Andrea Cosentino created CAMEL-24439:
----------------------------------------
Summary: camel-shiro - presented password is not verified when the
thread subject already matches the username
Key: CAMEL-24439
URL: https://issues.apache.org/jira/browse/CAMEL-24439
Project: Camel
Issue Type: Bug
Components: camel-shiro
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.23.0
{{ShiroSecurityProcessor.authenticateUser()}}:
{code:java}
boolean authenticated = currentUser.isAuthenticated();
boolean sameUser =
securityToken.getUsername().equals(currentUser.getPrincipal());
if (!authenticated || !sameUser) {
UsernamePasswordToken token = new
UsernamePasswordToken(securityToken.getUsername(), securityToken.getPassword());
...
currentUser.login(token);
}
{code}
{{login()}} - and therefore the credential check - runs only when the
thread-bound Shiro subject is not already authenticated for the same username.
When it is, the password carried by the incoming {{ShiroSecurityToken}} is
never verified: the method treats "same principal name" as "same credentials".
{{alwaysReauthenticate}} defaults to {{true}} and the processor calls
{{logout()}} in a {{finally}} block, which hides the issue in the default
configuration. But {{alwaysReauthenticate=false}} is a documented option, and
in that mode the token is created with {{setRememberMe(true)}}, deliberately
making subjects long-lived on Camel's shared worker threads - which is exactly
when the skip can trigger.
Proposal: always call {{login()}} with the presented token, or compare the
presented credentials rather than only the principal name before deciding to
skip. The username comparison also uses {{Object.equals}} against
{{getPrincipal()}}, which is not necessarily a String.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
