[JBoss JIRA] (SEAMSECURITY-121) [Regression] 3.1.0.Beta4 eats exceptions in IdentityImpl + returns RESPONSE_LOGIN_FAILED instead of RESPONSE_LOGIN_EXCEPTION
12:48 p.m.
[Regression] 3.1.0.Beta4 eats exceptions in IdentityImpl + returns RESPONSE_LOGIN_FAILED
instead of RESPONSE_LOGIN_EXCEPTION
----------------------------------------------------------------------------------------------------------------------------
Key: SEAMSECURITY-121
URL: https://issues.jboss.org/browse/SEAMSECURITY-121
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta4
Reporter: Geoffrey De Smet
Priority: Critical
Fix For: 3.1.0.Beta5
org.jboss.seam.security.IdentityImpl#authenticate line 237 eats exceptions:
{code}
} catch (Exception ex) {
authenticating = false;
if (ex instanceof AuthenticationException) throw (AuthenticationException)
ex;
return false;
}
{code}
As a result, my @PostConstruct weld exception isn't show in the log between these 2
lines:
{code}
INFO 26-10 12:05:00,849 (DemoAuthenticator.java:authenticate:65) Demo login for user
(admin) succeeded.
INFO 26-10 12:39:19,825 (SecurityServiceImpl.java:login:70) Logging in user [admin]
{code}
Extra bug:
{code}
public String login() {
try {
...
boolean success = authenticate();
...
return RESPONSE_LOGIN_FAILED;
} catch (Exception ex) { // Doesn't happen any more because authenticate() eat
the exception
...
return RESPONSE_LOGIN_EXCEPTION;
}
}
{code}
Regression since Beta3 in Beta4.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:56 p.m.
[
https://issues.jboss.org/browse/SEAMSECURITY-121?page=com.atlassian.jira....
]
Jason Porter commented on SEAMSECURITY-121:
-------------------------------------------
Looks to me like this would be a good place to pass the exception off to Solder Exception
Handling (formerly Seam Catch), thoughts?
[Regression] 3.1.0.Beta4 eats exceptions in IdentityImpl + returns
RESPONSE_LOGIN_FAILED instead of RESPONSE_LOGIN_EXCEPTION
----------------------------------------------------------------------------------------------------------------------------
Key: SEAMSECURITY-121
URL: https://issues.jboss.org/browse/SEAMSECURITY-121
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta4
Reporter: Geoffrey De Smet
Priority: Critical
Fix For: 3.1.0.Beta5
org.jboss.seam.security.IdentityImpl#authenticate line 237 eats exceptions:
{code}
} catch (Exception ex) {
authenticating = false;
if (ex instanceof AuthenticationException) throw (AuthenticationException)
ex;
return false;
}
{code}
As a result, my @PostConstruct weld exception isn't show in the log between these 2
lines:
{code}
INFO 26-10 12:05:00,849 (DemoAuthenticator.java:authenticate:65) Demo login for user
(admin) succeeded.
INFO 26-10 12:39:19,825 (SecurityServiceImpl.java:login:70) Logging in user [admin]
{code}
Extra bug:
{code}
public String login() {
try {
...
boolean success = authenticate();
...
return RESPONSE_LOGIN_FAILED;
} catch (Exception ex) { // Doesn't happen any more because authenticate()
eat the exception
...
return RESPONSE_LOGIN_EXCEPTION;
}
}
{code}
Regression since Beta3 in Beta4.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:09 p.m.
[
https://issues.jboss.org/browse/SEAMSECURITY-121?page=com.atlassian.jira....
]
Geoffrey De Smet commented on SEAMSECURITY-121:
-----------------------------------------------
Sound good, if nothing in seam-catch expects the user to be logged in.
[Regression] 3.1.0.Beta4 eats exceptions in IdentityImpl + returns
RESPONSE_LOGIN_FAILED instead of RESPONSE_LOGIN_EXCEPTION
----------------------------------------------------------------------------------------------------------------------------
Key: SEAMSECURITY-121
URL: https://issues.jboss.org/browse/SEAMSECURITY-121
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta4
Reporter: Geoffrey De Smet
Priority: Critical
Fix For: 3.1.0.Beta5
org.jboss.seam.security.IdentityImpl#authenticate line 237 eats exceptions:
{code}
} catch (Exception ex) {
authenticating = false;
if (ex instanceof AuthenticationException) throw (AuthenticationException)
ex;
return false;
}
{code}
As a result, my @PostConstruct weld exception isn't show in the log between these 2
lines:
{code}
INFO 26-10 12:05:00,849 (DemoAuthenticator.java:authenticate:65) Demo login for user
(admin) succeeded.
