Bug 1152477

Created attachment 946764 [details]
RolesAllowed-reproducer.zip

If generic types are used, the AuthorizationInterceptor is not correctly configured. The problem is the MethodPermissionsMergingProcessor adds permission based on the type parameter, but EJBSecurityViewConfigurator checks a base type for the parameter 

Example:

public class BaseObject {
...
}

public class TestItem extends BaseObject {
...
}

@Local
public interface TestInterface<T extends BaseObject> {
  public void testMethodWithArgs(T t) throws Exception;
}


@Stateless
@Local
@SecurityDomain("test")
public class TestImplementation implements TestInterface<TestItem> {

  @RolesAllowed("JBossAdmin")
  public void testMethodWithArgs(TestItem t) throws Exception {
	// whatever
  }
}

When deploying the TestImplementation bean, it does following:

1)
The MethodPermissionsMergingProcessor.handleAnnotations() method sets AnnotationMethodPermissions attribute for:

className: jboss.example.ejb.TestImplementation
methodName: testMethodWithArgs
methodParams: ["jboss.example.ejb.TestItem"]

2)
The org.jboss.as.ejb3.security.EJBSecurityViewConfigurator.handlePermissions() method reads permission for:

className: jboss.example.ejb.TestImplementation
methodName: testMethodWithArgs
methodParams: ["jboss.example.ejb.BaseObject"]


==================
Attaching also original reproducer from Derek Horton. Usage:
- configure a "jmx-console" security domain with a user in role "JBossAdmin"
- deploy the EAR
- go to http://localhost:8080/SimpleWar/Hello
- check log files