[OAK-8802] ExternalLoginModule.commit will fail if no principals can be resolved for externalUser

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 1.22.0
• Component/s: auth-external, security
• Assignee: Angela Schreiber
• Reporter: Angela Schreiber
• Created: 27/Nov/19 07:47
• Updated: 16/Jan/20 12:38
• Resolved: 27/Nov/19 14:55

Description

while testing a potential patch for OAK-8710 i noticed that ExternalLoginModule.commit() will not succeed if AbstractLoginModule.getPrincipals returns an empty list. however, depending on the oak security setup there the principal lookup may not be able to resolve the given external ID while still being able to successfully login the given external user e.g. by means of login with a subject that has already been populated with the principals to be used.

i would suggest to let ExternalLoginModule.commit() succeed as soon as the externalUser field was set during the first login phase. authinfo and subject can then be populated accordingly.

Issue Links

• relates to: OAK-8710 AbstractLoginModule#logout() must not remove 'foreign' principals/credentials