INFO 26-10 12:39:19,825 (SecurityServiceImpl.java:login:70) Logging in user [admin]
{code}
Extra bug:
{code}
public String login() {
try {
...
boolean success = authenticate();
...
return RESPONSE_LOGIN_FAILED;
} catch (Exception ex) { // Doesn't happen any more because authenticate()
eat the exception
...
return RESPONSE_LOGIN_EXCEPTION;
}
}
{code}
Regression since Beta3 in Beta4.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:20 p.m.
[
https://issues.jboss.org/browse/SEAMSECURITY-121?page=com.atlassian.jira....
]
Jason Porter commented on SEAMSECURITY-121:
-------------------------------------------
No, it does not. It's all about Exception Handling, however you want to do it.
[Regression] 3.1.0.Beta4 eats exceptions in IdentityImpl + returns
RESPONSE_LOGIN_FAILED instead of RESPONSE_LOGIN_EXCEPTION
----------------------------------------------------------------------------------------------------------------------------
Key: SEAMSECURITY-121
URL: https://issues.jboss.org/browse/SEAMSECURITY-121
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta4
Reporter: Geoffrey De Smet
Priority: Critical
Fix For: 3.1.0.Beta5
org.jboss.seam.security.IdentityImpl#authenticate line 237 eats exceptions:
{code}
} catch (Exception ex) {
authenticating = false;
if (ex instanceof AuthenticationException) throw (AuthenticationException)
ex;
return false;
}
{code}
As a result, my @PostConstruct weld exception isn't show in the log between these 2
lines:
{code}
INFO 26-10 12:05:00,849 (DemoAuthenticator.java:authenticate:65) Demo login for user
(admin) succeeded.
INFO 26-10 12:39:19,825 (SecurityServiceImpl.java:login:70) Logging in user [admin]
{code}
Extra bug:
{code}
public String login() {
try {
...
boolean success = authenticate();
...
return RESPONSE_LOGIN_FAILED;
} catch (Exception ex) { // Doesn't happen any more because authenticate()
eat the exception
...
return RESPONSE_LOGIN_EXCEPTION;
}
}
{code}
Regression since Beta3 in Beta4.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:55 a.m.
[
https://issues.jboss.org/browse/SEAMSECURITY-121?page=com.atlassian.jira....
]
Jason Porter commented on SEAMSECURITY-121:
-------------------------------------------
Actually, there's a LoginFailedEvent we could fire, would that be preferable?
[Regression] 3.1.0.Beta4 eats exceptions in IdentityImpl + returns
RESPONSE_LOGIN_FAILED instead of RESPONSE_LOGIN_EXCEPTION
----------------------------------------------------------------------------------------------------------------------------
Key: SEAMSECURITY-121
URL: https://issues.jboss.org/browse/SEAMSECURITY-121
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta4
Reporter: Geoffrey De Smet
Priority: Critical
Fix For: 3.1.0.Beta5
org.jboss.seam.security.IdentityImpl#authenticate line 237 eats exceptions:
{code}
} catch (Exception ex) {
authenticating = false;
if (ex instanceof AuthenticationException) throw (AuthenticationException)
ex;
return false;
}
{code}
As a result, my @PostConstruct weld exception isn't show in the log between these 2
lines:
{code}
INFO 26-10 12:05:00,849 (DemoAuthenticator.java:authenticate:65) Demo login for user
(admin) succeeded.
INFO 26-10 12:39:19,825 (SecurityServiceImpl.java:login:70) Logging in user [admin]
{code}
Extra bug:
{code}
public String login() {
try {
...
boolean success = authenticate();
...
return RESPONSE_LOGIN_FAILED;
} catch (Exception ex) { // Doesn't happen any more because authenticate()
eat the exception
...
return RESPONSE_LOGIN_EXCEPTION;
}
}
{code}
Regression since Beta3 in Beta4.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:03 a.m.
[
https://issues.jboss.org/browse/SEAMSECURITY-121?page=com.atlassian.jira....
]
Jason Porter commented on SEAMSECURITY-121:
-------------------------------------------
Going through the history, the regression you're experiencing was due to the fix for
SEAMSECURITY-103. I actually think this is more correct now that I think about it. I would
suggest catching any exception in your authenticator method and wrapping it in an
AuthorizationException so you receive the exception.
