[GERONIMO-1201] All our login modules implement login() incorrectly

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.0-M5
• Fix Version/s: 1.0
• Component/s: security
• Security Level: public (Regular issues)
• Assignee: Aaron Mulder
• Reporter: Aaron Mulder
• Created: 19/Nov/05 13:10
• Updated: 07/Aug/06 15:04
• Resolved: 19/Nov/05 13:12

Description

According to the JAAS LoginModule contract, if a login fails, the LoginModule should throw an exception from the login() method (typically FailedLoginException). We instead return false, which does not mean "login failed", but instead means "this login module is not appropriate" (the stated example for returning false is a root login for an NIS login module).