Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8064331

JavaSecurityAccess.doIntersectionPrivilege() drops the information about the domain combiner of the stack ACC

XMLWordPrintable

        This issue was reported against the JMX functionality. When a user tries to do the following
        ```
        AccessControlContext acc = AccessController.getContext();
        Subject subject = Subject.getSubject(acc);
        ```
        the subject is always null even though it should contain the currently authenticated Subject.

        The reason for this is the combination of the facts that JMX is using JavaSecurityAccess.doIntersectionPrivilege(actin, stackACC, savedACC) to invoke a code in the combined access control context and this method just drops the information about the domain combiner of the stack ACC.

        In turn, Subject.getSubject(acc) relies on a correct domain container used in the current ACC and fails.

              jbachorik Jaroslav Bachorík
              shadowbug Shadow Bug
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved: