[DELTASPIKE-801] Security: SecurityParameterValueRedefiner doesnt recognize @Nonbinding

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.2.0
• Fix Version/s: 1.2.1
• Component/s: Security-Module
• Environment: Wildfly 8.1.0.Final / JSF / DeltaSpike
• Assignee: Gerhard Petracek
• Reporter: Thomas Frühbeck
• Created: 15/Dec/14 21:56
• Updated: 23/Dec/14 23:06
• Resolved: 15/Dec/14 22:16

Description

According specification @Nonbinding annotation desingates properties of annotations to be ignored when checking for equality.

Nevertheless I get a missing parameter binding exception in following situation:

Exception:
java.lang.IllegalStateException: Missing required security parameter binding [@at.telekom.sms.web.security.AuthorizedParam(action=UPDATE)] on method invocation [net.a1.csms.jsf.GroupBean.setCsmsGroup(class at.telekom.sms.persistence.entities.SmsLists)]

Binding Annotaiton:

@SecurityParameterBinding
@Target(

{ TYPE, METHOD, FIELD, PARAMETER }

)
@Retention(RUNTIME)
public @interface AuthorizedParam

{ @Nonbinding Action action() default Action.UPDATE; }

Authorizer:

public class MssmsAuthorizer {

@Secures @Authorized
public boolean authorized(InvocationContext ctx, @LoggedIn MssmsUser mssmsUser, @AuthorizedParam SmsLists smsList)

{ return doAuthorize(ctx, mssmsUser, smsList); }

}

Annotated Bean method:

{
@Authorized
@OpenTransactionProvided(rollbackOnly=true)
public void setCsmsGroup(@AuthorizedParam(action=Action.READ) final SmsLists newGroup)

{ ... }

}