[Regression] 3.1.0.Beta4 eats exceptions in IdentityImpl + returns
RESPONSE_LOGIN_FAILED instead of RESPONSE_LOGIN_EXCEPTION
----------------------------------------------------------------------------------------------------------------------------
Key: SEAMSECURITY-121
URL: https://issues.jboss.org/browse/SEAMSECURITY-121
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta4
Reporter: Geoffrey De Smet
Priority: Critical
Fix For: 3.1.0.Beta5
org.jboss.seam.security.IdentityImpl#authenticate line 237 eats exceptions:
{code}
} catch (Exception ex) {
authenticating = false;
if (ex instanceof AuthenticationException) throw (AuthenticationException)
ex;
return false;
}
{code}
As a result, my @PostConstruct weld exception isn't show in the log between these 2
lines:
{code}
INFO 26-10 12:05:00,849 (DemoAuthenticator.java:authenticate:65) Demo login for user
(admin) succeeded.
INFO 26-10 12:39:19,825 (SecurityServiceImpl.java:login:70) Logging in user [admin]
{code}
Extra bug:
{code}
public String login() {
try {
...
boolean success = authenticate();
...
return RESPONSE_LOGIN_FAILED;
} catch (Exception ex) { // Doesn't happen any more because authenticate()
eat the exception
...
return RESPONSE_LOGIN_EXCEPTION;
}
}
{code}
Regression since Beta3 in Beta4.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:23 p.m.
[
https://issues.jboss.org/browse/SEAMSECURITY-121?page=com.atlassian.jira....
]
Geoffrey De Smet commented on SEAMSECURITY-121:
-----------------------------------------------
@Jason Even if that's the expected implementation behavior of an Authenticator (which
I don't think is a good idea), the IdentityImpl should be resistant to incorrect
Authenticator and should therefor *in no case eat the exception*.
Eating exceptions is really bad. Eating = catching but not logging xor retrowing it.
It hides failures and doesn't follow the fail-fast guideline.
[Regression] 3.1.0.Beta4 eats exceptions in IdentityImpl + returns
RESPONSE_LOGIN_FAILED instead of RESPONSE_LOGIN_EXCEPTION
----------------------------------------------------------------------------------------------------------------------------
Key: SEAMSECURITY-121
URL: https://issues.jboss.org/browse/SEAMSECURITY-121
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta4
Reporter: Geoffrey De Smet
Priority: Critical
Fix For: 3.1.0.Beta5
org.jboss.seam.security.IdentityImpl#authenticate line 237 eats exceptions:
{code}
} catch (Exception ex) {
authenticating = false;
if (ex instanceof AuthenticationException) throw (AuthenticationException)
ex;
return false;
}
{code}
As a result, my @PostConstruct weld exception isn't show in the log between these 2
lines:
{code}
INFO 26-10 12:05:00,849 (DemoAuthenticator.java:authenticate:65) Demo login for user
(admin) succeeded.
INFO 26-10 12:39:19,825 (SecurityServiceImpl.java:login:70) Logging in user [admin]
{code}
Extra bug:
{code}
public String login() {
try {
...
boolean success = authenticate();
...
return RESPONSE_LOGIN_FAILED;
} catch (Exception ex) { // Doesn't happen any more because authenticate()
eat the exception
...
return RESPONSE_LOGIN_EXCEPTION;
}
}
{code}
Regression since Beta3 in Beta4.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:02 p.m.
[
https://issues.jboss.org/browse/SEAMSECURITY-121?page=com.atlassian.jira....
]
Shane Bryzak updated SEAMSECURITY-121:
--------------------------------------
Fix Version/s: 3.1.0.Final
(was: 3.1.0.Beta5)
[Regression] 3.1.0.Beta4 eats exceptions in IdentityImpl + returns
RESPONSE_LOGIN_FAILED instead of RESPONSE_LOGIN_EXCEPTION
----------------------------------------------------------------------------------------------------------------------------
Key: SEAMSECURITY-121
URL: https://issues.jboss.org/browse/SEAMSECURITY-121
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta4
Reporter: Geoffrey De Smet
Priority: Critical
Fix For: 3.1.0.Final
org.jboss.seam.security.IdentityImpl#authenticate line 237 eats exceptions:
{code}
} catch (Exception ex) {
authenticating = false;
if (ex instanceof AuthenticationException) throw (AuthenticationException)
ex;
return false;
}
{code}
As a result, my @PostConstruct weld exception isn't show in the log between these 2
lines:
{code}
INFO 26-10 12:05:00,849 (DemoAuthenticator.java:authenticate:65) Demo login for user
(admin) succeeded.
