[jboss-jira] [JBoss JIRA] (SECURITY-900) Differently implemented password-stacking option in ClientLoginModule

[Darran Lofthouse (JIRA)]

    [ https://issues.jboss.org/browse/SECURITY-900?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13098875#comment-13098875 ] 

Darran Lofthouse commented on SECURITY-900:
-------------------------------------------

I am actually yet to see a valid use case where the ClientLoginModule is used in the same configuration as other login modules.

> Differently implemented password-stacking option in ClientLoginModule
> ---------------------------------------------------------------------
>
>                 Key: SECURITY-900
>                 URL: https://issues.jboss.org/browse/SECURITY-900
>             Project: PicketBox 
>          Issue Type: Bug
>    Affects Versions: PicketBox_4_9_2.Final
>            Reporter: Ondrej Lukas
>
> In case when some login module should use password stacking then value of password-stacking option should be set to useFirstPass. All login modules should respect it. However implemetation of org.jboss.security.ClientLoginModule uses password-stacking differently - it uses password stacking everytime when some value is set for password-stacking option (even value false). It should work same as other login modules. Current behavior can be confusing and can lead to incorrectly set server configuration.



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)