jakartaee / jakartaee/security
Support @RolesAllowed for CDI beans and REST
@arjantijms is already working on this.
Since Oct 17, 2023.
- Dominant language
- Java
- Stars
- 66
- Forks
- 43
- PR merge metrics
- No merged PRs in 30d
Description
The Jakarta platform included the `@RolesAllowed` annotation (via commons annotation), but it's only used and defined by Enterprise Beans in Jakarta (and in JWT in MicroProfile).
We would like to introduce an interceptor based version of this, that largely does what `@RolesAllowed` does, but owned by Jakarta Security, being an interceptor (so can be composed and will be automatically applied by CDI), and having some additional features not directly supported by @RolesAllowed.
Specifically needed is the distinction to throw an exception when the caller of the annotated method is not the correct role, or to trigger authenticate (in a web context). See SecurityContext#authenticate for details on triggering authentication.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.