[GERONIMO-4521] ejb apps with spec security constraints should only deploy if there are corresponding geronimo security constraints, as with web apps

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.1.3, 2.1.4, 2.2
• Fix Version/s: 2.1.4, 2.2
• Component/s: deployment, OpenEJB
• Security Level: public (Regular issues)
• Assignee: David Jencks
• Reporter: David Jencks
• Created: 23/Jan/09 00:51
• Updated: 23/Jan/09 00:57
• Resolved: 23/Jan/09 00:57

Description

for quite a while we have only allowed you to deploy a web app with security constraints if you also supply a geronimo security configuration; otherwise you get no security constraints at all. We should be doing the same for ejb apps. While this may be inconvenient for those who want to try deploying an app without completing the configuration, the alternative is to give the impression that the deployed app is enforcing the security constraints – which it is not.

I suppose an alternative might be to figure out a way to deploy and just forbid access to any resources that are constrained.