natalia-s-ivanova commented on PR #819:
URL: https://github.com/apache/tomcat/pull/819#issuecomment-2668518211
> 2. If user/password auth is attempted when `authentication="GSSAPI"` then
remove the environment properties that configured GSSAPI, perform user/password
authentication and then restore the GSSAPI environment properties. We already
do the inverse when performing SPNEGO authentication.
We also had a similar quick fix of it for such kind of application, still
not sure that this such kind of fix should be in general code:
```
public class MixedSpnegoLdapJNDIRealm extends JNDIRealm {
protected boolean checkCredentials(DirContext context, User user, String
credentials) throws NamingException {
boolean validated;
if (userPassword == null) {
Hashtable<?, ?> preservedEnvironment = context.getEnvironment();
context.removeFromEnvironment(SECURITY_AUTHENTICATION);
validated = bindAsUser(context, user, credentials);
context.addToEnvironment(SECURITY_AUTHENTICATION,
preservedEnvironment.get(SECURITY_AUTHENTICATION));
} else {
validated = compareCredentials(context, user, credentials);
}
....
return validated;
}
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
