[
https://issues.apache.org/jira/browse/CAMEL-24439?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen resolved CAMEL-24439.
---------------------------------
Resolution: Fixed
> camel-shiro - presented password is not verified when the thread subject
> already matches the username
> -----------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24439
> URL: https://issues.apache.org/jira/browse/CAMEL-24439
> Project: Camel
> Issue Type: Bug
> Components: camel-shiro
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> {{ShiroSecurityProcessor.authenticateUser()}}:
> {code:java}
> boolean authenticated = currentUser.isAuthenticated();
> boolean sameUser =
> securityToken.getUsername().equals(currentUser.getPrincipal());
> if (!authenticated || !sameUser) {
> UsernamePasswordToken token = new
> UsernamePasswordToken(securityToken.getUsername(),
> securityToken.getPassword());
> ...
> currentUser.login(token);
> }
> {code}
> {{login()}} - and therefore the credential check - runs only when the
> thread-bound Shiro subject is not already authenticated for the same
> username. When it is, the password carried by the incoming
> {{ShiroSecurityToken}} is never verified: the method treats "same principal
> name" as "same credentials".
> {{alwaysReauthenticate}} defaults to {{true}} and the processor calls
> {{logout()}} in a {{finally}} block, which hides the issue in the default
> configuration. But {{alwaysReauthenticate=false}} is a documented option, and
> in that mode the token is created with {{setRememberMe(true)}}, deliberately
> making subjects long-lived on Camel's shared worker threads - which is
> exactly when the skip can trigger.
> Proposal: always call {{login()}} with the presented token, or compare the
> presented credentials rather than only the principal name before deciding to
> skip. The username comparison also uses {{Object.equals}} against
> {{getPrincipal()}}, which is not necessarily a String.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
