[KARAF-2914] JAAS JDBCBackingEngineFactory: Wrong query from the configuration

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.0
• Fix Version/s: 2.4.0, 3.0.2, 2.3.6, 4.0.0.M3
• Component/s: karaf
• Assignee: Freeman Fang
• Reporter: Mike Hummel
• Created: 15/Apr/14 13:54
• Updated: 15/Sep/18 05:45
• Resolved: 16/Apr/14 02:11

Description

In JDBCBackingEngineFactory is in line 49 the following code:

String selectUsersQuery = (String) options.get(JDBCLoginModule.PASSWORD_QUERY);

PASSWORD_QUERY is ""SELECT PASSWORD FROM USERS WHERE USERNAME=?

but selectUserQuery should be "SELECT USERNAME FROM USERS"

looks like a mismatch.

The correct code should be:

String selectUsersQuery = (String) options.get(JDBCLoginModule.USER_QUERY);

in JDBCLoginModule.java:
public static final String USER_QUERY = "query.user"

and you need a separate selectPasswordQuery attribute.