Fix https://bz.apache.org/bugzilla/show_bug.cgi?id=62547

JASPIC cleanSubject() was not called on logout when the authenticator was configured to cache the authenticated Principal.
Patch provided by Guillermo González de Agüero.
This closes #116

git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1837520 13f79535-47bb-0310-9956-ffa450edef68

java/org/apache/catalina/authenticator/AuthenticatorBase.java

@@ -810,7 +810,6 @@ private boolean authenticateJaspic(Request request, Response response, JaspicSta
                     !principal.getUserPrincipal().equals(request.getUserPrincipal())) {
                 // Skip registration if authentication credentials were
                 // cached and the Principal did not change.
-                request.setNote(Constants.REQ_JASPIC_SUBJECT_NOTE, client);
                 @SuppressWarnings("rawtypes")// JASPIC API uses raw types
                 Map map = state.messageInfo.getMap();
                 if (map != null && map.containsKey("javax.servlet.http.registerSession")) {
@@ -819,6 +818,7 @@ private boolean authenticateJaspic(Request request, Response response, JaspicSta
                     register(request, response, principal, "JASPIC", null, null);
                 }
             }
+            request.setNote(Constants.REQ_JASPIC_SUBJECT_NOTE, client);
             return true;
         }
         return false;

webapps/docs/changelog.xml

@@ -86,6 +86,11 @@
         Make logout more robust if JASPIC subject is unexpectedly unavailable.
         (markt)
       </add>
+      <fix>
+        <bug>62547</bug>: JASPIC <code>cleanSubject()</code> was not called on
+        logout when the authenticator was configured to cache the authenticated
+        Principal. Patch provided by Guillermo González de Agüero. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">