[cxf] branch master updated: Implement "abort" properly in the STSLoginModule

[co...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/master by this push:
     new f8c59c1  Implement "abort" properly in the STSLoginModule
f8c59c1 is described below

commit f8c59c182755eaa3570831916718d69f5eed1efb
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Tue Jan 15 18:04:10 2019 +0000

    Implement "abort" properly in the STSLoginModule
---
 .../cxf/ws/security/trust/STSLoginModule.java      | 28 ++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/STSLoginModule.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/STSLoginModule.java
index 7cf524a..d4e9163 100644
--- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/STSLoginModule.java
+++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/STSLoginModule.java
@@ -165,6 +165,10 @@ public class STSLoginModule implements LoginModule {
     private String namespace;
     private Map<String, Object> stsClientProperties = new HashMap<>();
 
+    /** the authentication status*/
+    private boolean succeeded;
+    private boolean commitSucceeded;
+
     @Override
     public void initialize(Subject subj, CallbackHandler cbHandler, Map<String, ?> sharedState,
                            Map<String, ?> options) {
@@ -275,6 +279,7 @@ public class STSLoginModule implements LoginModule {
             throw new LoginException("User " + user + " authentication failed: " + e.getMessage());
         }
 
+        succeeded = true;
         return true;
     }
 
@@ -381,16 +386,31 @@ public class STSLoginModule implements LoginModule {
 
     @Override
     public boolean commit() throws LoginException {
-        if (userPrincipal == null) {
+        if (!succeeded || userPrincipal == null) {
+            roles.clear();
+            succeeded = false;
+            userPrincipal = null;
             return false;
-        }
+        } 
         subject.getPrincipals().add(userPrincipal);
         subject.getPrincipals().addAll(roles);
+        commitSucceeded = true;
         return true;
     }
 
     @Override
     public boolean abort() throws LoginException {
+        if (!succeeded) {
+            return false;
+        } else if (succeeded && commitSucceeded) {
+            // we succeeded, but another required module failed
+            logout();
+        } else {
+            // our commit failed
+            roles.clear();
+            userPrincipal = null;
+            succeeded = false;
+        }
         return true;
     }
 
@@ -400,6 +420,10 @@ public class STSLoginModule implements LoginModule {
         subject.getPrincipals().removeAll(roles);
         roles.clear();
         userPrincipal = null;
+
+        succeeded = false;
+        commitSucceeded = false;
+
         return true;
     }