Hi,
I am cancelling this vote because of the regression Eric found. The parameter fallback added for SLING-13025 also runs when anonymous access is granted, before a resource resolver is on the request. A login page carrying ?resource=... then fails with a NullPointerException in AuthUtil.getMappedLoginResourcePath. A plain null check would not be enough either: on that path the login page would be redirected to the protected resource, which loops. I will fix this under SLING-13389, add tests for the anonymous path and also take care of Stefan's point: SLING-13257 is resolved now and will be in the release notes of the next candidate. The staging repository orgapachesling-3127 is dropped and the tag org.apache.sling.auth.core-2.1.0 removed. The next candidate will be 2.1.2. Thanks Norman and apologies for not having tested the contributions more thoroughly. Andrei On Thu, Oct 8, 2026 at 10:42 PM Eric Norman <[email protected]> wrote: > -1 for me since updating to this one in the starter project results in new > NPE when attempting to render the custom form login page > > Below is the stack trace that was logged: > > 08.10.2026 13:36:20.202 *ERROR* [qtp691698687-65] org.apache.felix.http > Exception while processing request to /starter.login.html > java.lang.NullPointerException: Cannot invoke > > "org.apache.sling.api.resource.ResourceResolver.map(jakarta.servlet.http.HttpServletRequest, > String)" because the return value of > > "org.apache.sling.auth.core.AuthUtil.getResourceResolver(jakarta.servlet.http.HttpServletRequest)" > is null > at > > org.apache.sling.auth.core.AuthUtil.getMappedLoginResourcePath(AuthUtil.java:227) > [org.apache.sling.auth.core:2.1.0] > at > > org.apache.sling.auth.core.spi.DefaultJakartaAuthenticationFeedbackHandler.getValidatedRedirectTarget(DefaultJakartaAuthenticationFeedbackHandler.java:105) > [org.apache.sling.auth.core:2.1.0] > at > > org.apache.sling.auth.core.spi.DefaultJakartaAuthenticationFeedbackHandler.handleRedirect(DefaultJakartaAuthenticationFeedbackHandler.java:80) > [org.apache.sling.auth.core:2.1.0] > at > > org.apache.sling.auth.core.impl.SlingAuthenticator.getAnonymousResolver(SlingAuthenticator.java:920) > [org.apache.sling.auth.core:2.1.0] > at > > org.apache.sling.auth.core.impl.SlingAuthenticator.doHandleSecurity(SlingAuthenticator.java:552) > [org.apache.sling.auth.core:2.1.0] > at > > org.apache.sling.auth.core.impl.SlingAuthenticator.handleSecurity(SlingAuthenticator.java:494) > [org.apache.sling.auth.core:2.1.0] > at > > org.apache.sling.engine.impl.SlingHttpContext.handleSecurity(SlingHttpContext.java:121) > [org.apache.sling.engine:3.0.4] > ... > > Regards, > Eric > > On Wed, Oct 7, 2026 at 5:48 AM Andrei Dulvac <[email protected]> > wrote: > > > [VOTE] Release Apache Sling Auth Core version 2.1.0 > > > > Hi, > > > > We solved 2 issues in this release: > > > > > https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310710&version=12356686&styleName=Text > > > > Staging repository: > > https://repository.apache.org/content/repositories/orgapachesling-3127/ > > > > You can use this UNIX script to download the release and verify the > > signatures: > > > > > https://raw.githubusercontent.com/apache/sling-tooling-release/master/check_staged_release.sh > > > > Usage: > > sh check_staged_release.sh 3127 /tmp/sling-staging > > > > Please vote to approve this release: > > > > [ ] +1 Approve the release > > [ ] 0 Don't care > > [ ] -1 Don't release, because ... > > > > This majority vote is open for at least 72 hours. > > > > - Andrei > > >
