craigmcc 01/08/03 15:39:33 Modified: catalina/src/share/org/apache/catalina/authenticator AuthenticatorBase.java SingleSignOn.java Log: Revert sending the username and password as request notes. This is not the correct strategy, because it makes the web layer dependent on unspecified limitations in the EJB layer's model. Instead, the Realm implemented by the J2EE container should maintain enough state so that correct user identity can be established even when the web layer caches user principals in the user's session. Revision Changes Path 1.23 +4 -12 jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/authenticator/AuthenticatorBase.java Index: AuthenticatorBase.java =================================================================== RCS file: /home/cvs/jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/authenticator/AuthenticatorBase.java,v retrieving revision 1.22 retrieving revision 1.23 diff -u -r1.22 -r1.23 --- AuthenticatorBase.java 2001/08/01 03:04:04 1.22 +++ AuthenticatorBase.java 2001/08/03 22:39:33 1.23 @@ -1,7 +1,7 @@ /* - * $Header: /home/cvs/jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/authenticator/AuthenticatorBase.java,v 1.22 2001/08/01 03:04:04 craigmcc Exp $ - * $Revision: 1.22 $ - * $Date: 2001/08/01 03:04:04 $ + * $Header: /home/cvs/jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/authenticator/AuthenticatorBase.java,v 1.23 2001/08/03 22:39:33 craigmcc Exp $ + * $Revision: 1.23 $ + * $Date: 2001/08/03 22:39:33 $ * * ==================================================================== * @@ -121,7 +121,7 @@ * requests. Requests of any other type will simply be passed through. * * @author Craig R. McClanahan - * @version $Revision: 1.22 $ $Date: 2001/08/01 03:04:04 $ + * @version $Revision: 1.23 $ $Date: 2001/08/03 22:39:33 $ */ @@ -965,14 +965,6 @@ // Cache the authentication information in our request request.setAuthType(authType); request.setUserPrincipal(principal); - if (username != null) - request.setNote(Constants.REQ_USERNAME_NOTE, username); - else - request.removeNote(Constants.REQ_USERNAME_NOTE); - if (password != null) - request.setNote(Constants.REQ_PASSWORD_NOTE, password); - else - request.removeNote(Constants.REQ_PASSWORD_NOTE); // Cache the authentication information in our session, if any if (cache) { 1.9 +4 -12 jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/authenticator/SingleSignOn.java Index: SingleSignOn.java =================================================================== RCS file: /home/cvs/jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/authenticator/SingleSignOn.java,v retrieving revision 1.8 retrieving revision 1.9 diff -u -r1.8 -r1.9 --- SingleSignOn.java 2001/08/01 03:04:04 1.8 +++ SingleSignOn.java 2001/08/03 22:39:33 1.9 @@ -1,7 +1,7 @@ /* - * $Header: /home/cvs/jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/authenticator/SingleSignOn.java,v 1.8 2001/08/01 03:04:04 craigmcc Exp $ - * $Revision: 1.8 $ - * $Date: 2001/08/01 03:04:04 $ + * $Header: /home/cvs/jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/authenticator/SingleSignOn.java,v 1.9 2001/08/03 22:39:33 craigmcc Exp $ + * $Revision: 1.9 $ + * $Date: 2001/08/03 22:39:33 $ * * ==================================================================== * @@ -109,7 +109,7 @@ * </ul> * * @author Craig R. McClanahan - * @version $Revision: 1.8 $ $Date: 2001/08/01 03:04:04 $ + * @version $Revision: 1.9 $ $Date: 2001/08/03 22:39:33 $ */ public class SingleSignOn @@ -381,14 +381,6 @@ request.setNote(Constants.REQ_SSOID_NOTE, cookie.getValue()); ((HttpRequest) request).setAuthType(entry.authType); ((HttpRequest) request).setUserPrincipal(entry.principal); - if (entry.username != null) - request.setNote(Constants.REQ_USERNAME_NOTE, entry.username); - else - request.removeNote(Constants.REQ_USERNAME_NOTE); - if (entry.password != null) - request.setNote(Constants.REQ_PASSWORD_NOTE, entry.password); - else - request.removeNote(Constants.REQ_PASSWORD_NOTE); } else { if (debug >= 1) log(" No cached principal found, erasing SSO cookie");