[OAK-3302] ExternalLoginModule:193 can never be reached

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Not A Problem
• Affects Version/s: 1.2.2
• Component/s: auth-external

Environment

AEM 6.1

• Assignee: Unassigned
• Reporter: Thorsten Biegner
• Created: 26/Aug/15 15:55
• Updated: 12/Feb/16 10:18
• Resolved: 11/Feb/16 15:49

Description

Starting at line 193 in Version 1.2.2 which shipped with AEM 6.1 this code can never be reached.

https://github.com/apache/jackrabbit-oak/blob/jackrabbit-oak-1.2.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/ExternalLoginModule.java#L189

sId = syncHandler.findIdentity(userMgr, userId);
// if there exists an authorizable with the given userid but is
// not an external one or if it belongs to another IDP, we just ignore it.
if (sId != null) {
Line 193 ExternalIdentityRef externalIdRef = sId.getExternalIdRef();
if (externalIdRef == null) {

Because when no ExternalReference is present sId will be null.
See https://github.com/apache/jackrabbit-oak/blob/jackrabbit-oak-1.2.2/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/DefaultSyncHandler.java#L187

Instead of being null it should return a SyncedIdentity with the ExternalIdRef set to null.

As far as I can see the same bug still exists in the current trunk see

https://github.com/apache/jackrabbit-oak/blob/trunk/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/ExternalLoginModule.java#L193

and

https://github.com/apache/jackrabbit-oak/blob/trunk/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/basic/DefaultSyncContext.java#L120