[jboss-jira] [JBoss JIRA] (SECURITY-900) Differently implemented password-stacking option in ClientLoginModule

[Martin Švehla (JIRA)]

     [ https://issues.jboss.org/browse/SECURITY-900?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Martin Švehla resolved SECURITY-900.
------------------------------------
    Resolution: Won't Fix


This issue is not backed by a valid use case and the difference in the login module behaviour is not a bug in this case.

> Differently implemented password-stacking option in ClientLoginModule
> ---------------------------------------------------------------------
>
>                 Key: SECURITY-900
>                 URL: https://issues.jboss.org/browse/SECURITY-900
>             Project: PicketBox 
>          Issue Type: Bug
>    Affects Versions: PicketBox_4_9_2.Final
>            Reporter: Ondrej Lukas
>
> In case when some login module should use password stacking then value of password-stacking option should be set to useFirstPass. All login modules should respect it. However implemetation of org.jboss.security.ClientLoginModule uses password-stacking differently - it uses password stacking everytime when some value is set for password-stacking option (even value false). It should work same as other login modules. Current behavior can be confusing and can lead to incorrectly set server configuration.



--
This message was sent by Atlassian JIRA
(v6.4.11#64026)