Merge pull request #26006 from arjantijms/90_jwt_roles

Author: arjantijms

appserver/admingui/common/pom.xml

@@ -114,8 +114,8 @@
             <scope>provided</scope>
         </dependency>
         <dependency>
-            <groupId>jakarta.enterprise</groupId>
-            <artifactId>jakarta.enterprise.cdi-api</artifactId>
+            <groupId>jakarta.cdi</groupId>
+            <artifactId>jakarta.cdi-api</artifactId>
             <scope>provided</scope>
         </dependency>
         <dependency>

appserver/deployment/dol/src/main/java/com/sun/enterprise/deployment/WebBundleDescriptor.java

@@ -50,7 +50,6 @@
 import java.util.Set;
 
 import org.glassfish.api.deployment.archive.ArchiveType;
-import org.glassfish.api.event.EventTypes;
 import org.glassfish.deployment.common.Descriptor;
 import org.glassfish.grizzly.http.util.MimeType;
 
@@ -67,10 +66,6 @@ public abstract class WebBundleDescriptor extends CommonResourceBundleDescriptor
 
     private static final String DEPLOYMENT_DESCRIPTOR_DIR = "WEB-INF";
 
-    /** Used by the deployer and the web container */
-    public static final EventTypes<WebBundleDescriptor> AFTER_SERVLET_CONTEXT_INITIALIZED_EVENT = EventTypes
-        .create("After_Servlet_Context_Initialized", WebBundleDescriptor.class);
-
     private String contextRoot;
     private boolean denyUncoveredHttpMethods;
     private boolean distributable;

appserver/deployment/dol/src/main/java/com/sun/enterprise/deployment/WebBundleRuntimeContext.java

@@ -0,0 +1,17 @@
+package com.sun.enterprise.deployment;
+
+import jakarta.servlet.ServletContext;
+
+import org.glassfish.api.event.EventTypes;
+
+public record WebBundleRuntimeContext(
+        WebBundleDescriptor webBundleDescriptor,
+        ServletContext servletContext) {
+
+    /** Used by the deployer and the web container */
+    public static final EventTypes<WebBundleRuntimeContext> AFTER_SERVLET_CONTEXT_INITIALIZED_EVENT =
+        EventTypes.create("After_Servlet_Context_Initialized", WebBundleRuntimeContext.class);
+
+    public static final EventTypes<WebBundleRuntimeContext> AFTER_SERVLET_LOAD_INITIALIZED_EVENT =
+        EventTypes.create("After_Servlet_Load_Initialized", WebBundleRuntimeContext.class);
+}

appserver/security/core-ee/pom.xml

@@ -69,6 +69,10 @@
             <artifactId>jakarta.authorization-api</artifactId>
         </dependency>
 
+        <dependency>
+            <groupId>org.glassfish.soteria</groupId>
+            <artifactId>soteria</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.glassfish.exousia</groupId>
             <artifactId>exousia</artifactId>

appserver/security/core-ee/src/main/java/com/sun/enterprise/security/ee/SecurityDeployer.java

@@ -20,6 +20,7 @@
 import com.sun.enterprise.deployment.Application;
 import com.sun.enterprise.deployment.EjbBundleDescriptor;
 import com.sun.enterprise.deployment.WebBundleDescriptor;
+import com.sun.enterprise.deployment.WebBundleRuntimeContext;
 import com.sun.enterprise.deployment.web.LoginConfiguration;
 import com.sun.enterprise.security.AppCNonceCacheMap;
 import com.sun.enterprise.security.CNonceCacheFactory;
@@ -33,6 +34,7 @@
 import jakarta.inject.Inject;
 import jakarta.inject.Named;
 import jakarta.inject.Provider;
+import jakarta.servlet.ServletContext;
 
 import java.util.ArrayList;
 import java.util.Collection;
@@ -57,9 +59,11 @@
 import org.glassfish.internal.data.ModuleInfo;
 import org.glassfish.security.common.CNonceCache;
 import org.glassfish.security.common.HAUtil;
+import org.glassfish.soteria.rest.RestPermissions;
 import org.jvnet.hk2.annotations.Service;
 
