[OAK-8710] AbstractLoginModule#logout() must not remove 'foreign' principals/credentials

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 1.22.0
• Component/s: auth-external, core, security-spi
• Assignee: Angela Schreiber
• Reporter: Manfred Baedke
• Created: 22/Oct/19 13:12
• Updated: 16/Jan/20 12:38
• Resolved: 28/Nov/19 15:56

Description

See https://github.com/apache/jackrabbit-oak/blob/9569d659f0655d3ba16c1cfe1fbb5f53959f701f/oak-security-spi/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/AbstractLoginModule.java#L189:

The criterion for logout() to succeed is

!subject.getPrincipals().isEmpty() && !subject.getPublicCredentials(Credentials.class).isEmpty()

This did not work in a case where the subject was created by a thread handling an authenticated JMX connection (and later passed on to other threads due to AccessControlContext inheritage).

I'd propose to make logout() succeed unconditionally, but I'm not entirely sure about side effects.

Issue Links

• is blocked by: OAK-8803 AbstractLoginModule and subclasses: successful commit must not clear state information required for successful logout
• is related to: OAK-8763 LoginContextProviderImpl uses any subject found in the AccessControlContext.
• is related to: OAK-8800 TokenLoginModule does not add principals from subject to AuthInfo
• is related to: OAK-8801 LoginModuleImpl will not populate auth info if subject is readonly
• is related to: OAK-8802 ExternalLoginModule.commit will fail if no principals can be resolved for externalUser
• is related to: OAK-8804 AuthInfoImpl: add constructor with iterable-principals instead of set
• supercedes: OAK-8404 AbstractLoginModule#logout() may fail for impersonated users whose subject provides admin credentials