You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@shiro.apache.org by "phil198 (via GitHub)" <gi...@apache.org> on 2026/06/26 10:15:07 UTC
[I] [Bug] AllowAllCredentialsMatcher logs a "matched the simulated credentials" error via simulateFailedLogin [shiro]
phil198 opened a new issue, #2818:
URL: https://github.com/apache/shiro/issues/2818
### Search before asking
- [x] I had searched in the [issues, **including closed issues**](https://github.com/apache/shiro/issues?q=is%3Aissue) and found no similar issues.
### Environment
Any application using a `ModularRealmAuthenticator` with more than one realm, where at least one realm uses `AllowAllCredentialsMatcher` (i.e. the realm verifies credentials elsewhere — token/SSO validation, an LDAP bind, or implicit trust — and returns `null` from `doGetAuthenticationInfo` for principals it doesn't own). Reproduced on JDK 21; doesn't appear to be OS- or app-server-specific.
### Shiro version
2.1.0. It looks like this surfaces from 2.0.7 onwards, when `simulateFailedLogin`/`createSimulatedCredentials` were introduced (the fix for CVE-2026-23901, user-enumeration timing).
### What was the actual outcome?
When an `AllowAllCredentialsMatcher` realm is asked about a principal it doesn't own, `AuthenticatingRealm` logs an `ERROR` with an `IncorrectCredentialsException` stack trace (`"…matched the simulated credentials. This indicates a misconfiguration of the realm's CredentialsMatcher or simulated credentials."`). In a multi-realm setup this happens on every login that another realm handles, so it can produce a lot of log noise even though authentication itself works fine (the exception is caught internally).
I think this comes from an interaction between `AllowAllCredentialsMatcher` and `simulateFailedLogin`:
- When `doGetAuthenticationInfo` returns `null`, `getAuthenticationInfo` calls `simulateFailedLogin(token)`, which matches the submitted token against the decoy from `createSimulatedCredentials()` and treats a match as a misconfiguration:
```java
// AuthenticatingRealm
AuthenticationInfo simulated = ensureSimulatedAuthenticationInfo();
if (simulated != null && assertCredentialsMatchWithoutException(token, simulated)) {
throw new IncorrectCredentialsException("... matched the simulated credentials ...");
}
```
- `AllowAllCredentialsMatcher` matches everything and also supplies a non-empty decoy:
```java
public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) { return true; }
@Override
public Optional<AuthenticationInfo> createSimulatedCredentials() {
return Optional.of(new SimpleAuthenticationInfo("user", "password", "realm"));
}
```
Since `createSimulatedCredentials()` is meant to provide a decoy that `doCredentialsMatch` will not match, an always-matching matcher can't really satisfy that, so the check is always taken and the error logged.
### What was the expected outcome?
Ideally a realm that intentionally trusts credentials via `AllowAllCredentialsMatcher` wouldn't log a misconfiguration error just because it found no account for a principal. One option is for the matcher to return `Optional.empty()` from `createSimulatedCredentials()`; the only snag is that `ensureSimulatedAuthenticationInfo` then logs a `WARN` (`"CredentialsMatcher … did not supply simulated credentials"`) on each call, so it'd be nice if that warning were emitted once (or skipped for matchers that opt out) too. Happy to open a PR along these lines if that direction sounds reasonable.
### How to reproduce
1. Configure a realm whose `doGetAuthenticationInfo` returns `null` for unknown principals, with `setCredentialsMatcher(new AllowAllCredentialsMatcher())`.
2. Call `realm.getAuthenticationInfo(token)` with a token for a principal that realm doesn't own (the usual case in a multi-realm `ModularRealmAuthenticator`, e.g. a native user when an SSO realm is also configured).
3. Observe an `ERROR` from `org.apache.shiro.realm.AuthenticatingRealm` on each such call.
Minimal sketch:
```java
AuthenticatingRealm realm = new AuthenticatingRealm() {
@Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken t) { return null; }
};
realm.setCredentialsMatcher(new AllowAllCredentialsMatcher());
realm.getAuthenticationInfo(new UsernamePasswordToken("alice", "secret")); // logs the ERROR
```
### Debug logs
### Debug logs
```
ERROR CredentialsMatcher [org.apache.shiro.authc.credential.AllowAllCredentialsMatcher@20d5fd1e] threw exception on method 'doCredentialsMatch'
org.apache.shiro.authc.IncorrectCredentialsException: Submitted credentials for token [{ ... principal='alice' ... }] matched the simulated credentials. This indicates a misconfiguration of the realm's CredentialsMatcher or simulated credentials. Please review your configuration.
at org.apache.shiro.realm.AuthenticatingRealm.simulateFailedLogin(AuthenticatingRealm.java:601)
at org.apache.shiro.realm.AuthenticatingRealm.getAuthenticationInfo(AuthenticatingRealm.java:588)
at org.apache.shiro.authc.pam.ModularRealmAuthenticator.doMultiRealmAuthentication(ModularRealmAuthenticator.java:227)
at org.apache.shiro.authc.pam.ModularRealmAuthenticator.doAuthenticate(ModularRealmAuthenticator.java:277)
at org.apache.shiro.authc.AbstractAuthenticator.authenticate(AbstractAuthenticator.java:198)
...
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [I] [Bug] AllowAllCredentialsMatcher logs a "matched the simulated credentials" error via simulateFailedLogin [shiro]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
lprimak commented on issue #2818:
URL: https://github.com/apache/shiro/issues/2818#issuecomment-5160249189
Hi, Phil,
Do you mind opening a PR for this issue?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [I] [Bug] AllowAllCredentialsMatcher logs a "matched the simulated credentials" error via simulateFailedLogin [shiro]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
lprimak closed issue #2818: [Bug] AllowAllCredentialsMatcher logs a "matched the simulated credentials" error via simulateFailedLogin
URL: https://github.com/apache/shiro/issues/2818
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org