INFO 26-10 12:39:19,825 (SecurityServiceImpl.java:login:70) Logging in user [admin]
{code}
Extra bug:
{code}
public String login() {
try {
...
boolean success = authenticate();
...
return RESPONSE_LOGIN_FAILED;
} catch (Exception ex) { // Doesn't happen any more because authenticate()
eat the exception
...
return RESPONSE_LOGIN_EXCEPTION;
}
}
{code}
Regression since Beta3 in Beta4.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:02 p.m.
[
https://issues.jboss.org/browse/SEAMSECURITY-121?page=com.atlassian.jira....
]
Shane Bryzak reassigned SEAMSECURITY-121:
-----------------------------------------
Assignee: Shane Bryzak
[Regression] 3.1.0.Beta4 eats exceptions in IdentityImpl + returns
RESPONSE_LOGIN_FAILED instead of RESPONSE_LOGIN_EXCEPTION
----------------------------------------------------------------------------------------------------------------------------
Key: SEAMSECURITY-121
URL: https://issues.jboss.org/browse/SEAMSECURITY-121
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta4
Reporter: Geoffrey De Smet
Assignee: Shane Bryzak
Priority: Critical
Fix For: 3.1.0.Final
org.jboss.seam.security.IdentityImpl#authenticate line 237 eats exceptions:
{code}
} catch (Exception ex) {
authenticating = false;
if (ex instanceof AuthenticationException) throw (AuthenticationException)
ex;
return false;
}
{code}
As a result, my @PostConstruct weld exception isn't show in the log between these 2
lines:
{code}
INFO 26-10 12:05:00,849 (DemoAuthenticator.java:authenticate:65) Demo login for user
(admin) succeeded.
INFO 26-10 12:39:19,825 (SecurityServiceImpl.java:login:70) Logging in user [admin]
{code}
Extra bug:
{code}
public String login() {
try {
...
boolean success = authenticate();
...
return RESPONSE_LOGIN_FAILED;
} catch (Exception ex) { // Doesn't happen any more because authenticate()
eat the exception
...
return RESPONSE_LOGIN_EXCEPTION;
}
}
{code}
Regression since Beta3 in Beta4.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:27 p.m.
[
https://issues.jboss.org/browse/SEAMSECURITY-121?page=com.atlassian.jira....
]
Shane Bryzak resolved SEAMSECURITY-121.
---------------------------------------
Resolution: Done
I've modified IdentityImpl so it no longer eats the exception.
[Regression] 3.1.0.Beta4 eats exceptions in IdentityImpl + returns
RESPONSE_LOGIN_FAILED instead of RESPONSE_LOGIN_EXCEPTION
----------------------------------------------------------------------------------------------------------------------------
Key: SEAMSECURITY-121
URL: https://issues.jboss.org/browse/SEAMSECURITY-121
Project: Seam Security
Issue Type: Bug
Affects Versions: 3.1.0.Beta4
Reporter: Geoffrey De Smet
Assignee: Shane Bryzak
Priority: Critical
Fix For: 3.1.0.Final
org.jboss.seam.security.IdentityImpl#authenticate line 237 eats exceptions:
{code}
} catch (Exception ex) {
authenticating = false;
if (ex instanceof AuthenticationException) throw (AuthenticationException)
ex;
return false;
}
{code}
As a result, my @PostConstruct weld exception isn't show in the log between these 2
lines:
{code}
INFO 26-10 12:05:00,849 (DemoAuthenticator.java:authenticate:65) Demo login for user
(admin) succeeded.
INFO 26-10 12:39:19,825 (SecurityServiceImpl.java:login:70) Logging in user [admin]
{code}
Extra bug:
{code}
public String login() {
try {
...
boolean success = authenticate();
...
return RESPONSE_LOGIN_FAILED;
} catch (Exception ex) { // Doesn't happen any more because authenticate()
eat the exception
...
return RESPONSE_LOGIN_EXCEPTION;
}
}
{code}
Regression since Beta3 in Beta4.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
4586
days inactive
4632
days old
9 comments
6 participants
participants (6)
-
Geoffrey De Smet (Commented) (JIRA) -
Geoffrey De Smet (Created) (JIRA)
-
Jason Porter (Commented) (JIRA)
-
Shane Bryzak (Assigned) (JIRA)
-
Shane Bryzak (Resolved) (JIRA)
-
Shane Bryzak (Updated) (JIRA)