Integrated: 8296244: Alternate implementation of user-based authorization Subject APIs that doesn’t depend on Security Manager APIs
Weijun Wang
weijun at openjdk.org
Wed Mar 20 21:28:29 UTC 2024
On Wed, 17 Jan 2024 23:41:53 GMT, Weijun Wang <weijun at openjdk.org> wrote:
> This code change adds an alternative implementation of user-based authorization `Subject` APIs that doesn't depend on Security Manager APIs. Depending on if the Security Manager is allowed, the methods store the current subject differently. See the spec change in the `Subject.java` file for details. When the Security Manager APIs are finally removed in a future release, this new implementation will be only implementation for these methods.
>
> One major change in the new implementation is that `Subject.getSubject` always throws an `UnsupportedOperationException` since it has an `AccessControlContext` argument but the current subject is no longer associated with an `AccessControlContext` object.
>
> Now it's the time to migrate from the `getSubject` and `doAs` methods to `current` and `callAs`. If the user application is simply calling `getSubject(AccessController.getContext())`, then switching to `current()` would work. If the `AccessControlContext` argument is retrieved from an earlier `getContext()` call and the associated subject might be different from that of the current `AccessControlContext`, then instead of storing the previous `AccessControlContext` object and passing it into `getSubject` to get the "previous" subject, the application should store the `current()` return value directly.
This pull request has now been integrated.
Changeset: d32746ef
Author: Weijun Wang <weijun at openjdk.org>
URL: https://git.openjdk.org/jdk/commit/d32746ef4a0ce6fec558274244321991be141698
Stats: 622 lines in 17 files changed: 477 ins; 27 del; 118 mod
8296244: Alternate implementation of user-based authorization Subject APIs that doesn’t depend on Security Manager APIs
Reviewed-by: mullan
-------------
PR: https://git.openjdk.org/jdk/pull/17472
More information about the core-libs-dev
mailing list