[tomcat] branch 8.5.x updated: Take account of tomcatAuthorization for auth_type

[markt]

This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch 8.5.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/8.5.x by this push:
     new 4e85a4d9cc Take account of tomcatAuthorization for auth_type
4e85a4d9cc is described below

commit 4e85a4d9ccd79e18869b47cfbe2f977a02ae4369
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Thu Sep 21 22:21:22 2023 +0100

    Take account of tomcatAuthorization for auth_type
    
    This aligns the handling of auth_type (0x04) with that of remote_user
    (0x03).
---
 java/org/apache/coyote/ajp/AjpProcessor.java | 9 +++++----
 webapps/docs/changelog.xml                   | 6 ++++++
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/java/org/apache/coyote/ajp/AjpProcessor.java 
b/java/org/apache/coyote/ajp/AjpProcessor.java
index 2b14407e2c..76930461ca 100644
--- a/java/org/apache/coyote/ajp/AjpProcessor.java
+++ b/java/org/apache/coyote/ajp/AjpProcessor.java
@@ -899,11 +899,12 @@ public class AjpProcessor extends AbstractProcessor {
                     break;
 
                 case Constants.SC_A_AUTH_TYPE:
-                    if (tomcatAuthentication) {
-                        // ignore server
-                        requestHeaderMessage.getBytes(tmpMB);
-                    } else {
+                    if (tomcatAuthorization || !tomcatAuthentication) {
+                        // Implies tomcatAuthentication == false
                         requestHeaderMessage.getBytes(request.getAuthType());
+                    } else {
+                        // Ignore user information from reverse proxy
+                        requestHeaderMessage.getBytes(tmpMB);
                     }
                     break;
 
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index e4fa277eb7..5f7e8b2784 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -119,6 +119,12 @@
   </subsection>
   <subsection name="Coyote">
     <changelog>
+      <fix>
+        <bug>67198</bug>: Ensure that the AJP connector attribute
+        <code>tomcatAuthorization</code> takes precedence over the
+        <code>tomcatAuthentication</code> attribute when processing an
+        <code>auth_type</code> attribute received from a proxy server. (markt)
+      </fix>
       <fix>
         <bug>67235</bug>: Fix a <code>NullPointerException</code> when an
         <code>AsyncListener</code> handles an error with a dispatch rather than


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org