[JS2-21] Missing Security Feature: Check roles assigned to any group to user belongs

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0-FINAL, 2.1
• Fix Version/s: 2.1.3
• Component/s: Security
• Assignee: Woonsan Ko
• Reporter: David LeStrat
• Created: 26/Apr/04 13:12
• Updated: 25/Sep/08 22:37
• Resolved: 25/Sep/08 22:37

Description

Reported by Ate Douma:

o.a.j.security.impl.RoleManagerImpl.isUserInRole() implementation is
missing a required feature.
A User can be part of a Group which can have Roles just like the User itself.
The isUserInRole() method currently only checks if the specified role is assigned to the user, not if it is assigned to one of the groups the user belongs to.
The Role definition in Servlet 2.3 SRV.12.4 (which according to portlet PLT.20.2 also applies for portlets) specifies that a user is in a specific role either when assigned directly to the user or
when assigned to a group the user belongs to.
Thus according to this definition the RoleManagerImpl.isUserInRole()
should also check the roles assigned to any group to user belongs to.

Issue Links

• relates to: JS2-151 Security enhancements for password validation and enable/disable principals