-import static com.sun.enterprise.deployment.WebBundleDescriptor.AFTER_SERVLET_CONTEXT_INITIALIZED_EVENT;
+import static com.sun.enterprise.deployment.WebBundleRuntimeContext.AFTER_SERVLET_CONTEXT_INITIALIZED_EVENT;
+import static com.sun.enterprise.deployment.WebBundleRuntimeContext.AFTER_SERVLET_LOAD_INITIALIZED_EVENT;
 import static com.sun.enterprise.security.ee.authorization.AuthorizationUtil.getContextID;
 import static com.sun.enterprise.security.ee.authorization.AuthorizationUtil.removeRoleMapper;
 import static com.sun.enterprise.util.Utility.isEmpty;
@@ -77,6 +81,8 @@ public class SecurityDeployer extends SimpleDeployer<SecurityContainer, DummyApp
 
     private static final Logger LOGGER = LogDomains.getLogger(SecurityDeployer.class, LogDomains.SECURITY_LOGGER);
 
+    private static final String WEBBUNDLE_KEY = "org.glassfish.web.deployment.descriptor.WebBundleDescriptorImpl";
+
     @Inject
     private ServerContext serverContext;
 
@@ -115,15 +121,31 @@ private class AppDeployEventListener implements EventListener {
         public void event(Event<?> event) {
             Application application;
 
+            // Overview of the events regarding to the Policy permissions:
+            //
+            //  MODULE_LOADED / generateArtifacts
+            //   -> initial policy translation without ServletContext
+            //
+            //  APPLICATION_LOADED
+            //   -> link web/EJB policies
+            //   -> commit EJB policies
+            //
+            //  AFTER_SERVLET_CONTEXT_INITIALIZED_EVENT
+            //   -> if ServletContextListeners modified security, retranslate + commit
+            //
+            //  AFTER_SERVLET_LOAD_INITIALIZED_EVENT
+            //   -> if Jersey/Soteria staged REST permissions, retranslate + final commit
+
             if (MODULE_LOADED.equals(event.type())) {
                 ModuleInfo moduleInfo = (ModuleInfo) event.hook();
                 if (moduleInfo instanceof ApplicationInfo) {
                     return;
                 }
 
-                WebBundleDescriptor webBundleDescriptor = (WebBundleDescriptor)
-                    moduleInfo.getMetaData("org.glassfish.web.deployment.descriptor.WebBundleDescriptorImpl");
-                loadWebPolicy(webBundleDescriptor, false);
+                loadWebPolicy(
+                    null,
+                    (WebBundleDescriptor) moduleInfo.getMetaData(WEBBUNDLE_KEY),
+                    false);
 
             } else if (APPLICATION_LOADED.equals(event.type())) {
                 ApplicationInfo applicationInfo = (ApplicationInfo) event.hook();
@@ -144,8 +166,8 @@ public void event(Event<?> event) {
                         handler.register();
                     }
                 }
-            } else if (AFTER_SERVLET_CONTEXT_INITIALIZED_EVENT.equals(event.type())) {
-                commitWebPolicy((WebBundleDescriptor) event.hook());
+            } else if (AFTER_SERVLET_LOAD_INITIALIZED_EVENT.equals(event.type()) || AFTER_SERVLET_CONTEXT_INITIALIZED_EVENT.equals(event.type())) {
+                commitWebPolicy((WebBundleRuntimeContext) event.hook());
             }
         }
     }
@@ -168,21 +190,22 @@ protected void generateArtifacts(DeploymentContext deploymentContext) throws Dep
             return;
         }
 
-        String applicationName = params.name();
         try {
-            Application application = deploymentContext.getModuleMetaData(Application.class);
-            Set<WebBundleDescriptor> webBundleDescriptors = application.getBundleDescriptors(WebBundleDescriptor.class);
+            Set<WebBundleDescriptor> webBundleDescriptors =
+                deploymentContext.getModuleMetaData(Application.class)
+                                 .getBundleDescriptors(WebBundleDescriptor.class);
+
             if (webBundleDescriptors == null) {
                 return;
             }
 
             for (WebBundleDescriptor webBundleDescriptor : webBundleDescriptors) {
                 webBundleDescriptor.setApplicationClassLoader(deploymentContext.getFinalClassLoader());
-                loadWebPolicy(webBundleDescriptor, false);
+                loadWebPolicy(null, webBundleDescriptor, false);
             }
 
         } catch (Exception se) {
-            throw new DeploymentException("Error in generating security policy for " + applicationName, se);
+            throw new DeploymentException("Error in generating security policy for " + params.name(), se);
         }
     }
 
