Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
JASPIC cleanSubject() was not called on logout when the authenticator was configured to cache the authenticated Principal.
Patch provided by Guillermo González de Agüero.
This closes #116

git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1837520 13f79535-47bb-0310-9956-ffa450edef68
  • Loading branch information
markt-asf committed Aug 6, 2018
1 parent a68c468 commit 0757533
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -810,7 +810,6 @@ private boolean authenticateJaspic(Request request, Response response, JaspicSta
!principal.getUserPrincipal().equals(request.getUserPrincipal())) {
// Skip registration if authentication credentials were
// cached and the Principal did not change.
request.setNote(Constants.REQ_JASPIC_SUBJECT_NOTE, client);
@SuppressWarnings("rawtypes")// JASPIC API uses raw types
Map map = state.messageInfo.getMap();
if (map != null && map.containsKey("javax.servlet.http.registerSession")) {
Expand All @@ -819,6 +818,7 @@ private boolean authenticateJaspic(Request request, Response response, JaspicSta
register(request, response, principal, "JASPIC", null, null);
}
}
request.setNote(Constants.REQ_JASPIC_SUBJECT_NOTE, client);
return true;
}
return false;
Expand Down
5 changes: 5 additions & 0 deletions webapps/docs/changelog.xml
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,11 @@
Make logout more robust if JASPIC subject is unexpectedly unavailable.
(markt)
</add>
<fix>
<bug>62547</bug>: JASPIC <code>cleanSubject()</code> was not called on
logout when the authenticator was configured to cache the authenticated
Principal. Patch provided by Guillermo González de Agüero. (markt)
</fix>
</changelog>
</subsection>
<subsection name="Coyote">
Expand Down

0 comments on commit 0757533

Please sign in to comment.