WebLogic also had issues when the server was run in production mode with security on instead our development mode which is usually run during R&D. >It would be better if we caught these security issues before external groups notified us during integration testing at the end of the release cycle.
>Most issues will occur on predeploy()/deploy() of existing EARs with security on >Specifically GlassFish with the SecurityManager turned on so the following code blocks execute import java.security.AccessController; import org.eclipse.persistence.internal.security.PrivilegedAccessHelper; if (PrivilegedAccessHelper.shouldUsePrivilegedAccess()) { AccessController.doPrivileged(...); }
>GlassFish V3 Security Manager Enablement Turning on the security manager in GlassFish is very simple. It is WebLogic that has some issues that we need to look at surrounding any custom JTA datasources and their specific grants Just an fyi that no Grant elements are required in the EAR if you use the default datasource. <jta-data-source>jdbc/__default</jta-data-source> >We can use the existing code for both and configure the server on the fly by creating and deleting the following two security properties This will simplify partitioning the test suite in secure/unsecured asadmin start-domain asadmin --user admin create-jvm-options -Djava.security.manager asadmin --user admin create-jvm-options -Declipselink.security.usedoprivileged=true asadmin stop-domain asadmin start-domain >Look for the following log to verify. [#|2011-01-14T12:18:45.513-0430|INFO|glassfish3.0.1|javax.enterprise.system.core.security.com.sun.enterprise.security|_ThreadID=11;_ThreadName=Thread-1;|SEC1001: Security Manager is ON.|#]
The Eclipselink project has moved to Github: https://github.com/eclipse-ee4j/eclipselink
