[jboss-jira] [JBoss JIRA] (SECURITY-903) Differently implemented password-stacking option in ClientLoginModule

[Ryan Emerson (JIRA)]

     [ https://issues.jboss.org/browse/SECURITY-903?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Ryan Emerson resolved SECURITY-903.
-----------------------------------
    Fix Version/s: PicketBox_5_0_0.Beta1
       Resolution: Done


> Differently implemented password-stacking option in ClientLoginModule
> ---------------------------------------------------------------------
>
>                 Key: SECURITY-903
>                 URL: https://issues.jboss.org/browse/SECURITY-903
>             Project: PicketBox 
>          Issue Type: Bug
>            Reporter: Ryan Emerson
>            Assignee: Ryan Emerson
>             Fix For: PicketBox_5_0_0.Beta1
>
>
> From BZ:
> "In case when some login module should use password stacking then value of password-stacking option should be set to useFirstPass. All login modules should respect it. However implemetation of org.jboss.security.ClientLoginModule uses password-stacking differently - it uses password stacking everytime when some value is set for password-stacking option (even value false). It should work same as other login modules. Current behavior can be confusing and can lead to incorrectly set server configuration."



--
This message was sent by Atlassian JIRA
(v6.4.11#64026)