@@ -231,7 +254,7 @@ public void unload(DummyApplication container, DeploymentContext context) {
      * @param remove boolean indicated whether any existing policy statements are removed form context before translation
      * @throws DeploymentException
      */
-    private void loadWebPolicy(WebBundleDescriptor webBundleDescriptor, boolean remove) throws DeploymentException {
+    private void loadWebPolicy(ServletContext servletContext, WebBundleDescriptor webBundleDescriptor, boolean remove) throws DeploymentException {
         try {
             if (webBundleDescriptor != null) {
                 if (remove) {
@@ -241,7 +264,7 @@ private void loadWebPolicy(WebBundleDescriptor webBundleDescriptor, boolean remo
                         webSecurityManager.release();
                     }
                 }
-                webSecurityManagerFactory.createManager(webBundleDescriptor, true, serverContext);
+                webSecurityManagerFactory.createManager(servletContext, webBundleDescriptor, true, serverContext);
             }
 
         } catch (Exception se) {
@@ -251,17 +274,34 @@ private void loadWebPolicy(WebBundleDescriptor webBundleDescriptor, boolean remo
     }
 
     /**
-     * Puts Web Bundle Policy In Service, repeats translation if Descriptor indicates policy was changed by ContextListener.
+     * Commits the web policy at servlet lifecycle milestones.
      *
-     * @param webBundleDescriptor
+     * <p>
+     * This method may commit more than once during startup. The first commit, after
+     * ServletContextListener processing, makes the policy available to subsequent
+     * initialization code such as filter init and load-on-startup servlet init.
+     *
+     * <p>
+     * Later, load-on-startup servlet initialization may discover additional security
+     * metadata, notably Jakarta REST endpoint security staged by Soteria. If so, the
+     * policy is reopened, rebuilt from the full effective web model, and committed
+     * again before the module is made available for requests.
+     *
+     * @param webBundleRuntimeContext
      * @throws DeploymentException
      */
-    private void commitWebPolicy(WebBundleDescriptor webBundleDescriptor) throws DeploymentException {
+    private void commitWebPolicy(WebBundleRuntimeContext webBundleRuntimeContext) throws DeploymentException {
+        WebBundleDescriptor webBundleDescriptor = webBundleRuntimeContext.webBundleDescriptor();
+        ServletContext servletContext = webBundleRuntimeContext.servletContext();
+
         try {
             if (webBundleDescriptor != null) {
-                if (webBundleDescriptor.isPolicyModified()) {
+                if (webBundleDescriptor.isPolicyModified() || RestPermissions.hasPermissions(servletContext)) {
                     // Redo policy translation for web module
-                    loadWebPolicy(webBundleDescriptor, true);
+                    loadWebPolicy(servletContext, webBundleDescriptor, true);
+
+                    webBundleDescriptor.setPolicyModified(false);
+                    RestPermissions.clear(servletContext);
                 }
 
                 String contextId = getContextID(webBundleDescriptor);

appserver/security/core-ee/src/main/java/com/sun/enterprise/security/ee/authorization/GlassFishAuthorizationService.java

@@ -35,6 +35,7 @@
 import jakarta.security.jacc.PolicyFactory;
 import jakarta.security.jacc.WebResourcePermission;
 import jakarta.security.jacc.WebUserDataPermission;
+import jakarta.servlet.ServletContext;
 import jakarta.servlet.http.HttpServletRequest;
 
 import java.security.Permission;
@@ -48,6 +49,7 @@
 
 import static com.sun.enterprise.security.ee.authorization.GlassFishToExousiaConverter.getConstraintsFromBundle;
 import static com.sun.enterprise.security.ee.authorization.GlassFishToExousiaConverter.getSecurityRoleRefsFromBundle;
+import static com.sun.enterprise.security.ee.authorization.SoteriaToExousiaConverter.getStagedPermissionsFromContext;
 import static com.sun.enterprise.security.ee.authorization.cache.PermissionCacheFactory.createPermissionCache;
 import static java.util.logging.Level.FINE;
 import static java.util.stream.Collectors.toSet;
@@ -96,7 +98,7 @@ public class GlassFishAuthorizationService {
     private final ThreadLocal<HttpServletRequest> currentRequest = new ThreadLocal<>();
     private final AuthorizationService exousiaAuthorizationService;
 
-    public GlassFishAuthorizationService(WebBundleDescriptor webBundleDescriptor, boolean register) throws PolicyContextException {
+    public GlassFishAuthorizationService(ServletContext servletContext, WebBundleDescriptor webBundleDescriptor, boolean register) throws PolicyContextException {
         this.register = register;
         this.contextId = AuthorizationUtil.getContextID(webBundleDescriptor);
 
@@ -105,6 +107,9 @@ public GlassFishAuthorizationService(WebBundleDescriptor webBundleDescriptor, bo
 
         initPermissionCache();
 
