Critical Description
Since 8.5.50 and 9.0.30, the fediz tomcat valve stop working.
With these versions of tomcat the authentication never succeed, even with correct credentials, and fall in an infinite redirect loop between tomcat and the IDP server.
This behavior is due to matchRequest from FormAuthenticator is always returning false.
A security fix has been applied to FormAuthenticator:
Refactor FORM authentication to reduce duplicate code and to ensure that the authenticated Principal is not cached in the session when caching is disabled. (markt)
Which has been done with this commit
