@Override
    public Object beforeGettingConnection(Subject subject, ConnectionRequestInfo reqInfo) throws ResourceException {
        if (tc.isEntryEnabled())
            Tr.entry(this, tc, "beforeGettingConnection", getSubjectString(subject), reqInfo);

        Object retObject = null;
        final Subject subj = subject;

        // If Security is enabled, continue. Otherwise exit immediately
        // with a null object.

        if (ThreadIdentityManager.isThreadIdentityEnabled()) {

            // Check if the current resource adapter MCF configuration
            // supports using ThreadIdentity. If so, continue processing.
            // Otherwise get out.

            if ((m_ThreadIdentitySupport != AbstractConnectionFactoryService.THREAD_IDENTITY_NOT_ALLOWED)) {

                if (subj != null) {
                    // resauth = CONTAINER

                    // Check if UTOKEN Generic Credential was found. If so,
                    // the subject being processed represents the user identity
                    // currently associated with the thread we are running under
                    // (i.e., was established by finalizeSubject()). In this case,
                    // if SyncToThread is enabled for the server and this resource
                    // adapter (e.g., DB2 or IMS DL/I) indicates it needs the user
                    // identity associated with the thread actually pushed to the
                    // OS thread, then push the user identity to the OS thread.
                    // Under z/OS, this will create an ACEE for the user identity
                    // on the z/OS Thread. Connectors like the DB2 390 Local JDBC
                    // Provider and the IMS DL/I Connector in the case of a
                    // getConnection() request without any userid/password base
                    // the connection owner on the user represented by the
                    // user identity of the current z/OS thread.
                    //
                    //
                    // It should be noted that if SyncToThread is not enabled
                    // for the server, we cannot push the user identity to the
                    // OS thread. In this case, the WAS z/OS server will not
                    // have a security ACEE at all. In this situation,
                    // Connectors like the DB2 390 Local JDBC Provider and the IMS
                    // DL/I Connector will end up using the Server identity as
                    // user associated with the connection. Even though server
                    // identity will be used, the Subject used by
                    // Connection Management will be left set to the
                    // user identity associated with the current
                    // thread (e.g., RunAs Caller or Role user) and
                    // connection pooling will be based on this
                    // subject as opposed to using the Server identity.

                    if (doesSubjectContainUTOKEN(subj)) {

                        // We are using the user identity associated with the thread.
                        // The Subject contains a UTOKEN credential representing that
                        // user identity.

                        if (m_ThreadSecurity) {

                            // Connector requires that user identity be pushed to
                            // OS Thread.

                            if (ThreadIdentityManager.isJ2CThreadIdentityEnabled()) {

                                // J2C SyncToThread is enabled for Server.
                                // Push Subject to thread

                                retObject = setJ2CThreadIdentity(subj);

                                if (tc.isDebugEnabled()) {
                                    Tr.debug(tc, "beforeGettingConnection() pushed the user identity associated with the thread to the OS Thread:  ",
                                             new Object[] { getSubjectString(subj) });
                                }

                            } else {

                                // J2C SyncToThread not enabled for Server.
                                // The adapter Will run with server identity
                                // since we are not able to push the Subject's
                                // user identity to the current OS thread as an ACEE.

                                if (tc.isDebugEnabled()) {
                                    Tr.debug(
                                             tc,
                                             "beforeGettingConnection() could not push user identity associated with the thread to the OS Thread  because server was not enabled for SyncToThread.");
                                }

                                // Now we may need to synch server ID to thread.
                                // We found a UTOKEN credential on the Subject,
                                // which indicates that no container-managed alias was
                                // specified, (in which case finalizeSubject would not
                                // have gone through the process of getting a Subject with
                                // UTOKEN credential).  So if (Connection Mgmt) SyncToThread is
                                // not enabled but Application SynchToThread is enabled, we
                                // would end up using the RunAs anyway, from the Application Synch,
                                // even though (Connection Mgmt) SyncToThread was disabled.
                                //
                                // We wish to control the id used to get a connection within Connection
                                // Mgmt code alone and to isolate the behavior from any settings not
                                // related to Connection Mgmt.  If no Application Synch were done,
                                // a Thread Security-enabled connector would use server id to get a
                                // connection (when no container alias was specified and when no Connection Mgmt
                                // synch was done).  So we add this code to ensure that the server id
                                // is also used to get a connection if an Application Synch has
                                // been performed (and no container alias was specified and when no Connection Mgmt
                                // synch was done)
                                //
                                // This is only worth doing if the Appliation Synch has been enabled.  Though we
                                // won't determine if the Application Synch has actually been done.

                                if (ThreadIdentityManager.isAppThreadIdentityEnabled()) {

                                    if (tc.isDebugEnabled()) {
                                        Tr.debug(tc, "beforeGettingConnection() pushing server identity to the OS Thread because Application SyncToThread is enabled.");
                                    }

                                    // get Server subject and push it to the current OS thread
                                    retObject = ThreadIdentityManager.runAsServer();
                                }
                            }

                        } else {
                            // OS ThreadSecurity is not enabled
                            // The adapter will use the user identity
                            // from the Subject that is associated with the
                            // current thread (i.e., the subject that is
                            // passed to the adapter).
                        }

                    } else {
                        // Subject doesn't have a UTOKEN GenericCredential.
                        // Check if we have an unexpected error situation.
                        checkForUTOKENNotFoundError(subj);
                    }

