[OAK-3392] Security configurations shouldn't be bound to a SecurityProvider

• Type: Wish
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 1.3.5
• Component/s: core
• Assignee: Francesco Mari
• Reporter: Francesco Mari
• Created: 10/Sep/15 15:07
• Updated: 24/Aug/16 07:49
• Resolved: 24/Aug/16 07:49

Description

ConfigurationBase, the base class for security configurations, allows a SecurityProvider to be injected in a security configuration at will. This mechanism is used to implement a basic form dependency injection in SecurityProviderImpl, where every configuration receives a the instance of SecurityProviderImpl that is currently using it.

This mechanism is problematic in a dynamic scenario like OSGi, where a security configuration can be loaded independently from the SecurityProvider that is using it. Moreover, if multiple implementations of SecurityProvider are available, it is impossible to determine which instance of SecurityProvider will be injected in the security configuration.

I suggest to remove the reference to a SecurityProvider in the security configurations. If a SecurityProvider is needed, it should be instead passed as parameter in the appropriate methods.

Issue Links

• relates to: OAK-3201 Use static references in SecurityProviderImpl for composite services