jackrabbit-oak-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Julian Reschke (Jira)" <j...@apache.org>
Subject [jira] [Commented] (OAK-8710) AbstractLoginModule#logout() must not remove 'foreign' principals/credentials
Date Tue, 03 Dec 2019 15:58:00 GMT

    [ https://issues.apache.org/jira/browse/OAK-8710?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16987029#comment-16987029
] 

Julian Reschke commented on OAK-8710:
-------------------------------------

Javadoc fixed in [r1870758|http://svn.apache.org/r1870758]

> AbstractLoginModule#logout() must not remove 'foreign' principals/credentials 
> ------------------------------------------------------------------------------
>
>                 Key: OAK-8710
>                 URL: https://issues.apache.org/jira/browse/OAK-8710
>             Project: Jackrabbit Oak
>          Issue Type: Bug
>          Components: auth-external, core, security-spi
>            Reporter: Manfred Baedke
>            Assignee: Angela Schreiber
>            Priority: Minor
>             Fix For: 1.22.0
>
>         Attachments: OAK-8710.patch, logout.png
>
>
> See https://github.com/apache/jackrabbit-oak/blob/9569d659f0655d3ba16c1cfe1fbb5f53959f701f/oak-security-spi/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/AbstractLoginModule.java#L189:
> The criterion for logout() to succeed is
> {code}!subject.getPrincipals().isEmpty() && !subject.getPublicCredentials(Credentials.class).isEmpty(){code}
> This did not work in a case where the subject was created by a thread handling an authenticated
JMX connection (and later passed on to other threads due to AccessControlContext inheritage).
> I'd propose to make logout() succeed unconditionally, but I'm not entirely sure about
side effects.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

Mime
View raw message