[SHIRO-462] Authentication exceptions are swallowed

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.2.2
• Fix Version/s: 1.2.5
• Component/s: Authentication (log-in)
• Assignee: Unassigned
• Reporter: Art O Cathain
• Created: 08/Oct/13 08:09
• Updated: 08/Nov/16 16:45
• Resolved: 12/May/16 01:08

Description

In org.apache.shiro.cas.CasFilter.onLoginFailure(AuthenticationToken, AuthenticationException, ServletRequest, ServletResponse) the passed-in AuthenticationException is not logged anywhere. In my case, a misconfigured SSL certificate error was being swallowed. The lack of logging meant I had to use a debugger to see the exception details.

There is a similar issue with the other override of this method, in org.apache.shiro.web.filter.authc.FormAuthenticationFilter.

Suggest logging at debug level (which is off by default in sensible setups, but can be enabled during investigations). See attached patch.

Issue Links

• is duplicated by: SHIRO-427 No log when have exception
• is related to: SHIRO-592 ModularRealmAuthenticator causes log spam when one realm throws exception