[ACCUMULO-2700] SecurityOperation.authenticateSystemUser fails to properly validate system user

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 1.6.0
• Labels: 16_qa_bug findbugs
• Assignee: Christopher Tubbs
• Reporter: Christopher Tubbs
• Created: 18/Apr/14 20:52
• Updated: 23/Apr/14 16:45
• Resolved: 21/Apr/14 20:12

Description

FindBugs found in the 1.6.0-SNAPSHOT branch that SecurityOperation.authenticateSystemUser(TCredentials credentials) does an improper comparison (equals) between AuthenticationToken and byte array.

Additionally, upon visual inspection, it looks like the condition is not'd (missing a ! to throw the exception when the credentials don't match).

The result appears to be that the system user is always authenticated, even if the credentials don't match. I haven't checked 1.5 yet to see if the bug applies there also.