users@glassfish.java.net

Security restrictions on Singletons with _at_Startup annotation

From: <glassfish_at_javadesktop.org>
Date: Thu, 21 Jan 2010 00:31:56 PST

Hi,

for initialization purposes I'm using a [i]@Singleton[/i] with [i]@Startup[/i] annotation including a [i]@PostConstruct[/i] annotated method ([i]private void init()[/i]). The application runs on GlassFish v3 final.

In my Singleton-Init method especially the [i]HBCIUtils.init()[/i] method from the HBCI4Java project (http://hbci4java.kapott.org) is called. The [i]HBCIUtils.init()[/i] method tries to register new hash and signature algorithms by using its own security provider ([i]java.security.Provider[/i]). At this point an AccessControlException is thrown. Calling the [i]HBCIUtils.init()[/i] method at any other place (e.g. in an [i]@Entity[/i] method) works without raising this exception:

javax.ejb.EJBException: javax.ejb.CreateException: Initialization failed for Singleton Globals
        at com.sun.ejb.containers.AbstractSingletonContainer$SingletonContextFactory.create(AbstractSingletonContainer.java:695)
        at com.sun.ejb.containers.AbstractSingletonContainer.instantiateSingletonInstance(AbstractSingletonContainer.java:444)
        at org.glassfish.ejb.startup.SingletonLifeCycleManager.initializeSingleton(SingletonLifeCycleManager.java:213)
        at org.glassfish.ejb.startup.SingletonLifeCycleManager.initializeSingleton(SingletonLifeCycleManager.java:174)
        at org.glassfish.ejb.startup.SingletonLifeCycleManager.doStartup(SingletonLifeCycleManager.java:152)
        at org.glassfish.ejb.startup.EjbApplication.start(EjbApplication.java:150)
        at org.glassfish.internal.data.EngineRef.start(EngineRef.java:126)
        at org.glassfish.internal.data.ModuleInfo.start(ModuleInfo.java:241)
        at org.glassfish.internal.data.ApplicationInfo.start(ApplicationInfo.java:236)
        at com.sun.enterprise.v3.server.ApplicationLifecycle.deploy(ApplicationLifecycle.java:339)
        at com.sun.enterprise.v3.server.ApplicationLifecycle.deploy(ApplicationLifecycle.java:183)
        at org.glassfish.deployment.admin.DeployCommand.execute(DeployCommand.java:272)
        at com.sun.enterprise.v3.admin.CommandRunnerImpl$1.execute(CommandRunnerImpl.java:305)
        at com.sun.enterprise.v3.admin.CommandRunnerImpl.doCommand(CommandRunnerImpl.java:320)
        at com.sun.enterprise.v3.admin.CommandRunnerImpl.doCommand(CommandRunnerImpl.java:1176)
        at com.sun.enterprise.v3.admin.CommandRunnerImpl.access$900(CommandRunnerImpl.java:83)
        at com.sun.enterprise.v3.admin.CommandRunnerImpl$ExecutionContext.execute(CommandRunnerImpl.java:1235)
        at com.sun.enterprise.v3.admin.CommandRunnerImpl$ExecutionContext.execute(CommandRunnerImpl.java:1224)
        at com.sun.enterprise.v3.admin.AdminAdapter.doCommand(AdminAdapter.java:365)
        at com.sun.enterprise.v3.admin.AdminAdapter.service(AdminAdapter.java:204)
        at com.sun.grizzly.tcp.http11.GrizzlyAdapter.service(GrizzlyAdapter.java:166)
        at com.sun.enterprise.v3.server.HK2Dispatcher.dispath(HK2Dispatcher.java:100)
        at com.sun.enterprise.v3.services.impl.ContainerMapper.service(ContainerMapper.java:245)
        at com.sun.grizzly.http.ProcessorTask.invokeAdapter(ProcessorTask.java:791)
        at com.sun.grizzly.http.ProcessorTask.doProcess(ProcessorTask.java:693)
        at com.sun.grizzly.http.ProcessorTask.process(ProcessorTask.java:954)
        at com.sun.grizzly.http.DefaultProtocolFilter.execute(DefaultProtocolFilter.java:170)
        at com.sun.grizzly.DefaultProtocolChain.executeProtocolFilter(DefaultProtocolChain.java:135)
        at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:102)
        at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:88)
