oscerd opened a new pull request, #25822: URL: https://github.com/apache/camel/pull/25822
Fixes [CAMEL-24439](https://issues.apache.org/jira/browse/CAMEL-24439). ShiroSecurityProcessor.authenticateUser() called login() only when the thread-bound subject was not already authenticated for the same username as the incoming ShiroSecurityToken: if (!authenticated || !sameUser) { ... currentUser.login(token); } That conflates "same principal name" with "same credentials". Once a user had authenticated on a worker thread, a later exchange presenting that username with any password was accepted for as long as the subject stayed bound, because the password was never checked. The default alwaysReauthenticate=true masks it, since the processor calls logout() in a finally block after each exchange. With alwaysReauthenticate=false the skip is reachable, and that mode deliberately sets rememberMe(true) to keep subjects long-lived on Camel's shared worker threads. Call login() for every exchange with the credentials that exchange presented. Shiro offers no way to compare presented credentials against a bound subject, so the principal-name comparison could not be made sound and is removed rather than narrowed. The added test sends a valid token for ringo, then the same username with a wrong password on the same thread; without the fix both reach mock:success. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> \n## Verification\n\n3 files changed, including 1 test file(s). Module build with \`-am\` is green on current main, no generated-file drift. Verified against the pre-fix code when the change was written. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
