You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2006/08/01 10:52:32 UTC
DO NOT REPLY [Bug 40150] New: - Incorrect User/Role classnames are silently ignored.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40150>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40150
Summary: Incorrect User/Role classnames are silently ignored.
Product: Tomcat 5
Version: 5.5.17
Platform: All
OS/Version: other
Status: NEW
Severity: normal
Priority: P2
Component: Catalina
AssignedTo: tomcat-dev@jakarta.apache.org
ReportedBy: vandenberget@aciworldwide.com
org.apache.catalina.realm.JAASRealm does not verify any of the class names that
are set through setRoleClassNames() and setUserClassNames().
If an incorrect class name (e.g. a typo) is configured in context.xml, this is
unnoticed by JAASRealm. The result is that during authentication, when the
subject's principals are checked against the configured class names, the
principals are not recognised, and therefore not added to the subject.
The fact an incorrect configured class name is currently not detected and logged
makes it very hard to find the source of the problem. It can be easily fixed by
checking the class names in the two methods mentioned above. The class must
exist, and it must implement java.security.Principal, which is currently not
enforced/checked by the code.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40150] - Incorrect User/Role classnames are silently ignored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40150>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40150
------- Additional Comments From vandenberget@aciworldwide.com 2006-12-27 00:54 -------
Created an attachment (id=19306)
--> (http://issues.apache.org/bugzilla/attachment.cgi?id=19306&action=view)
Patch of JAASRealm.java (in diff format)
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40150] - Incorrect User/Role classnames are silently ignored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40150>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40150
yoavs@computer.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |ASSIGNED
------- Additional Comments From yoavs@computer.org 2006-12-26 05:24 -------
This looks like a good idea to enhance. However, please submit your patch in
diff format rather than the whole file, that would make its review and
application much faster: http://www.apache.org/dev/contributors.html#patches
provides more details.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40150] - Incorrect User/Role classnames are silently ignored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40150>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40150
------- Additional Comments From vandenberget@aciworldwide.com 2006-08-01 09:00 -------
Created an attachment (id=18668)
--> (http://issues.apache.org/bugzilla/attachment.cgi?id=18668&action=view)
Proposed fixed version of JAASRealm.
This version of JAASRealm validates the class names for setUserClassNames and
setRoleClassNames. It verifies if the class exists, and if it implements
java.security.Principal. If not, it logs a message (severe), that allows users
to detect the incorrect class name.
It might even be better if it threw an exception.
I've also restructured the code to parse the comma-delimited class name string,
as it was rather inefficient. It uses a StringTokenizer now.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40150] - Incorrect User/Role classnames are silently ignored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40150>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40150
markt@apache.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution| |FIXED
------- Additional Comments From markt@apache.org 2008-01-21 13:01 -------
This has been fixed as per the comments in 44084.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40150] - Incorrect User/Role classnames are silently ignored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40150>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40150
ate@douma.nu changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|FIXED |
------- Additional Comments From ate@douma.nu 2007-12-13 06:13 -------
While this patch might have improved feedback when an incorrect classnames are
provided, it actually fully *breaks* JAASRealm usage when correct classnames are
provided but need to be accessed through a ContextClassLoader.
We at Apache Jetspeed-2 use the useContextClassLoader=true setting for hooking
up our own custom Principal classes as these are provided through the portal
application itself, not from a common/shared classloader.
Because the new parseClassNames only does a simple Class.forName() check this
now fails to validate our classnames for Tomcat 5.5.24 and later and thereby
breaking our JAAS based security :(
I suggest this to be solved by either:
- reverting the patch
- keep the current patch but *ignore* a ClassNotFoundException except for
logging that it happened
- run this method in the appropriate ContextClassLoader for the web app if possible
FYI: we have a Jetspeed JIRA issue opened on this bug with some additional
information: https://issues.apache.org/jira/browse/JS2-828
Hopefully this issue can be resolved quickly as right now we cannot run Jetspeed
on Tomcat >= 5.5.24
Regards, Ate
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40150] - Incorrect User/Role classnames are silently ignored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40150>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40150
------- Additional Comments From yoavs@computer.org 2007-12-27 14:33 -------
See http://issues.apache.org/bugzilla/show_bug.cgi?id=44084 for the Tomcat 6
version of this issue. This has been fixed in the Tomcat SVN trunk, and should
be integrated into the next 5.5 and 6 releases.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40150] - Incorrect User/Role classnames are silently ignored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40150>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40150
ate@douma.nu changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |ate@douma.nu
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40150] - Incorrect User/Role classnames are silently ignored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40150>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40150
yoavs@computer.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |RESOLVED
Resolution| |FIXED
------- Additional Comments From yoavs@computer.org 2007-03-25 14:42 -------
Tom, thanks for providing this patch in diff form. I've applied it to the
Tomcat 5.5 and 6.0 trunks, I really like it. Sorry it took so long.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40150] - Incorrect User/Role classnames are silently ignored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40150>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40150
ate@douma.nu changed:
What |Removed |Added
----------------------------------------------------------------------------
Severity|normal |blocker
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40150] - Incorrect User/Role classnames are silently ignored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40150>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40150
------- Additional Comments From vandenberget@aciworldwide.com 2006-08-01 11:28 -------
Created an attachment (id=18669)
--> (http://issues.apache.org/bugzilla/attachment.cgi?id=18669&action=view)
Improved version of the patch
No longer using StringTokenizer, but String.split, as StringTokenizer is
considered legacy. Thanks to Sameer Acharya.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org