[
https://issues.apache.org/jira/browse/OAK-8710?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16973240#comment-16973240
]
Angela Schreiber edited comment on OAK-8710 at 11/13/19 10:58 AM:
------------------------------------------------------------------
[~reschke], i don't need it in a maintenance branch and would just fix it in
1.20.0. also it was manfred that spotted the issues and pointed to the
specification... but it seems in the meantime the issue he is investigating is
_not_ caused by the logout.... so, you would have to ask him.
and btw: i don't think this can be fixed without API changes (except for
removing AbstractLoginModule.logout altogether, which would essentially break
subclasses not contained in oak)
was (Author: anchela):
[~reschke], i don't need it in a maintenance branch and would just fix it in
1.20.0. also it was manfred that spotted the issues and pointed to the
specification... but it seems in the meantime the issue he is investigating is
_not_ caused by the logout.... so, you would have to ask him.
> AbstractLoginModule#logout() must not remove 'foreign' principals/credentials
> ------------------------------------------------------------------------------
>
> Key: OAK-8710
> URL: https://issues.apache.org/jira/browse/OAK-8710
> Project: Jackrabbit Oak
> Issue Type: Bug
> Components: auth-external, core, security-spi
> Reporter: Manfred Baedke
> Assignee: Angela Schreiber
> Priority: Major
> Fix For: 1.20.0
>
> Attachments: OAK-8710.patch, logout.png
>
>
> See
> https://github.com/apache/jackrabbit-oak/blob/9569d659f0655d3ba16c1cfe1fbb5f53959f701f/oak-security-spi/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/AbstractLoginModule.java#L189:
> The criterion for logout() to succeed is
> {code}!subject.getPrincipals().isEmpty() &&
> !subject.getPublicCredentials(Credentials.class).isEmpty(){code}
> This did not work in a case where the subject was created by a thread
> handling an authenticated JMX connection (and later passed on to other
> threads due to AccessControlContext inheritage).
> I'd propose to make logout() succeed unconditionally, but I'm not entirely
> sure about side effects.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
