[CONTINUUM-1723] wrong password use and chaching during add maven2 project

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Cannot Reproduce
• Affects Version/s: 1.1
• Component/s: Integration - Maven 2, Security, Web interface
• Environment: linux system, plexus server, (maestro1.5.1 bundle)
• Assignee: Olivier Lamy
• Reporter: David Delbecq
• Created: 11/Apr/08 04:10
• Updated: 01/Jun/08 17:46
• Resolved: 01/Jun/08 17:46

Description

When adding a maven2 project, if the provided pom.xml url (first field of form) requires user / pass authentification and you type in the wrong password or wrong username, continuum caches it and will always use it for the rest of his life. As a result it's impossible to get the pom.xml, even if you type correct password in field.

Steps to reproduce

1. go to continuum server
2. Type url of a pom.xml that requires server "basic" authentification
3. Type in any user/pass for that url that is incorrect (eg: foo:bar)
4. Click add
5. Pages show up form again telling "there was a problem getting the pom.xml"
6. Type in correct user/password
7. Click add
8. Pages show up again telling same problem
9. logout, login, try again with correct user/password
10. Still impossible
11. Logout , close your browser, clean your cookies and everything
12. Login, try again with correct user/password
13. Still impossible
14. shutdown continuum server and it's JVM, restart it
15. Login, try again with correct user/password
16. Success!
17. Try to add a second project, with another url on same http server, with incorrect user/pass
18. Success!

As a conclusion, continuum caches somewhere the first user / pass, even if incorrect, and will reuse it everytime you access this server. This is a problem in an environment where multiple teams share a common continuum server, a common svn server (with different access rights at different project nodes) and have rights to add projects. The first team member to add a project will have have his user/password right forced to every other users trying to add project.

The only solution i found so far is, after adding a project, to shutdown the jvm hosting continuum and restart it.

Behind the scene:

sniffing of protocol show clearly that continuum, when "getting" the pom mentionned in add project, always uses the same basic authentification, whatever the user type in in user/pass boxes. It's always the first attempt that get used