Bugs item #476757, was opened at 2001-10-31 05:26
You can respond by visiting:
http://sourceforge.net/tracker/?func=detail&atid=376685&aid=476757&group_id=22866
Category: CatalinaBundle
Group: v2.4 (stable)
Status: Open
Resolution: None
Priority: 5
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Scott M Stark (starksm)
Summary: JDBCRealm and JBossSecurityMgrRealm prob
Initial Comment:
Hi guys,
Just a note to say i have found a bug related
to the JBoss-Tomcat integration.
If you add the tomcat JDBC realm interceptor to
authenticate webapps from a JDBC source only usernames
are authenticated (ie as long as the username is valid
you will be logged on regardless of password entered).
This is because there is another Realm manager
(JBossSecurityMgrRealm) installed in server.xml by
default when installing the bundle. These 2 realm
managers conflict in the following way...
The Tomcat JDBCRealm sets a remote user in the Request
object (interface of RequestImpl class) that is passed
to it in the authenticate method if authentication
succeeds otherwise the value is null. When it comes to
loading the roles from the database the JDBCRealm
checks this request remote user value and if it is
null it knows the user is not authenticated. Otherwise
it loads the roles associated with that user.
The problem is that the JBossSecurityManager realm
sets this value WITHOUT checking if the user is has
typed the correct password, effectivly bypassing the
password check.
I have solved the problem temporarily by commenting
the JBossSecurity Realm and using the JDBCRealm in
tomcat, however i am unsure of the long term effects
of this.
I hope this was clear (i did try) if not feel free to
drop me a mail with any questions.
----------------------------------------------------------------------
You can respond by visiting:
http://sourceforge.net/tracker/?func=detail&atid=376685&aid=476757&group_id=22866
_______________________________________________
Jboss-development mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/jboss-development
