markt-asf commented on a change in pull request #186: BZ 63636:
Context#findRoleMapping() never called in RealmBase#hasRole()
URL: https://github.com/apache/tomcat/pull/186#discussion_r311451173
##########
File path: java/org/apache/catalina/realm/RealmBase.java
##########
@@ -928,6 +928,15 @@ public boolean hasRole(Wrapper wrapper, Principal
principal, String role) {
}
}
+ // Check for a role alias/mapping defined on context level
+ if (getContainer() instanceof Context) {
+ Context context = (Context) getContainer();
+ String realRole = context.findRoleMapping(role);
Review comment:
The above code is only used when the Realm is defined at the Context level.
That isn't what is required here. The role mappings need to be checked for the
current Context irrespective of where the Realm is defined. Something like:
`Context context = (Context) wrapper.getParent();`
A similar change would also need to be made to `UserDatabaseRealm` and
potentially other sub-classes. Consider moving this to
`Wrapper.findSecurityReference`. i.e. Look up Wrapper references first and if
none found try the Context.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
