arimu1 opened a new pull request, #2855:
URL: https://github.com/apache/shiro/pull/2855
## Summary
Fixes #2818.
`AllowAllCredentialsMatcher` always returns `true` from
`doCredentialsMatch`, so it cannot provide decoy simulated credentials that
fail matching. When a multi-realm setup asks such a realm about an unknown
principal, `simulateFailedLogin` was treating the decoy as a misconfiguration
and logging a false `IncorrectCredentialsException` error on every login.
This change:
- Returns `Optional.empty()` from
`AllowAllCredentialsMatcher#createSimulatedCredentials()`
- Caches the opt-out in
`AuthenticatingRealm#ensureSimulatedAuthenticationInfo` so empty simulated
credentials are not re-requested on every lookup
- Skips the misconfiguration warning for `AllowAllCredentialsMatcher`, since
opting out is intentional
## Test plan
- [x] `mvn -pl core -am test
-Dtest=AllowAllCredentialsMatcherTest,AuthenticatingRealmJavaTest
-Dsurefire.failIfNoSpecifiedTests=false` (JDK 21)
- [x] Added regression test for unknown principal +
`AllowAllCredentialsMatcher`
- [x] Added test asserting `createSimulatedCredentials()` is empty
- [x] I hereby declare this contribution to be licenced under the [Apache
License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0)
Made with [Cursor](https://cursor.com)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
