[infinispan-issues] [JBoss JIRA] (ISPN-4306) HR client auth over kerberos has wrong AccessControlContext

[Tristan Tarrant (JIRA)]

     [ https://issues.jboss.org/browse/ISPN-4306?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Tristan Tarrant updated ISPN-4306:
----------------------------------

              Status: Pull Request Sent  (was: Open)
    Git Pull Request: https://github.com/infinispan/infinispan/pull/2578


> HR client auth over kerberos has wrong AccessControlContext
> -----------------------------------------------------------
>
>                 Key: ISPN-4306
>                 URL: https://issues.jboss.org/browse/ISPN-4306
>             Project: Infinispan
>          Issue Type: Bug
>          Components: Test Suite - Server
>            Reporter: Vojtech Juranek
>            Assignee: Tristan Tarrant
>
> When HotRod client authneticate to HR server via kerberos, HR server obtains wrong {{AccessControlContext}}, which doesn't contain appropriate subject (to be more clear it's in [AuthorizationManagerImpl.checkPermission()|https://github.com/infinispan/infinispan/blob/master/core/src/main/java/org/infinispan/security/impl/AuthorizationManagerImpl.java#L49]). Returned subject is {{null}} and moreover this default {{AccessControlContext}} allows to do anything, so effectively the HR client can do anything, no matter what the permissions are.
> Need to mention that in this case java {{SecurityManager}} is turned off, but as the same setup works with e.g. MD5 auth, we should keep some consistency and it shouldn't work in any case (and {{SecurityManager}} to be turned on should be a hard requirement to ISPN auth works) or it should work also in case of krb auth.



--
This message was sent by Atlassian JIRA
(v6.2.3#6260)