This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new f65306da73 Remove the roles on logout from the subject
f65306da73 is described below
commit f65306da73248bbedab7064513cb31de1ffec8b4
Author: remm <[email protected]>
AuthorDate: Fri May 22 15:57:08 2026 +0200
Remove the roles on logout from the subject
The main principal was removed, so it is best to be consistent.
---
.../apache/catalina/realm/JAASMemoryLoginModule.java | 19 +++++++++++++++++--
test/org/apache/catalina/realm/TestJAASRealm.java | 1 +
webapps/docs/changelog.xml | 4 ++++
3 files changed, 22 insertions(+), 2 deletions(-)
diff --git a/java/org/apache/catalina/realm/JAASMemoryLoginModule.java
b/java/org/apache/catalina/realm/JAASMemoryLoginModule.java
index 705565bcec..e60a900b25 100644
--- a/java/org/apache/catalina/realm/JAASMemoryLoginModule.java
+++ b/java/org/apache/catalina/realm/JAASMemoryLoginModule.java
@@ -19,6 +19,7 @@ package org.apache.catalina.realm;
import java.io.File;
import java.io.IOException;
import java.security.Principal;
+import java.util.HashSet;
import java.util.Map;
import java.util.Map.Entry;
@@ -105,6 +106,12 @@ public class JAASMemoryLoginModule extends MemoryRealm
implements LoginModule {
protected Principal principal = null;
+ /**
+ * The <code>Principal</code> for the roles.
+ */
+ protected HashSet<Principal> roles = null;
+
+
/**
* The state information that is shared with other configured
<code>LoginModule</code> instances.
*/
@@ -167,11 +174,13 @@ public class JAASMemoryLoginModule extends MemoryRealm
implements LoginModule {
// Add the roles as additional subjects as per the contract with
the
// JAASRealm
if (principal instanceof GenericPrincipal) {
+ this.roles = new HashSet<>();
String[] roles = ((GenericPrincipal) principal).getRoles();
for (String role : roles) {
- subject.getPrincipals().add(new GenericPrincipal(role));
+ GenericPrincipal roleGp = new GenericPrincipal(role);
+ subject.getPrincipals().add(roleGp);
+ this.roles.add(roleGp);
}
-
}
}
@@ -308,8 +317,14 @@ public class JAASMemoryLoginModule extends MemoryRealm
implements LoginModule {
@Override
public boolean logout() throws LoginException {
subject.getPrincipals().remove(principal);
+ if (principal instanceof GenericPrincipal) {
+ for (Principal role : roles) {
+ subject.getPrincipals().remove(role);
+ }
+ }
committed = false;
principal = null;
+ roles = null;
return true;
}
diff --git a/test/org/apache/catalina/realm/TestJAASRealm.java
b/test/org/apache/catalina/realm/TestJAASRealm.java
index b309baffd9..49ab665ff9 100644
--- a/test/org/apache/catalina/realm/TestJAASRealm.java
+++ b/test/org/apache/catalina/realm/TestJAASRealm.java
@@ -112,6 +112,7 @@ public class TestJAASRealm extends TomcatBaseTest {
Assert.assertTrue(p instanceof GenericPrincipal);
GenericPrincipal gp = (GenericPrincipal) p;
Assert.assertTrue(gp.hasRole("testrole"));
+ gp.logout();
}
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index acf8c725aa..d4624ed9aa 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -264,6 +264,10 @@
Remove exception swallowing in <code>DataSourceStore</code> to align
it with <code>FileStore</code> and avoid session loss on errors. (remm)
</fix>
+ <fix>
+ On JAAS logout, clear out role principals on the subject that were
+ added on commit, as recommended by the JAAS specification. (remm)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
