[OAK-8803] AbstractLoginModule and subclasses: successful commit must not clear state information required for successful logout

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 1.22.0
• Component/s: auth-external, core, security, security-spi
• Assignee: Angela Schreiber
• Reporter: Angela Schreiber
• Created: 27/Nov/19 08:18
• Updated: 16/Jan/20 12:38
• Resolved: 28/Nov/19 07:45

Description

while working OAK-8710 in noticed that the main reason for the initial patch not work was the fact that subclasses of {AbstractLoginModule call clearState upon successful commit. this essentially clears all state information that is needed for a successful logout later on.... on the other hand it is crucial that subclasses of AbstractLoginModule close the system-session that was used for looking up principals during the commit phase.

proposed fix: add protected closeSystemSession method that can be used instead of clearState upon successful commit, leaving the clearState only for those cases where commit fails or abort is called, which require the complete state the be wiped out.

Issue Links

• blocks: OAK-8710 AbstractLoginModule#logout() must not remove 'foreign' principals/credentials