                } else {
                    // resauth = APPLICATION

                    // When resauth is Application and the current
                    // connector is one that supports using ThreadSecurity (i.e,
                    // associates the user identity from the OS Thread with the
                    // connection when getConnection() is done without
                    // a userid/password), check if the server is enabed to perform
                    // SynctoThread. If so, get the Server identity and push
                    // the Server identity to the current OS Thread.
                    //
                    // The reason for this is to ensure consistency in terms of
                    // the default user identity used by the connector.
                    // Whenever a connector that supports ThreadSecurity defaults,
                    // we want to ensure the default is Server identity. For
                    // example, in the case of resauth=Container, if we try
                    // to push the current user identity asscoiated with the
                    // thread to the OS thread, but the server is not enabled
                    // to perform SyncToThread, we cannot push the user identity
                    // to the thread. Thus, in this case, the connector
                    // will default to using the Server identity as the owner of
                    // the connection that is allocated. Similarly, when
                    // resauth=Application and the getConnection() request is
                    // issued without a userid/password, we want to ensure that
                    // the connector defaults to using Server Identity. Thus,
                    // to make this happen, we push the Server identity to the
                    // current OS thread whenever resauth=Application and the
                    // connector supports ThreadSecurity. If it so happens
                    // that the application ends up issuing getConnection() with
                    // a userid/password, the fact that we have pushed the
                    // Server identity to the OS thread will not impact processing.
                    // Later, during afterGettingConnection() processing, the
                    // OS Thread Identity will then be returned to what it was.

                    if (m_ThreadSecurity && ThreadIdentityManager.isThreadIdentityEnabled()) {
                        // Get Server subject and push it to the current OS thread
                        retObject = ThreadIdentityManager.runAsServer();
                    }
                }
            }

        } else {
            // Security not enabled
            if (tc.isDebugEnabled()) {
                Tr.debug(tc, "beforeGettingConnection() processing skipped. Security not enabled.");
            }

            // NOTE: In the case where Security is not enabled, if
            // no Container-managed alias was specified and the
            // connector ALLOWS or REQUIRES ThreadIdentitySupport,
            // any connection obtained will be associated with
            // server identity.
        }

        if (tc.isEntryEnabled())
            Tr.exit(this, tc, "beforeGettingConnection", retObject);
        return retObject;
    }
@ Override public Object beforeGettingConnection ( Subject subject , ConnectionRequestInfo reqInfo ) throws ResourceException { if ( tc . isEntryEnabled ( ) ) Tr . entry ( this , tc , "beforeGettingConnection" , getSubjectString ( subject ) , reqInfo ) ; Object retObject = null ; final Subject subj = subject ; if ( ThreadIdentityManager . isThreadIdentityEnabled ( ) ) { if ( ( m_ThreadIdentitySupport != AbstractConnectionFactoryService . THREAD_IDENTITY_NOT_ALLOWED ) ) { if ( subj != null ) { if ( doesSubjectContainUTOKEN ( subj ) ) { if ( m_ThreadSecurity ) { if ( ThreadIdentityManager . isJ2CThreadIdentityEnabled ( ) ) { retObject = setJ2CThreadIdentity ( subj ) ; if ( tc . isDebugEnabled ( ) ) { Tr . debug ( tc , "beforeGettingConnection() pushed the user identity associated with the thread to the OS Thread:  " , new Object [ ] { getSubjectString ( subj ) } ) ; } } else { if ( tc . isDebugEnabled ( ) ) { Tr . debug ( tc , "beforeGettingConnection() could not push user identity associated with the thread to the OS Thread  because server was not enabled for SyncToThread." ) ; } if ( ThreadIdentityManager . isAppThreadIdentityEnabled ( ) ) { if ( tc . isDebugEnabled ( ) ) { Tr . debug ( tc , "beforeGettingConnection() pushing server identity to the OS Thread because Application SyncToThread is enabled." ) ; } retObject = ThreadIdentityManager . runAsServer ( ) ; } } } else { } } else { checkForUTOKENNotFoundError ( subj ) ; } } else { if ( m_ThreadSecurity && ThreadIdentityManager . isThreadIdentityEnabled ( ) ) { retObject = ThreadIdentityManager . runAsServer ( ) ; } } } } else { if ( tc . isDebugEnabled ( ) ) { Tr . debug ( tc , "beforeGettingConnection() processing skipped. Security not enabled." ) ; } } if ( tc . isEntryEnabled ( ) ) Tr . exit ( this , tc , "beforeGettingConnection" , retObject ) ; return retObject ; }
{@inheritDoc}

The beforeGettingConnection() method is used to allow
special security processing to be performed prior to calling
a resource adapter to get a connection. If ThreadIdentitySupport
is "ALLOWED" or "REQUIRED" and the input Subject is not null
(i.e., res-auth=Container), search the credentials for a
UTOKEN generic credential. If found and ThreadSecurity is true,
indicating the adapter will get the connection user identity
from the OS thread ACEE, push the Subject to the OS Thread in the
form of an ACEE if SyncToThread is enabled. In the case where
SyncToThread is not enabled, the connector by default will
get Server identity since no user identity will have been
pushed to the OS thread.

In the case, where the input Subject is null (i.e.,
res-auth=Application or Servlet) and the resource adapter
requires OS ThreadSecurity when a getConnection is issued without
a userid/password, push the Server identity to the OS thread in the
form of an ACEE if the Server is enabled to allow the subject
to be sync'd to thread. If SyncToThread is not allowed, the
connector by default will get Server identity since no user
identity will have been pushed to the current OS thread.

@param Subject subject
@param ConnectionRequestInfo reqInfo
@return Object if non-null, the user identity defined by the
Subject was pushed to thread. The Object in
this case needs to be passed as input to
afterGettingConnection method processing and
will be used to restore the thread identity
back to what it was.
@exception ResourceException