killbill-uncached

security: fix Shiro wiring Disable AOP when RBAC is disabled. Signed-off-by:

8/19/2013 7:56:30 AM

Details

diff --git a/server/src/main/java/com/ning/billing/server/modules/KillBillShiroWebModule.java b/server/src/main/java/com/ning/billing/server/modules/KillBillShiroWebModule.java
index 57b6c5a..0dfade8 100644
--- a/server/src/main/java/com/ning/billing/server/modules/KillBillShiroWebModule.java
+++ b/server/src/main/java/com/ning/billing/server/modules/KillBillShiroWebModule.java
@@ -33,10 +33,10 @@ import com.ning.billing.util.security.shiro.realm.KillBillJndiLdapRealm;
 
 import com.google.inject.binder.AnnotatedBindingBuilder;
 
+// For Kill Bill server only.
+// See com.ning.billing.util.glue.KillBillShiroModule for Kill Bill library.
 public class KillBillShiroWebModule extends ShiroWebModule {
 
-    public static final String KILLBILL_RBAC_PROPERTY = "killbill.server.rbac";
-
     public KillBillShiroWebModule(final ServletContext servletContext) {
         super(servletContext);
     }
@@ -45,16 +45,14 @@ public class KillBillShiroWebModule extends ShiroWebModule {
     protected void configureShiroWeb() {
         bindRealm().toProvider(IniRealmProvider.class).asEagerSingleton();
 
-        final boolean ldapEnabled = Boolean.parseBoolean(System.getProperty(KillBillShiroModule.KILLBILL_LDAP_PROPERTY, "false"));
-        if (ldapEnabled) {
+        if (KillBillShiroModule.isLDAPEnabled()) {
             bindRealm().to(KillBillJndiLdapRealm.class).asEagerSingleton();
         }
 
         // Magic provider to configure the cache manager
         bind(CacheManager.class).toProvider(EhCacheManagerProvider.class).asEagerSingleton();
 
-        final boolean rbacEnabled = Boolean.parseBoolean(System.getProperty(KILLBILL_RBAC_PROPERTY, "true"));
-        if (rbacEnabled) {
+        if (KillBillShiroModule.isRBACEnabled()) {
             addFilterChain(JaxrsResource.PREFIX + "/**", AUTHC_BASIC);
         }
     }
diff --git a/util/src/main/java/com/ning/billing/util/glue/KillBillShiroAopModule.java b/util/src/main/java/com/ning/billing/util/glue/KillBillShiroAopModule.java
index 3f32935..d3611ae 100644
--- a/util/src/main/java/com/ning/billing/util/glue/KillBillShiroAopModule.java
+++ b/util/src/main/java/com/ning/billing/util/glue/KillBillShiroAopModule.java
@@ -45,6 +45,10 @@ public class KillBillShiroAopModule extends ShiroAopModule {
     protected void configureInterceptors(final AnnotationResolver resolver) {
         super.configureInterceptors(resolver);
 
+        if (!KillBillShiroModule.isRBACEnabled()) {
+            return;
+        }
+
         final PermissionAnnotationHandler permissionAnnotationHandler = new PermissionAnnotationHandler();
         // Inject the Security API
         requestInjection(permissionAnnotationHandler);
diff --git a/util/src/main/java/com/ning/billing/util/glue/KillBillShiroModule.java b/util/src/main/java/com/ning/billing/util/glue/KillBillShiroModule.java
index 41e0f5d..ee99ac1 100644
--- a/util/src/main/java/com/ning/billing/util/glue/KillBillShiroModule.java
+++ b/util/src/main/java/com/ning/billing/util/glue/KillBillShiroModule.java
@@ -32,12 +32,20 @@ import com.google.inject.binder.AnnotatedBindingBuilder;
 public class KillBillShiroModule extends ShiroModule {
 
     public static final String KILLBILL_LDAP_PROPERTY = "killbill.server.ldap";
+    public static final String KILLBILL_RBAC_PROPERTY = "killbill.server.rbac";
+
+    public static boolean isLDAPEnabled() {
+        return Boolean.parseBoolean(System.getProperty(KILLBILL_LDAP_PROPERTY, "false"));
+    }
+
+    public static boolean isRBACEnabled() {
+        return Boolean.parseBoolean(System.getProperty(KILLBILL_RBAC_PROPERTY, "true"));
+    }
 
     protected void configureShiro() {
         bindRealm().toProvider(IniRealmProvider.class).asEagerSingleton();
 
-        final boolean ldapEnabled = Boolean.parseBoolean(System.getProperty(KILLBILL_LDAP_PROPERTY, "false"));
-        if (ldapEnabled) {
+        if (isLDAPEnabled()) {
             bindRealm().to(KillBillJndiLdapRealm.class).asEagerSingleton();
         }
     }