Restart required after changing password

• Key: DIRSERVER-782
• Type: Bug
• Status: Closed
• Resolution: Fixed
• Priority: Blocker
• Assignee: Alex Karasulu
• Reporter: Ate Douma
• Component/s: core
• Affects Version/s: 1.0
• Fix Version/s: 1.5.2

Description

AuthenticationService.invalidateAuthenticationCaches( LdapDN principalDn ) calls:
  authenticator.invalidateCache( getPrincipal().getJndiName() );

instead of (what I think it should do):
   authenticator.invalidateCache( principalDn );

This results in original credentials remaining in the Authenticator cache, blocking a user to login again after changing the credentials.

I'm trying to upgrade our Jetspeed-2 codebase to use the new ApacheDS 1.0.0 but this is a blocker right now.
(NB: another one is that we still build with maven-1..., I can't find any docs how to embed ApacheDS using maven-1, or -2 for that matter)

When I modified the AuthenticationService the way I think it should, the problem is solved.

Comments

[Emmanuel Lecharny]

I guess you *must* use the ADS jars, because of maven 1/maven 2 incompatibility ...

We will try to get a 1.0.1 out soon, and we also check to see if your modification can be applied right away.

[Ate Douma]

Right...
Well, we probably will drop the ApacheDS "embedded" feature from Jetspeed-2 and have the users run it themselves.
Ok, that would be great, thanks.

BTW: are you going to provide "normal" src and binary distributions too, besides now only binary setup dists?
I also thought that to be a requirement for ASF releases...

For development, I honestly don't need nor like to be forced to *install* ADS.

Regards,

Ate

[Ate Douma]

The weirdest thing:
I just replied *by mail* to the comment from Emmanuel, with 2 inline comments.
But somehow my mail was scanned and my comments extracted as new comment for this issue..., without context of course.
I certainly won't do that again :(

Anyway, because my previous comment is somewhat incomprehensible now, I'm providing it again below, not *with* context:

> I guess you *must* use the ADS jars, because of maven 1/maven 2 incompatibility ...
Right...
Well, we probably will drop the ApacheDS "embedded" feature from Jetspeed-2 and have the users run it themselves.

>
> We will try to get a 1.0.1 out soon, and we also check to see if your modification can be applied right away.
Ok, that would be great, thanks.
 
BTW: are you going to provide "normal" src and binary distributions too, besides now only binary setup dists?
I also thought that to be a requirement for ASF releases...
 
For development, I honestly don't need nor like to be forced to *install* ADS.

 

[Alex Karasulu]

Ate,

Having normal tar/zip balls is not an Apache release requirement. However it's a good thing to have. How about helping out over here to rig that into our build.

Thanks.

[Emmanuel Lecharny]

We need to investigate the implication of such a fix in the server.

Let's mark it as to be fixed for 1.0.1 and 1.5.0

[Alex Karasulu]

The following tests confirm that updates are correctly handled to invalidate the credential cache:

  o test11InvalidateCredentialCache
  o testDIRSERVER782

I just added the last test but both test cases test to make sure the cache is properly invalidated. Please confirm this bug no longer exists and if so I will open this JIRA issue again.

Thanks!

[Alberto Troisi]

The described problem seems still present in the ApacheDS 1.0.2 (used with Jetspeed 2.1.2).

Changing the AuthenticationService.invalidateAuthenticationCaches( LdapDN principalDn ) call from

  authenticator.invalidateCache( getPrincipal().getJndiName() );

to

   authenticator.invalidateCache( principalDn );

solve the problem.

[Alex Karasulu]

Recent changes in BigBang have fixed this issue.