[jboss-jira] [JBoss JIRA] (WFLY-2596) JASPI Web layer problems

[István Tóth (JIRA)]

István Tóth created WFLY-2596:
---------------------------------

             Summary: JASPI Web layer problems
                 Key: WFLY-2596
                 URL: https://issues.jboss.org/browse/WFLY-2596
             Project: WildFly
          Issue Type: Bug
      Security Level: Public (Everyone can see)
          Components: Web (Undertow)
    Affects Versions: 8.0.0.CR1
         Environment: Fedora 19, x86_64
            Reporter: István Tóth
            Assignee: Stuart Douglas


I have found several problems in the current (master, trunk) Wildfly JASPI Web layer implementation

Undertow related:
----------------------

 * It does not support pre-emptive authentication: 
When the ServerAuthenticationModule returns AUTH_SUCCESS and null userPrincipal, it should let the request fall through unathenticated, instead it is rejected.

 * It does not call secureResponse when the authentication was unsuccessful

 * It does not populate the org.jboss.security.SecurityContext, only the undertow Account structure.

 * It does not support the wrapper feature (Spec 3.8.3.5 and B.9)

The attached pull request aims to fix the first three issues.

Credits: This patch is based on Arjan Tijms' analysis, and suggested patches for the Jboss 7.X valve based authentitactor.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira