[infinispan-issues] [JBoss JIRA] (ISPN-4306) HR client auth over kerberos has wrong AccessControlContext

[Vojtech Juranek (JIRA)]

Vojtech Juranek created ISPN-4306:
-------------------------------------

             Summary: HR client auth over kerberos has wrong AccessControlContext
                 Key: ISPN-4306
                 URL: https://issues.jboss.org/browse/ISPN-4306
             Project: Infinispan
          Issue Type: Bug
          Components: Test Suite - Server
            Reporter: Vojtech Juranek
            Assignee: Mircea Markus


When HotRod client authneticate to HR server via kerberos, HR server obtains wrong {{AccessControlContext}}, which doesn't contain appropriate subject (to be more clear it's in [AuthorizationManagerImpl.checkPermission()|https://github.com/infinispan/infinispan/blob/master/core/src/main/java/org/infinispan/security/impl/AuthorizationManagerImpl.java#L49]). Returned subject is {{null}} and moreover this default {{AccessControlContext}} allows to do anything, so effectively the HR client can do anything, no matter what the permissions are.

Need to mention that in this case java {{SecurityManager}} is turned off, but as the same setup works with e.g. MD5 auth, we should keep some consistency and it shouldn't work in any case (and {{SecurityManager}} to be turned on should be a hard requirement to ISPN auth works) or it should work also in case of krb auth.



--
This message was sent by Atlassian JIRA
(v6.2.3#6260)