[jboss-cvs] JBossAS SVN: r91978 - in projects/security/security-jboss-sx/branches/Branch_2_0/jbosssx/src: test/java/org/jboss/test/authentication/jaas and 1 other directory.

[jboss-cvs-commits at lists.jboss.org]

Author: anil.saldhana at jboss.com
Date: 2009-08-04 17:23:24 -0400 (Tue, 04 Aug 2009)
New Revision: 91978

Modified:
   projects/security/security-jboss-sx/branches/Branch_2_0/jbosssx/src/main/java/org/jboss/security/ClientLoginModule.java
   projects/security/security-jboss-sx/branches/Branch_2_0/jbosssx/src/test/java/org/jboss/test/authentication/jaas/ClientLoginModuleUnitTestCase.java
Log:
SECURITY-339: ClientLoginModule abort should only pop principal info

Modified: projects/security/security-jboss-sx/branches/Branch_2_0/jbosssx/src/main/java/org/jboss/security/ClientLoginModule.java
===================================================================
--- projects/security/security-jboss-sx/branches/Branch_2_0/jbosssx/src/main/java/org/jboss/security/ClientLoginModule.java	2009-08-04 21:21:06 UTC (rev 91977)
+++ projects/security/security-jboss-sx/branches/Branch_2_0/jbosssx/src/main/java/org/jboss/security/ClientLoginModule.java	2009-08-04 21:23:24 UTC (rev 91978)
@@ -261,8 +261,8 @@
       else
       {
          // Clear the entire security association stack
-         SecurityAssociationActions.clear();  
-         SecurityAssociationActions.setSecurityContext(null);
+         SecurityAssociationActions.clear();
+         SecurityAssociationActions.popPrincipalInfo(); //SECURITY-339
       }
 
       return true;

Modified: projects/security/security-jboss-sx/branches/Branch_2_0/jbosssx/src/test/java/org/jboss/test/authentication/jaas/ClientLoginModuleUnitTestCase.java
===================================================================
--- projects/security/security-jboss-sx/branches/Branch_2_0/jbosssx/src/test/java/org/jboss/test/authentication/jaas/ClientLoginModuleUnitTestCase.java	2009-08-04 21:21:06 UTC (rev 91977)
+++ projects/security/security-jboss-sx/branches/Branch_2_0/jbosssx/src/test/java/org/jboss/test/authentication/jaas/ClientLoginModuleUnitTestCase.java	2009-08-04 21:23:24 UTC (rev 91978)
@@ -38,6 +38,7 @@
 import org.jboss.security.SecurityAssociation;
 import org.jboss.security.SecurityContext;
 import org.jboss.security.SecurityContextAssociation;
+import org.jboss.security.SecurityContextFactory;
 import org.jboss.security.SimplePrincipal;
 import org.jboss.security.auth.callback.UsernamePasswordHandler;
 
@@ -138,6 +139,17 @@
          return entry;
       }
       
+      AppConfigurationEntry[] testAbort()
+      {
+         String name = "org.jboss.security.ClientLoginModule";
+         HashMap<String,String> options = new HashMap<String,String>();
+         options.put("multi-threaded", "true"); 
+         AppConfigurationEntry ace = new AppConfigurationEntry(name,
+         AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, options);
+         AppConfigurationEntry[] entry = {ace};
+         return entry;
+      }
+      
    }
 
    public static Test suite() throws Exception
@@ -450,4 +462,31 @@
       }
    }
 
+   //SECURITY-339: ClientLoginModule abort should not clear security context
+   public void testAbort() throws Exception
+   {
+      SecurityContext sc = SecurityContextFactory.createSecurityContext("test");
+      SecurityContextAssociation.setSecurityContext(sc);
+      
+      //Failed Login
+      UsernamePasswordHandler handler = new UsernamePasswordHandler("jduke3", "BAD_PASSWORD");
+      LoginContext lc = new LoginContext("testAbort", handler);
+      lc.login();
+      Subject subject = lc.getSubject();
+      assertNotNull("Subject is not null", subject);
+      
+      assertTrue(SecurityContextAssociation.getSecurityContext() == null);
+      
+      
+      //Successful Login
+      SecurityContextAssociation.setSecurityContext(sc);
+      handler = new UsernamePasswordHandler("jduke3", "theduke3");
+      lc = new LoginContext("testAbort", handler);
+      lc.login();
+      subject = lc.getSubject();
+      assertNotNull("Subject is not null", subject);
+      
+      assertTrue(SecurityContextAssociation.getSecurityContext() != null);
+   }
+
 }