eclipse-ee4j / eclipse-ee4j/jersey
Improve current implementation of RolesAllowedDynamicFeature to support query of roles on current resource
- Dominant language
- Java
- Stars
- 730
- Forks
- 382
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
for the current release and as far as I can see also for the upcoming 3.0 release I cannot see a convenient way to access the roles allowed on the current resource
[https://github.com/jersey/jersey/blob/2.21.x/core-server/src/main/java/org/glassfish/jersey/server/filter/RolesAllowedDynamicFeature.java](https://github.com/jersey/jersey/blob/2.21.x/core-server/src/main/java/org/glassfish/jersey/server/filter/RolesAllowedDynamicFeature.java)
Since the inner class is private, there's no way to override what message is thrown with the ForbiddenException. For example if I want to put the missing role(s) into that message to be more informative for the caller.
For that scenario I would have to copy basically the whole file and always make sure, that my checked in code is still aligned to the current jersey release I'm using.
Another way would be to add another filter per resource, that basically does the same thing as the RolesAllowedDynamicFeature class but store the roles per resource, for example in the SecurityContext for me to use later.
Is there a way you could provide a function for me to retrieve the current resource's roles and act based on what is responded, or even let us change the behaviour, as by design that's not possible without having duplicate, resulting in possibly outdated, code.
Maybe there's even a way to solve this, that I cannot see.
#### Affected Versions
[2.22.1]
Contributor guide
Assessment
This issue has not been assessed yet.