You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2006/04/06 22:20:00 UTC
DO NOT REPLY [Bug 39231] New: - The JAAS contract for LoginModule is broken
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=39231>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=39231
Summary: The JAAS contract for LoginModule is broken
Product: Tomcat 5
Version: 5.5.16
Platform: All
OS/Version: All
Status: NEW
Severity: normal
Priority: P2
Component: Catalina
AssignedTo: tomcat-dev@jakarta.apache.org
ReportedBy: seva_popov@tvworks.com
The issue is that the custom JAAS's LoginModule.logout() method is never
called. I guess this has been never implemented correctly (at least since
Tomcat 5.5.9).
The thing is that according to the JAAS spec, the LoginContext.logout() is
supposed to invoke the logout method for each LoginModule configured for this
LoginContext.
So, somebody should be sure to call LoginContext.logout() method. The caller
for this method could be either a server or a client.
So, either Tomcat should provide some means to access the LoginContext to the
clients, or Tomcat should take the responsibility to call this method by itself.
I guess the solution could be for Tomcat to associate the instance of
LoginContext with the user's session, and then Tomcat could invoke
LoginContext.logout() when the session is being invalidated (both when the
session times out or invalidated explicitely).
I hope that I am correctly interpreting the JAAS spec.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 39231] - The JAAS contract for LoginModule is broken
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=39231>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=39231
------- Additional Comments From yoavs@computer.org 2006-04-13 18:21 -------
OK, thanks. If/when you get a chance to work on a patch, I will be glad to
review and commit it as necessary. I myself don't have the time to develop one
right now either, but I wanted to make sure you were still interested. Thanks.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 39231] - The JAAS contract for LoginModule is broken
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=39231>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=39231
seva_popov@tvworks.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|P2 |P1
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 39231] - The JAAS contract for LoginModule is broken
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=39231>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=39231
yoavs@computer.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|P1 |P3
------- Additional Comments From yoavs@computer.org 2006-04-13 21:34 -------
Normal is P3, not P1.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 39231] - The JAAS contract for LoginModule is broken
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=39231>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=39231
seva_popov@tvworks.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEEDINFO |NEW
------- Additional Comments From seva_popov@tvworks.com 2006-04-13 18:11 -------
1.
http://java.sun.com/j2se/1.5.0/docs/api/javax/security/auth/login/LoginContext.h
tml
"A typical caller instantiates a LoginContext with a name and a
CallbackHandler..."
"Once the caller has instantiated a LoginContext, it invokes the login method
to authenticate a Subject..."
"To logout the Subject, the caller calls the logout method. As with the login
method, this logout method invokes the logout method for the configured
modules..."
2. Unfortunately, I am on a tight deadline for my company, so can not work on
the patch (for myself I've just create a workaround for my logout requirements
by utilizing the HttpSessionBindingListener interface, though I haven't tested
it yet).
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 39231] - The JAAS contract for LoginModule is broken
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=39231>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=39231
------- Additional Comments From jason_chaffee@tvworks.com 2006-04-19 00:45 -------
I don't have a patch, but I do have a solution that I can outline here.
Basically, the LoginContext needs to be saved in the session so logout can be
called on it when the session is invalidated or expires. Currently, this is a
problem because the LoginContext is created in the JAASRealm and discarded
after login is called and the only place that the session is available is in
the Authenticator.
Here is a proposed solution:
1) Create a pojo that has getPrincipal() and getLoginContext(). Let's call
this pojo, RealmPrincipal.
2) Change the Realm's authenticate methods to return a RealmPrincipal object
instead of a Principal.
3) Change the Realm impl's to create and return the RealmPrincipal, including
the LoginContext where appropriate.
4) Change the Authentcator's to check to see if the LoginContext is not null
and add it to the session notes the same as currently is being done with the
principal.
5) Change the StandardSession expires() method to check for the LoginContext
in the notes and call logout on it, if it is present.
I hope this is clear and sufficient for a timely fix. Thanks.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org