This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/10.1.x by this push:
new a6426ff1f7 Remove the roles on logout from the subject
a6426ff1f7 is described below
commit a6426ff1f759dbdbff73bafb40e282823af82ad5
Author: remm <[email protected]>
AuthorDate: Fri May 22 15:57:08 2026 +0200
Remove the roles on logout from the subject
The main principal was removed, so it is best to be consistent.
---
.../apache/catalina/realm/JAASMemoryLoginModule.java | 19 +++++++++++++++++--
test/org/apache/catalina/realm/TestJAASRealm.java | 1 +
webapps/docs/changelog.xml | 4 ++++
3 files changed, 22 insertions(+), 2 deletions(-)
diff --git a/java/org/apache/catalina/realm/JAASMemoryLoginModule.java
b/java/org/apache/catalina/realm/JAASMemoryLoginModule.java
index 705565bcec..e60a900b25 100644
--- a/java/org/apache/catalina/realm/JAASMemoryLoginModule.java
+++ b/java/org/apache/catalina/realm/JAASMemoryLoginModule.java
@@ -19,6 +19,7 @@ package org.apache.catalina.realm;
import java.io.File;
import java.io.IOException;
import java.security.Principal;
+import java.util.HashSet;
import java.util.Map;
import java.util.Map.Entry;
@@ -105,6 +106,12 @@ public class JAASMemoryLoginModule extends MemoryRealm
implements LoginModule {
protected Principal principal = null;
+ /**
+ * The <code>Principal</code> for the roles.
+ */
+ protected HashSet<Principal> roles = null;
+
+
/**
* The state information that is shared with other configured
<code>LoginModule</code> instances.
*/
@@ -167,11 +174,13 @@ public class JAASMemoryLoginModule extends MemoryRealm
implements LoginModule {
// Add the roles as additional subjects as per the contract with
the
// JAASRealm
if (principal instanceof GenericPrincipal) {
+ this.roles = new HashSet<>();
String[] roles = ((GenericPrincipal) principal).getRoles();
for (String role : roles) {
- subject.getPrincipals().add(new GenericPrincipal(role));
+ GenericPrincipal roleGp = new GenericPrincipal(role);
+ subject.getPrincipals().add(roleGp);
+ this.roles.add(roleGp);
}
-
}
}
@@ -308,8 +317,14 @@ public class JAASMemoryLoginModule extends MemoryRealm
implements LoginModule {
@Override
public boolean logout() throws LoginException {
subject.getPrincipals().remove(principal);
+ if (principal instanceof GenericPrincipal) {
+ for (Principal role : roles) {
+ subject.getPrincipals().remove(role);
+ }
+ }
committed = false;
principal = null;
+ roles = null;
return true;
}
diff --git a/test/org/apache/catalina/realm/TestJAASRealm.java
b/test/org/apache/catalina/realm/TestJAASRealm.java
index b309baffd9..49ab665ff9 100644
--- a/test/org/apache/catalina/realm/TestJAASRealm.java
+++ b/test/org/apache/catalina/realm/TestJAASRealm.java
@@ -112,6 +112,7 @@ public class TestJAASRealm extends TomcatBaseTest {
Assert.assertTrue(p instanceof GenericPrincipal);
GenericPrincipal gp = (GenericPrincipal) p;
Assert.assertTrue(gp.hasRole("testrole"));
+ gp.logout();
}
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 8be2839488..f90dd66123 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -164,6 +164,10 @@
Add support for single-quote escaped literal as well as quoted literals
in <code>DateFormatCache</code>. (schultz)
</fix>
+ <fix>
+ On JAAS logout, clear out role principals on the subject that were
+ added on commit, as recommended by the JAAS specification. (remm)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