+        // Check if the user has specified alternative implementations for the
+        // PolicyConfigurationFactory and PolicyFactory via a web.xml parameter
+
         webBundleDescriptor.getContextParameters()
                            .stream()
                            .filter(param -> param.getName().equals(PolicyConfigurationFactory.FACTORY_NAME))
@@ -119,22 +124,41 @@ public GlassFishAuthorizationService(WebBundleDescriptor webBundleDescriptor, bo
                            .map(param -> loadFactory(webBundleDescriptor, param.getValue()))
                            .ifPresent(clazz -> installPolicyFactory(webBundleDescriptor, clazz));
 
+        // Create the Exousia AuthorizationService. This implements the Jakarta Authorization
+        // APIs.
+        //
+        // We provide it with a way to get hold of the Subject, which is GF specific, and an
+        // implementation of the principal mapper (role mapper) which is also GF specific.
         exousiaAuthorizationService = new AuthorizationService(
             contextId,
             () -> SecurityContext.getCurrent().getSubject(),
             () -> new GlassFishPrincipalMapper(contextId));
 
         exousiaAuthorizationService.setConstrainedUriRequestAttribute(CONSTRAINT_URI);
+
+        // For the web / servlet environment we additionally provide Exousia with a way
+        // to obtain the HTTPServletRequest for a given invocation
         exousiaAuthorizationService.setRequestSupplier(contextId,
             () -> currentRequest.get());
 
         exousiaAuthorizationService.addConstraintsToPolicy(
+            // Permissions collected and staged by Soteria from REST endpoints
+            getStagedPermissionsFromContext(servletContext),
+
+            // Constraints collected by GlassFish / Catalina from Servlets and web.xml
             getConstraintsFromBundle(webBundleDescriptor),
+
+            // All declared roles; discovered by GlassFish and additionally by Soteria
             webBundleDescriptor.getRoles()
                .stream()
                .map(e -> e.getName())
                .collect(toSet()),
+
+            // The web.xml directive to set whether HTTP methods (GET, POST, etc)
+            // which are not explicitly defined are denied / excluded or not.
             webBundleDescriptor.isDenyUncoveredHttpMethods(),
+
+            // Role-reffing; ancient feature where Servlets can define role aliases.
             getSecurityRoleRefsFromBundle(webBundleDescriptor));
     }
 

appserver/security/core-ee/src/main/java/com/sun/enterprise/security/ee/authorization/SoteriaToExousiaConverter.java

@@ -0,0 +1,73 @@
+/*
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0, which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the
+ * Eclipse Public License v. 2.0 are satisfied: GNU General Public License,
+ * version 2 with the GNU Classpath Exception, which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ */
+package com.sun.enterprise.security.ee.authorization;
+
+import jakarta.servlet.ServletContext;
+
+import java.security.Permissions;
+
+import org.glassfish.exousia.permissions.JakartaPermissions;
+import org.glassfish.soteria.rest.RestPermissions;
+
+/**
+ * This class converts from staged permissions by Soteria to Exousia JakartaPermissions.
+ *
+ * <p>
+ * Soteria stages permissions discovered from Jakarta REST endpoints in the ServletContext.
+ * Using its accessor for these, we retrieve them and creata an Exousia native {@link JakartaPermissions}
+ * instance out of those.
+ *
+ */
+public class SoteriaToExousiaConverter {
+
+    public static JakartaPermissions getStagedPermissionsFromContext(ServletContext servletContext) {
+        JakartaPermissions jakartaPermissions = new JakartaPermissions();
+
+        if (servletContext != null && RestPermissions.hasPermissions(servletContext)) {
+
+            var excluded = RestPermissions.getExcluded(servletContext);
+            if (excluded != null) {
+                excluded.elementsAsStream()
+                        .forEach(e -> jakartaPermissions.getExcluded().add(e));
+            }
+
+            var unchecked = RestPermissions.getUnchecked(servletContext);
+            if (unchecked != null) {
+                unchecked.elementsAsStream()
+                         .forEach(e -> jakartaPermissions.getUnchecked().add(e));
+            }
+
+            var perRole = RestPermissions.getPerRole(servletContext);
+            if (perRole != null) {
+                perRole.entrySet().stream()
+                       .forEach(e -> jakartaPermissions.getPerRole().put(e.getKey(), copy(e.getValue())));
+            }
+        }
+
+        return jakartaPermissions;
+    }
+
+    private static Permissions copy(Permissions source) {
+        Permissions target = new Permissions();
+
+        if (source != null) {
+            source.elementsAsStream()
+                  .forEach(target::add);
+        }
+
+        return target;
+    }
+}