About Question enthuware.oce-ejbd.v6.2.533 :

All the posts and topics that contain only an error report will be moved here after the error is corrected. This is to ensure that when users view a question in ETS Viewer, the "Discuss" button will not indicate the presence of a discussion that adds no value to the question.

Moderators: Site Manager, fjwalraven

Post Reply
PedroKowalski
Posts: 25
Joined: Thu Aug 04, 2011 10:36 am
Location: Poland
Contact:

About Question enthuware.oce-ejbd.v6.2.533 :

Post by PedroKowalski »

Howdy!

I guess that in case of multichoice questions, the 'none of the above' answer doesn't make any sense at all.

Cheers!

admin
Site Admin
Posts: 10036
Joined: Fri Sep 10, 2010 9:26 pm
Contact:

Re: About Question enthuware.oce-ejbd.v6.2.533 :

Post by admin »

Yes, it can be removed.

thanks for your feedback!
If you like our products and services, please help us by posting your review here.

fjwalraven
Posts: 429
Joined: Tue Jul 24, 2012 2:43 am
Contact:

Re: About Question enthuware.oce-ejbd.v6.2.533 :

Post by fjwalraven »

I don't know when this comment will be dealt with but I still see the option "None of the above." where two options are requested.

Regards,
Frits

admin
Site Admin
Posts: 10036
Joined: Fri Sep 10, 2010 9:26 pm
Contact:

Re: About Question enthuware.oce-ejbd.v6.2.533 :

Post by admin »

Fixed in v 2.39

HTH,
Paul.
If you like our products and services, please help us by posting your review here.

gurpreet_asrgndu
Posts: 55
Joined: Thu Jan 03, 2013 7:51 am
Contact:

Re: About Question enthuware.oce-ejbd.v6.2.533 :

Post by gurpreet_asrgndu »

the explanation to third option says that :
These methods will return the values a per the "run-as" configuration of the bean.

this is not true since getCallerPrincipal from onMessage will return the containers representation(anonymous in case of glassfish) of unauthenticated identity. run-as principal will be visible in the calls made from the onMessage method.

admin
Site Admin
Posts: 10036
Joined: Fri Sep 10, 2010 9:26 pm
Contact:

Re: About Question enthuware.oce-ejbd.v6.2.533 :

Post by admin »

As per Section 17.4.3.1:
17.3.4.1 Run-as
The Bean Provider can use the RunAs metadata annotation or the Bean Provider or Application Assembler can use the run-as deployment descriptor element to define a run-as identity for an enterprise bean in the deployment descriptor. The run-as identity applies to the enterprise bean as a whole, that is, to all methods of the enterprise bean’s business, home, and component interfaces, no-interface view, and/or web service endpoint; to the message listener methods of a message-driven bean; and to the timeout callback methods of an enterprise bean; and all internal methods of the bean that they might in turn call.
This means that the bean method itself runs as if it is run by the run-as role.

HTH,
Paul.
If you like our products and services, please help us by posting your review here.

gurpreet_asrgndu
Posts: 55
Joined: Thu Jan 03, 2013 7:51 am
Contact:

Re: About Question enthuware.oce-ejbd.v6.2.533 :

Post by gurpreet_asrgndu »

admin wrote:As per Section 17.4.3.1:
17.3.4.1 Run-as
The Bean Provider can use the RunAs metadata annotation or the Bean Provider or Application Assembler can use the run-as deployment descriptor element to define a run-as identity for an enterprise bean in the deployment descriptor. The run-as identity applies to the enterprise bean as a whole, that is, to all methods of the enterprise bean’s business, home, and component interfaces, no-interface view, and/or web service endpoint; to the message listener methods of a message-driven bean; and to the timeout callback methods of an enterprise bean; and all internal methods of the bean that they might in turn call.
This means that the bean method itself runs as if it is run by the run-as role.

HTH,
Paul.

you are right paul, but the explanation says that from within the bean class which is annotated as RunAs
if we do getCallerPrincipal we will get the whatever principal assigned to RunAs role. this is not true. the run as principal will only be visible to beans which ARE CALLED from the bean annotated with RunAs annotation

admin
Site Admin
Posts: 10036
Joined: Fri Sep 10, 2010 9:26 pm
Contact:

Re: About Question enthuware.oce-ejbd.v6.2.533 :

Post by admin »

I do not agree with that. It applies to the execution of that method itself as well. Section 17.1 says this:
The security principal under which a method invocation is performed is typically that of the component’s caller. By specifying a run-as identity, however, it is possible to specify that a different principal be substituted for the execution of the methods of the bean’s business interface, no-interface view, homeinterface, component interface, and/or web service endpoint and any methods of other enterprise beans that the bean may call.
This means the execution of the method itself runs as the "run-as" identity. So getCallerPrincipal should return the run-as identity.

HTH,
Paul.
If you like our products and services, please help us by posting your review here.

gurpreet_asrgndu
Posts: 55
Joined: Thu Jan 03, 2013 7:51 am
Contact:

Re: About Question enthuware.oce-ejbd.v6.2.533 :

Post by gurpreet_asrgndu »

admin wrote:I do not agree with that. It applies to the execution of that method itself as well. Section 17.1 says this:
The security principal under which a method invocation is performed is typically that of the component’s caller. By specifying a run-as identity, however, it is possible to specify that a different principal be substituted for the execution of the methods of the bean’s business interface, no-interface view, homeinterface, component interface, and/or web service endpoint and any methods of other enterprise beans that the bean may call.
This means the execution of the method itself runs as the "run-as" identity. So getCallerPrincipal should return the run-as identity.

HTH,
Paul.

no getCallerPrincipal wont return run-as identity. it will return whatever identity invoked the bean. i just tested it again to reconfirm this

admin
Site Admin
Posts: 10036
Joined: Fri Sep 10, 2010 9:26 pm
Contact:

Re: About Question enthuware.oce-ejbd.v6.2.533 :

Post by admin »

You are right. Section 17.2.5.1 says,
Note that getCallerPrincipal returns the principal that represents the caller of the enterprise bean, not the principal that corresponds to the run-as security identity for the bean, if any.
this has now been fixed.

thank you for your feedback!
If you like our products and services, please help us by posting your review here.

Post Reply

Who is online

Users browsing this forum: No registered users and 26 guests