Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Refactoring of ProviderManager to ensure that any AuthenticationException from the ConcurrentSessionController will prevent further polling of providers.

Browse Source
This commit is contained in:
Luke Taylor
2009-07-08 23:20:46 +00:00
parent d02bbbf560
commit 8a3930e673
2 changed files with 29 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
core/src/main/java/org/springframework/security/authentication/ProviderManager.java
View File

@@ -170,27 +170,34 @@ public class ProviderManager extends AbstractAuthenticationManager implements In
try {
result = provider.authenticate(authentication);
if (result != null) {
copyDetails(authentication, result);
sessionController.checkAuthenticationAllowed(result);
if (result == null) {
continue;
}
} catch (AuthenticationException ae) {
lastException = ae;
result = null;
} catch (AccountStatusException e) {
// SEC-546: Avoid polling additional providers if auth failure is due to invalid account status
lastException = e;
break;
} catch (AuthenticationException e) {
lastException = e;
continue;
}
// SEC-546: Avoid polling additional providers if auth failure is due to invalid account status or
// disallowed concurrent login.
if (lastException instanceof AccountStatusException || lastException instanceof ConcurrentLoginException) {
assert result != null;
copyDetails(authentication, result);
try {
sessionController.checkAuthenticationAllowed(result);
} catch (AuthenticationException e) {
// SEC-546: Avoid polling additional providers if concurrent login check fails
lastException = e;
break;
}
if (result != null) {
sessionController.registerSuccessfulAuthentication(result);
publishEvent(new AuthenticationSuccessEvent(result));
sessionController.registerSuccessfulAuthentication(result);
publishEvent(new AuthenticationSuccessEvent(result));
return result;
}
return result;
}
if (lastException == null) {