        at com.sun.grizzly.http.HttpProtocolChain.execute(HttpProtocolChain.java:76)
        at com.sun.grizzly.ProtocolChainContextTask.doCall(ProtocolChainContextTask.java:53)
        at com.sun.grizzly.SelectionKeyContextTask.call(SelectionKeyContextTask.java:57)
        at com.sun.grizzly.ContextTask.run(ContextTask.java:69)
        at com.sun.grizzly.util.AbstractThreadPool$Worker.doWork(AbstractThreadPool.java:330)
        at com.sun.grizzly.util.AbstractThreadPool$Worker.run(AbstractThreadPool.java:309)
        at java.lang.Thread.run(Thread.java:619)
Caused by: javax.ejb.CreateException: Initialization failed for Singleton Globals
        at com.sun.ejb.containers.AbstractSingletonContainer.createSingletonEJB(AbstractSingletonContainer.java:525)
        at com.sun.ejb.containers.AbstractSingletonContainer.access$100(AbstractSingletonContainer.java:74)
        at com.sun.ejb.containers.AbstractSingletonContainer$SingletonContextFactory.create(AbstractSingletonContainer.java:693)
        ... 36 more
Caused by: org.kapott.hbci.exceptions.HBCI_Exception: *** error while initializing HBCI4Java
        at org.kapott.hbci.manager.HBCIUtils.init(HBCIUtils.java:593)
        at de.overturn.ecrm.Globals.init(Globals.java:27)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at com.sun.ejb.containers.interceptors.BeanCallbackInterceptor$1.run(InterceptorManager.java:999)
        at java.security.AccessController.doPrivileged(Native Method)
        at com.sun.ejb.containers.interceptors.BeanCallbackInterceptor.intercept(InterceptorManager.java:995)
        at com.sun.ejb.containers.interceptors.CallbackChainImpl.invokeNext(CallbackChainImpl.java:61)
        at com.sun.ejb.containers.interceptors.CallbackInvocationContext.proceed(CallbackInvocationContext.java:109)
        at com.sun.ejb.containers.interceptors.SystemInterceptorProxy.doCallback(SystemInterceptorProxy.java:133)
        at com.sun.ejb.containers.interceptors.SystemInterceptorProxy.init(SystemInterceptorProxy.java:115)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at com.sun.ejb.containers.interceptors.CallbackInterceptor$2.run(InterceptorManager.java:956)
        at java.security.AccessController.doPrivileged(Native Method)
        at com.sun.ejb.containers.interceptors.CallbackInterceptor.intercept(InterceptorManager.java:953)
        at com.sun.ejb.containers.interceptors.CallbackChainImpl.invokeNext(CallbackChainImpl.java:61)
        at com.sun.ejb.containers.interceptors.InterceptorManager.intercept(InterceptorManager.java:390)
        at com.sun.ejb.containers.interceptors.InterceptorManager.intercept(InterceptorManager.java:373)
        at com.sun.ejb.containers.AbstractSingletonContainer.createSingletonEJB(AbstractSingletonContainer.java:518)
        ... 38 more
Caused by: java.security.AccessControlException: access denied (java.security.SecurityPermission putProviderProperty.HBCIProvider)
        at java.security.AccessControlContext.checkPermission(AccessControlContext.java:323)
        at java.security.AccessController.checkPermission(AccessController.java:546)
        at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
        at java.lang.SecurityManager.checkSecurityAccess(SecurityManager.java:1698)
        at java.security.Provider.check(Provider.java:386)
        at java.security.Provider.put(Provider.java:309)
        at org.kapott.hbci.security.HBCIProvider.<init>(HBCIProvider.java:39)
        at org.kapott.hbci.manager.HBCIUtils.init(HBCIUtils.java:591)
        ... 61 more

So my question is, if there are any special security restrictions which apply to [i]@Startup[/i] annotated singletons?
[Message sent by forum member 'anusplus' (anus.plus_at_gmx.de)]

http://forums.java.net/jive/thread.jspa?messageID=382101